feat: proxy pre-agent gh CLI calls through DIFC gateway

[lpcox]

Summary

Routes all pre-agent gh CLI calls in repo-assist through the MCP gateway DIFC proxy, applying the same min-integrity: merged policy that governs the agent's MCP tool calls.

Problem

The repo-assist workflow runs several gh CLI calls before the agent starts (issue list, PR list, repo-memory clone). These calls bypass the DIFC pipeline entirely — the agent's guard policy only applies to MCP tool calls during the agent phase.

Solution

Add two steps to repo-assist.lock.yml:

Start DIFC Proxy (before first GH_TOKEN step)

• Runs ghcr.io/github/gh-aw-mcpg:v0.1.19 in proxy mode with TLS on port 18443
• Same policy as agent: {"allow-only":{"repos":["github/*"],"min-integrity":"merged"}}
• Adds proxy CA cert to system trust store (update-ca-certificates) so gh CLI (Go) trusts it
• Writes GH_HOST=localhost:18443 to $GITHUB_ENV — all subsequent steps inherit it

Stop DIFC Proxy (before agent execution)

• Stops the proxy container
• Clears GH_HOST from $GITHUB_ENV to prevent leaking into awf --env-all

Steps Covered

Pre-Agent Step	Uses GH_TOKEN	Proxied	Mechanism
Configure gh CLI for GHE	✅	✅	$GITHUB_ENV
Fetch repo data (gh issue/pr list)	✅	✅	$GITHUB_ENV
Clone repo-memory branch	✅	✅	$GITHUB_ENV
Checkout PR branch	✅	❌	Uses Octokit, not gh CLI
Install Copilot CLI	—	❌	Explicit GH_HOST: github.com override
Agent (awf container)	—	❌	GH_HOST cleared before agent

Design Decisions

• $GITHUB_ENV over per-step env vars: Propagates to framework-injected steps (clone-repo-memory) that we can't modify from the .md source
• System CA trust store: gh CLI uses Go's http.DefaultTransport which reads system CAs — NODE_EXTRA_CA_CERTS only works for Node.js
• Port 18443: Avoids conflict with the agent's MCP gateway (port 80)
• Graceful fallback: If proxy fails to start, workflow continues with direct API access
• Lock file only: Editing .lock.yml directly for debugging; .md source changes will follow once validated

Testing

This is a lock file change — needs to be validated by running the repo-assist workflow in CI.

[Copilot]

Pull request overview

This PR updates the repo-assist workflow lock file to route pre-agent gh CLI calls through a locally hosted DIFC proxy so they are subject to the same min-integrity: merged allow-only policy as the agent’s MCP tool calls.

Changes:

• Add a “Start DIFC proxy” step that runs gh-aw-mcpg in proxy mode with TLS and sets GH_HOST=localhost:18443 for subsequent pre-agent steps.
• Add a “Stop DIFC proxy” step that removes the proxy container and clears GH_HOST before running the agent container.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The step claims a graceful fallback if the proxy can’t start, but docker run ... will still hard-fail the job on any pull/run error because GitHub Actions runs bash with -e by default. To preserve the intended fallback, capture the docker run exit status (or use || / set +e around it) and only proceed to the readiness loop when the container actually started; otherwise emit the warning and continue.

[Copilot]

The readiness/fallback logic only warns when ca.crt is missing, but the loop can also time out with ca.crt present and curl never succeeding; in that case no warning is emitted and the proxy container may be left running. Consider tracking an explicit ready flag (set only when the curl check succeeds), installing the CA once (not every loop iteration), and warning+cleaning up the container when ready is still false after the loop.

Suggested change

	# Wait for proxy to be ready (TLS cert generated and port listening)
	for i in $(seq 1 30); do
	if [ -f "$PROXY_LOG_DIR/proxy-tls/ca.crt" ]; then
	# Add proxy CA to system trust store so gh CLI (Go) trusts it
	sudo cp "$PROXY_LOG_DIR/proxy-tls/ca.crt" /usr/local/share/ca-certificates/awmg-proxy.crt
	sudo update-ca-certificates
	if curl -sf "https://localhost:18443/api/v3/zen" -o /dev/null 2>/dev/null; then
	echo "DIFC proxy ready on port 18443"
	# Route all subsequent gh CLI calls through the proxy
	echo "GH_HOST=localhost:18443" >> "$GITHUB_ENV"
	break
	fi
	fi
	sleep 1
	done
	if [ ! -f "$PROXY_LOG_DIR/proxy-tls/ca.crt" ]; then
	echo "::warning::DIFC proxy failed to start, falling back to direct API access"
	READY=false
	CA_INSTALLED=false
	# Wait for proxy to be ready (TLS cert generated and port listening)
	for i in $(seq 1 30); do
	if [ -f "$PROXY_LOG_DIR/proxy-tls/ca.crt" ]; then
	if [ "$CA_INSTALLED" = false ]; then
	# Add proxy CA to system trust store so gh CLI (Go) trusts it
	sudo cp "$PROXY_LOG_DIR/proxy-tls/ca.crt" /usr/local/share/ca-certificates/awmg-proxy.crt
	sudo update-ca-certificates
	CA_INSTALLED=true
	fi
	if curl -sf "https://localhost:18443/api/v3/zen" -o /dev/null 2>/dev/null; then
	echo "DIFC proxy ready on port 18443"
	# Route all subsequent gh CLI calls through the proxy
	echo "GH_HOST=localhost:18443" >> "$GITHUB_ENV"
	READY=true
	break
	fi
	fi
	sleep 1
	done
	if [ "$READY" = false ]; then
	if [ ! -f "$PROXY_LOG_DIR/proxy-tls/ca.crt" ]; then
	echo "::warning::DIFC proxy failed to start (CA certificate not generated), falling back to direct API access"
	else
	echo "::warning::DIFC proxy failed to become ready (health check did not succeed), falling back to direct API access"
	fi

[Copilot]

With --network host, binding the proxy to 0.0.0.0:18443 exposes it on all runner interfaces. Since only local steps need access, bind to 127.0.0.1:18443 (and keep using https://localhost:18443/...) to reduce accidental exposure on shared/runner networking.

Suggested change

	--listen 0.0.0.0:18443 \
	--listen 127.0.0.1:18443 \