[github-actions]

Summary

• Scan window: merged PRs since 2026-11-07, plus the updated-since watermark (2026-11-14T03:15:53Z).
• Sources reviewed: 50 first-time merged PRs (of 103 pending), each mapped to its merge commit with changed files and PR body checked. Supplemental checks: fix: isolate Actions OIDC from agent container #6894, Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (resolved by Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054), the Anthropic/GCP/AWS/OpenAI provider adapters, and the auth-matrix/sidecar/environment docs.
• Corrected authentication paths: the Actions OIDC forwarding rule, native OpenAI WIF agent routing, and trusted LLM service secret headers.
• Current-main versus pending: fix: isolate Actions OIDC from agent container #6894 and gh-aw#50053 are merged and resolved on main. The OTLP workload-identity forwarding path is shipped code, not pending work.
• Coverage and backlog: 50 reviewed this run (4 covered, 1 proposed, 45 no-impact), 53 still pending. Historical catchup remains open: the cursor is at 2026-11-07, above the 2025-10-16 floor, so the next runs continue back in time. No deferred items.

Documentation Changes

• docs/api-proxy-sidecar.md: the Actions OIDC variables are forwarded to the sidecar for GH_AW_OTLP_WORKLOAD_IDENTITY as well as github-oidc (buildOtelEnv() in src/services/api-proxy-env-config.ts). The Azure OIDC caveat now states that native OpenAI WIF enables agent routing through isOpenAiOidcConfigured(), and that Azure OIDC does not.
• docs/environment.md: the same OTLP forwarding correction in the OIDC runtime variables paragraph.
• docs/auth-matrix.md: the OTLP forwarding correction in the OIDC Providers section; the Azure OIDC routing note; and a new Trusted LLM service secret headers (trustedService) subsection under Custom Headers, documenting the endpoint and secretHeaders contract from Add opt-in trusted LLM service routing and secret headers #11345 and linking the normative spec §9.10.

Canonical Registry Changes

No AUTH-* record changes in this PR. The three corrections are documentation accuracy fixes, not new diagnosis failures. npm run diagnostics:validate reports 26 valid findings, and npm run diagnostics:check reports the generated artifacts are in sync.

Validation

• Implementation checked on main: src/services/api-proxy-env-config.ts (buildOtelEnv, buildOidcEnv), src/services/credentials/openai-oidc-config.ts, containers/api-proxy/trusted-service.js, containers/api-proxy/providers/cloud-oidc-init.js, containers/api-proxy/providers/openai.js, containers/api-proxy/upstream-log.js.
• Tests: npx jest scripts/ci/auth-doctor-updater-workflow.test.ts src/services/api-proxy-env-config.test.ts containers/api-proxy/server.auth-matrix.test.js passes (85 tests). npm run build and npm run lint pass with 0 errors.
• Markdown: the new anchor awf-config-spec.md#910-trusted-llm-services matches the ### 9.10 Trusted LLM Services heading. Relative links in the three edited files resolve. Two pre-existing external GitHub blob URLs were not changed.
• Credential-leakage review: the diff was searched for JWT, key, Bearer, and credential-bearing URL patterns. No matches. No secret values, tokens, or Authorization headers are included.
• Not verified: the Gemini API-key migration claim in docs/auth-matrix.md. ai.google.dev redirects to aistudio.google.com, which the sandbox blocks, so that claim is left unchanged.

Sources

• Repository: fix: isolate Actions OIDC from agent container #6894 (merged 2026-08-03); Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (closed, resolved by Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054); Add opt-in trusted LLM service routing and secret headers #11345 (trusted LLM service); Add OpenAI workload identity federation to the API proxy #11364 (OpenAI WIF); Add isolated Azure Foundry provider for decision models #11363 (Azure Foundry); Clarify Copilot Decisions PAT support and rejection diagnostics #11289 (Decisions PAT diagnostics).
• Official provider docs: not used for the changes in this PR. Provider doc reads were limited to the allowlisted sites that were reachable from the sandbox.

Generated by Auth Doctor Updater · copilot · routed: haiku55 xhigh · ~74 AIC · ⊞ 9.4K · ◷

[Copilot]

🟡 Changes recommended

Contradictory OIDC forwarding statements remain across the authentication documentation, including the cited later passage and related files, so the active documentation issue must be resolved.

1 open issue

• Update stale OIDC forwarding rules across auth documentation · New

What changed in this PR

This documentation-only PR corrects AWF authentication guidance to match current OIDC forwarding, native OpenAI workload-identity routing, and trusted-service behavior.

Changes:

• Documents Actions OIDC variable forwarding for OTLP workload identity.
• Clarifies that native OpenAI WIF enables agent routing, while Azure OIDC alone does not.
• Adds the trusted LLM service endpoint and secretHeaders contract to the authentication matrix.

File	Description
docs/​environment.md	Updates environment documentation to describe OIDC variable forwarding for OTLP workload identity.
docs/​auth-matrix.md	Clarifies provider-specific OIDC routing and documents trusted LLM service secret headers.
docs/​api-proxy-sidecar.md	Updates sidecar OIDC forwarding and Azure/OpenAI routing guidance.

_{Review effort: Lite (dynamic)}