Fix DIFC proxy GraphQL endpoint rewriting for github.com API base

[Copilot]

The DIFC proxy was forwarding GraphQL traffic to /api/graphql even when upstream was github.xm233.cn-style, causing 404s and repeated retries in cli-proxy workflows. This updates GraphQL path normalization to target the correct endpoint based on configured API base.

• Endpoint rewrite logic

  • Updated proxy forwarding to rewrite GraphQL paths conditionally:
    • upstream ending in /api/v3 (GHES) → /api/graphql
    • upstream without /api/v3 (github.com) → /graphql
  • Applies consistently for incoming GraphQL variants: /graphql, /api/graphql, /api/v3/graphql.
  • Preserves query strings during rewrite.

• Coverage for dotcom behavior

  • Added focused tests for github.xm233.cn-style API base to assert canonical forwarding to /graphql across all supported input path forms.
  • Kept existing GHES coverage intact.

• Handler expectation alignment

  • Updated GraphQL query-string preservation expectation in handler tests to reflect normalized dotcom forwarding path.

pathOnly, query, hasQuery := strings.Cut(path, "?")
if IsGraphQLPath(pathOnly) {
    graphqlURL := s.githubAPIURL + "/graphql"
    if strings.HasSuffix(s.githubAPIURL, "/api/v3") {
        graphqlURL = strings.TrimSuffix(s.githubAPIURL, "/api/v3") + "/api/graphql"
    }
    url = graphqlURL
    if hasQuery {
        url += "?" + query
    }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build203165019/b514/launcher.test /tmp/go-build203165019/b514/launcher.test -test.testlogfile=/tmp/go-build203165019/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build203165019/b405/vet.cfg 1.80.0/internal/resolver/delegatingresolver/delegatingresolver.go 0845442/b151/ x_amd64/vet e.go esource/v1 (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build203165019/b496/config.test /tmp/go-build203165019/b496/config.test -test.testlogfile=/tmp/go-build203165019/b496/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build203165019/b317/vet.cfg /sdk@v1.43.0/trago1.25.8 /sdk@v1.43.0/tra-c=4 x_amd64/vet ctor idle E=3 x_amd64/vet 0845�� g_.a otection x_amd64/vet --gdwarf-5 rs/otlp/otlptrac-atomic -o x_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build203165019/b514/launcher.test /tmp/go-build203165019/b514/launcher.test -test.testlogfile=/tmp/go-build203165019/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build203165019/b405/vet.cfg 1.80.0/internal/resolver/delegatingresolver/delegatingresolver.go 0845442/b151/ x_amd64/vet e.go esource/v1 (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build203165019/b514/launcher.test /tmp/go-build203165019/b514/launcher.test -test.testlogfile=/tmp/go-build203165019/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build203165019/b405/vet.cfg 1.80.0/internal/resolver/delegatingresolver/delegatingresolver.go 0845442/b151/ x_amd64/vet e.go esource/v1 (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build203165019/b523/mcp.test /tmp/go-build203165019/b523/mcp.test -test.testlogfile=/tmp/go-build203165019/b523/testlog.txt -test.paniconexit0 -test.timeout=10m0s 0845�� g_.a GBv9xrrGM x_amd64/vet -p go-sdk/internal/-atomic -lang=go1.24 x_amd64/vet ortc�� cfg 64/src/net/textp-ifaceassert x_amd64/vet . --gdwarf2 --64 x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Updates DIFC proxy GraphQL forwarding so requests are rewritten to the correct upstream GraphQL endpoint depending on the configured GitHub API base (GHES /api/v3 vs github.xm233.cn-style), preventing 404s/retry loops.

Changes:

• Adjusted forwardToGitHub GraphQL normalization to route to /graphql for non-/api/v3 API bases and to /api/graphql for /api/v3 API bases.
• Added unit tests validating dotcom-style API base GraphQL rewriting and query-string preservation across supported incoming path variants.
• Updated handler test expectations to match the normalized dotcom forwarding path for /api/graphql?....

Show a summary per file

File	Description
internal/proxy/proxy.go	Implements conditional GraphQL endpoint rewrite based on whether githubAPIURL ends with /api/v3.
internal/proxy/proxy_test.go	Adds coverage for dotcom-style API base ensuring GraphQL paths normalize to /graphql and preserve query strings.
internal/proxy/handler_test.go	Aligns expected forwarded URL for /api/graphql?... with new dotcom normalization behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0