You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For .github/workflows/shared/self-hosted-failure-modes.md:
New row, Category B (Self-hosted runners) — append as B28 after the existing B27 row:
ID
Signal
Root cause
Fix / flag
Probe
Citations
B28
Custom apiProxy targets pointing at an internal/corporate LLM router (--openai-api-target, --anthropic-api-target, etc.) fail TLS verification when the upstream endpoint's certificate chains to a private or corporate CA not present in the api-proxy sidecar's trust store
The containers/api-proxy Node.js sidecar had no supported way to extend its trust store for custom upstream targets; the only workarounds were disabling certificate verification (insecure) or baking a custom CA into a rebuilt image
Fixed in AWF (PR #7816, merged 2026-08-28): new apiProxy.caCert config field and --api-proxy-ca-cert <path> CLI flag bind-mount the host CA file read-only into the api-proxy container at /usr/local/share/ca-certificates/awf-upstream-ca.crt and set NODE_EXTRA_CA_CERTS to that path, so Node trusts the additional CA alongside its built-in roots without disabling verification. Upgrade AWF to include #7816.
Inspect generated docker-compose.yml for the api-proxy service — a read-only bind mount to /usr/local/share/ca-certificates/awf-upstream-ca.crt and NODE_EXTRA_CA_CERTS env var confirm the fix is active; reproduce the failure pre-fix with awf --openai-api-target <internal-host> --allow-domains <internal-host> -- <cmd> against an endpoint using a private-CA certificate
For .github/workflows/self-hosted-runner-doctor.md:
Add to the error-string quick lookup table:
Observable
Likely mode
TLS/certificate verification failure from api-proxy against a custom --openai-api-target/--anthropic-api-target internal endpoint using a private/corporate CA
B28 (api-proxy sidecar had no custom CA trust extension point; fixed in #7816 with apiProxy.caCert/--api-proxy-ca-cert)
No other playbook changes needed this scan.
Proposed portable agent changes
For .github/agents/self-hosted-runner-doctor.md:
Apply the identical B28 catalog row addition (Category B table) and the identical error-string lookup addition, keeping the embedded copy in sync with the two files above.
Summary
github/gh-aw-firewall, items updated>= 2026-08-27(searches combined the date qualifier withARC,DinD,self-hosted,GHES,GHEC,ghe.com,DOCKER_HOST,docker-host-path-prefix,chroot,musl,Alpine,IPv6,corporate proxy,cache_peer,GH_HOST,resolv.conf,toolcache,capsh,passwd, plus generic ARC/DinD/topology/mount terms).apiProxy.caCert/--api-proxy-ca-cert), fixing issue api-proxy: no way to trust a private CA for a custom upstream target (the agent and cli-proxy sidecars already have one) #7807.awf-netcollision) — both already present in the catalog from yesterday's Runner Doctor Update (issue 🩺 Runner Doctor UpdateRunner Doctor: update catalog with A22 (cap_drop/Talos) and B27 (awf-net collision) from 2026-08-26+ scan #7835 / PR Update Runner Doctor catalog with A22 and B27 #7836). No changes needed there.awfrefuses to start sandbox when/usr/bin/goon the host is a symlink —Refusing to use symlink as bind mountpoint: /usr/bin/go#7791/[awf] agent: codex engine "auto" model not recognized when running inside AWF sandbox #7810/[awf] repo-memory: mount is read-only inside AWF sandbox, blocking persistence of audit findings #7811/[awf] MCP gateway Authorization header is written readable into agent workspace via engine config files #7787, plus newly reviewed Warn when Codex usesautounder AWF API proxy #7818/Harden and document the mcp gateway Authorization header contract against workspace credential exposure #7794):awfrefuses to start sandbox when/usr/bin/goon the host is a symlink —Refusing to use symlink as bind mountpoint: /usr/bin/go#7791 (/usr/bin/gosymlink bind-mount refusal) — reproduced on GitHub-hostedubuntu-latest, not runner-class specific.autounder AWF API proxy #7818 (Codexautomodel rejection under AWF API proxy) — engine/model routing issue, not runner-environment specific.Authorizationheader written into workspace config files) — general credential-hygiene hardening, not runner-class specific.Proposed knowledge-base changes
For
.github/workflows/shared/self-hosted-failure-modes.md:New row, Category B (Self-hosted runners) — append as
B28after the existingB27row:apiProxytargets pointing at an internal/corporate LLM router (--openai-api-target,--anthropic-api-target, etc.) fail TLS verification when the upstream endpoint's certificate chains to a private or corporate CA not present in the api-proxy sidecar's trust storecontainers/api-proxyNode.js sidecar had no supported way to extend its trust store for custom upstream targets; the only workarounds were disabling certificate verification (insecure) or baking a custom CA into a rebuilt imageapiProxy.caCertconfig field and--api-proxy-ca-cert <path>CLI flag bind-mount the host CA file read-only into the api-proxy container at/usr/local/share/ca-certificates/awf-upstream-ca.crtand setNODE_EXTRA_CA_CERTSto that path, so Node trusts the additional CA alongside its built-in roots without disabling verification. Upgrade AWF to include #7816.docker-compose.ymlfor the api-proxy service — a read-only bind mount to/usr/local/share/ca-certificates/awf-upstream-ca.crtandNODE_EXTRA_CA_CERTSenv var confirm the fix is active; reproduce the failure pre-fix withawf --openai-api-target <internal-host> --allow-domains <internal-host> -- <cmd>against an endpoint using a private-CA certificateProposed doctor changes
For
.github/workflows/self-hosted-runner-doctor.md:Add to the error-string quick lookup table:
--openai-api-target/--anthropic-api-targetinternal endpoint using a private/corporate CAapiProxy.caCert/--api-proxy-ca-cert)No other playbook changes needed this scan.
Proposed portable agent changes
For
.github/agents/self-hosted-runner-doctor.md:Apply the identical
B28catalog row addition (Category B table) and the identical error-string lookup addition, keeping the embedded copy in sync with the two files above.Source issues and PRs
apiProxy.caCert/--api-proxy-ca-cert, merged 2026-08-28)Confirmed already-covered from this window (no action needed): #7788, #7795 (A22); #7809, #7817 (B27).