refactor(api-proxy): extract shared Google API-key adapter factory for Gemini and Vertex by Copilot · Pull Request #5927 · github/gh-aw-firewall

Copilot · 2026-07-05T12:50:24Z

Gemini and Vertex each duplicated ~45 lines of identical Google provider scaffolding: createProviderAuthScaffold, x-goog-api-key header construction, createAdapterMethods, buildProviderAdapter, isEnabled, and unconfigured responses — all in a credential-injection path.

Changes

New providers/google-adapter.js — createGoogleApiKeyAdapter(env, deps, opts) factory that owns the shared scaffold. Callers supply only the provider-specific options:

function createGeminiAdapter(env, deps = {}) {
  return createGoogleApiKeyAdapter(env, deps, {
    name: 'gemini',
    port: 10003,
    envConstants: GEMINI_ENV,
    defaultTarget: 'generativelanguage.googleapis.com',
    validationPath: '/v1beta/models',
    modelsPath: '/v1beta/models',
    healthServiceName: 'awf-api-proxy-gemini',
    unconfiguredErrorMessage: 'Gemini proxy not configured ...',
    healthErrorMessage: 'GEMINI_API_KEY not configured in api-proxy sidecar',
    transformRequestUrl(url) { return stripGeminiKeyParam(url); },
  });
}

providers/gemini.js — reduced from 86 → 53 lines; retains the stripGeminiKeyParam URL transform.
providers/vertex.js — reduced from 78 → 44 lines.

No Dockerfile change needed — COPY providers/ ./providers/ already picks up the new module.

…rtex Both providers shared ~45 lines of identical Google API-key adapter scaffolding (createProviderAuthScaffold, x-goog-api-key header builder, createAdapterMethods, buildProviderAdapter, isEnabled, unconfigured responses). Extract to a new providers/google-adapter.js factory so each provider only supplies its name, port, env constants, paths, and error messages. Closes #5918

Copilot

Pull request overview

This PR refactors the api-proxy’s Google API-key providers (Gemini and Vertex) by extracting their shared adapter scaffolding into a reusable factory, reducing duplication in the credential-injection path while keeping provider-specific behavior configurable.

Changes:

Added a new shared factory createGoogleApiKeyAdapter() for Google API-key adapters (x-goog-api-key).
Updated Gemini and Vertex providers to use the shared factory, retaining Gemini’s URL query-param stripping.
Standardized unconfigured/health stub responses through the shared implementation.

Show a summary per file

File	Description
containers/api-proxy/providers/google-adapter.js	Introduces shared Google API-key adapter factory used by Gemini and Vertex.
containers/api-proxy/providers/gemini.js	Refactors Gemini provider to delegate adapter construction to the shared factory while keeping URL transform.
containers/api-proxy/providers/vertex.js	Refactors Vertex provider to delegate adapter construction to the shared factory.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 2
Review effort level: Low

+ * @param {Record<string, string|undefined>} env - Environment variables
+ * @param {{ bodyTransform?: ((body: Buffer) => Buffer|null)|null }} [deps={}] - Injected dependencies
+ * @param {object} opts


 function createVertexAdapter(env, deps = {}) {
-  const { apiKey, rawTarget, basePath, bodyTransform } = createProviderAuthScaffold(env, deps, {
-    keyEnvVar: VERTEX_ENV.KEY,
-    targetEnvVar: VERTEX_ENV.TARGET,
-    basePathEnvVar: VERTEX_ENV.BASE_PATH,
-    defaultTarget: 'aiplatform.googleapis.com',
-  });
-  const buildAuthHeaders = () => providerKeyHeaders('x-goog-api-key', apiKey);
-
-  const adapterMethods = createAdapterMethods({
-    apiKey,
-    rawTarget,
-    basePath,
-    provider: 'vertex',
+  return createGoogleApiKeyAdapter(env, deps, {
+    name: 'vertex',
    port: 10004,
+    envConstants: VERTEX_ENV,
    defaultTarget: 'aiplatform.googleapis.com',
    validationPath: '/v1/projects',
-    validationHeaders: buildAuthHeaders,
    modelsPath: null,
-    modelsFetchHeaders: null,
-  });
-
-  return buildProviderAdapter({
-    name: 'vertex',
-    port: 10004,
-    isManagementPort: false,
-    alwaysBind: true,
-    adapterMethods,
-    getAuthHeaders() {
-      return buildAuthHeaders();
-    },
-    bodyTransform,
-    isEnabled() { return !!apiKey; },
-    /** Response returned for all requests when no GOOGLE_API_KEY is configured. */
-    getUnconfiguredResponse() {
-      return {
-        statusCode: 503,
-        body: { error: 'Vertex AI proxy not configured (no GOOGLE_API_KEY). Set GOOGLE_API_KEY in the AWF runner environment to enable credential isolation.' },
-      };
-    },
-    /** /health response when not configured. */
-    getUnconfiguredHealthResponse() {
-      return makeUnconfiguredHealthResponse('awf-api-proxy-vertex', 'GOOGLE_API_KEY not configured in api-proxy sidecar');
-    },
+    healthServiceName: 'awf-api-proxy-vertex',
+    unconfiguredErrorMessage: 'Vertex AI proxy not configured (no GOOGLE_API_KEY). Set GOOGLE_API_KEY in the AWF runner environment to enable credential isolation.',
+    healthErrorMessage: 'GOOGLE_API_KEY not configured in api-proxy sidecar',
  });


lpcox · 2026-07-05T13:19:37Z

@copilot address review feedback

Copilot · 2026-07-05T13:24:33Z

@copilot address review feedback

Addressed in c752a80: widened the Google adapter JSDoc deps.bodyTransform type to include async transforms, and added Vertex auth-matrix coverage for x-goog-api-key header, default target, and isEnabled gating.

github-actions · 2026-07-05T14:34:41Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-05T14:35:24Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-05T14:35:25Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-07-05T14:35:25Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-05T14:35:25Z

✅ Smoke Claude passed

github-actions · 2026-07-05T14:35:26Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-05T14:35:26Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-05T14:35:26Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-05T14:35:28Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-07-05T14:35:28Z

Chroot tests failed Smoke Chroot failed - See logs for details.

github-actions · 2026-07-05T14:35:28Z

✅ Contribution Check completed successfully!

github-actions · 2026-07-05T14:35:35Z

✅ Security Guard completed successfully!

PR #5927 security review: API proxy refactoring only. No changes to firewall rules, iptables, Squid config, Docker capabilities, DNS, credential handling, or authentication mechanisms. Pure code consolidation of duplicate Google adapter scaffolding. No security concerns.

github-actions · 2026-07-05T14:36:25Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.81%	98.81%	➡️ +0.00%
Statements	98.73%	98.73%	➡️ +0.00%
Functions	99.58%	99.58%	➡️ +0.00%
Branches	95.14%	95.10%	📉 -0.04%

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-05T14:39:49Z

Thanks for the clear refactor and for adding Vertex auth-matrix coverage. One important item to address before this fully meets the CONTRIBUTING.md guidance:

Testing / behavior preservation: CONTRIBUTING.md asks contributors to include tests for new functionality and ensure tests pass. This refactor removes the previous alwaysBind: true setting from the Vertex adapter path, but the added tests only cover API-key headers, default target, and isEnabled gating. Please either preserve that Vertex behavior in the shared factory options or add/update a test that confirms the intended binding behavior is unchanged.

The file placement under containers/api-proxy/providers/ and the PR description look good.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Contribution Check for #5927 · 56.1 AIC · ⊞ 20.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:39:56Z

🧪 Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub.com HTTP connectivity: 200 OK
✅ File I/O operations: Working
✅ BYOK inference path: Operational (api-proxy → api.githubcopilot.com)
✅ All tests passed

Status: PASS
Mode: Direct BYOK via COPILOT_PROVIDER_API_KEY + api-proxy sidecar

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:40:07Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network is unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network is unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is not reachable from this runner environment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:40:11Z

Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	✅
File write/read	✅ (verified)

Overall: PASS — @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:40:15Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
GH check	✅ PASS
File status	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #5927 · 35.5 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:40:54Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Details
1. Module Loading	✅ Pass	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`
2. Test Suite	✅ Pass	59 tests passed, 0 failed across `otel.test.js` + `otel-fanout.test.js` — span creation, token usage attrs, parent context propagation, exporters all covered
3. Env Var Forwarding	✅ Pass	`src/services/api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME` to api-proxy container
4. Token Tracker Integration	✅ Pass	`onUsage` callback confirmed in `token-tracker-http.js` (lines 283/324) as the OTEL hook for `gen_ai.usage.*` span attributes
5. OTEL Diagnostics	i️ N/A	No live containers in this validation run; graceful degradation confirmed — `isEnabled()` returns `true` with valid config, falls back to `FileSpanExporter` when no OTLP endpoint set

All scenarios pass. The OTEL tracing integration is fully functional.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:41:03Z

$(sed s///g /tmp/comment_body.md)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:41:10Z

Smoke Test: Copilot PAT Auth

Test	Result
MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

Status: PASS | Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:41:35Z

Smoke Test Results

GitHub MCP Testing: ❌ (API unreachable, tools missing)
GitHub.com Connectivity: ❌ (Status 000)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:44:09Z

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T14:44:27Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #5927 · 171.9 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

lpcox · 2026-07-05T15:08:40Z

@copilot merge main and resolve conflicts

Copilot · 2026-07-05T15:12:39Z

@copilot merge main and resolve conflicts

Merged main and resolved conflicts in containers/api-proxy/providers/gemini.js and containers/api-proxy/providers/vertex.js in commit dcd9528.

Initial plan

b1eafb6

Copilot AI assigned Copilot and lpcox Jul 5, 2026

Copilot started work on behalf of lpcox July 5, 2026 12:50 View session

Copilot AI linked an issue Jul 5, 2026 that may be closed by this pull request

[Duplicate Code] Gemini and Vertex adapters repeat Google provider scaffolding #5918

Closed

Copilot AI changed the title ~~[WIP] Refactor Gemini and Vertex adapters to reduce duplicate code~~ refactor(api-proxy): extract shared Google API-key adapter factory for Gemini and Vertex Jul 5, 2026

Copilot finished work on behalf of lpcox July 5, 2026 12:55

Copilot AI requested a review from lpcox July 5, 2026 12:55

lpcox marked this pull request as ready for review July 5, 2026 13:15

Copilot AI review requested due to automatic review settings July 5, 2026 13:15

Copilot started reviewing on behalf of lpcox July 5, 2026 13:15 View session

Copilot AI reviewed Jul 5, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 5, 2026 13:19 View session

test(api-proxy): address google adapter review feedback

c752a80

Copilot finished work on behalf of lpcox July 5, 2026 13:25

lpcox added the ready-for-aw label Jul 5, 2026

github-actions Bot added the smoke-copilot-byok label Jul 5, 2026

github-actions Bot added the smoke-copilot label Jul 5, 2026

github-actions Bot added the smoke-claude label Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 14:40 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 5, 2026

github-actions Bot mentioned this pull request Jul 5, 2026

[aw] No-Op Runs #5883

Open

lpcox temporarily deployed to aoai-model July 5, 2026 14:41 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-pat label Jul 5, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 5, 2026

github-actions Bot added the build-test label Jul 5, 2026

Copilot started work on behalf of lpcox July 5, 2026 15:09 View session

Merge origin/main and resolve provider conflicts

dcd9528

Copilot finished work on behalf of lpcox July 5, 2026 15:12

lpcox merged commit 74af558 into main Jul 5, 2026
22 of 23 checks passed

lpcox deleted the copilot/fix-duplicate-code-google-adapters branch July 5, 2026 15:30

Uh oh!

Conversation

Copilot AI commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

🧪 Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: API Proxy OpenTelemetry Tracing

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: Copilot PAT Auth

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test Results

Uh oh!

Copilot AI commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading