Summary
Proposed knowledge-base changes
File: .github/workflows/shared/self-hosted-failure-modes.md
1 — Add C7 (new row in Category C — GHES / GHEC / ghe.com)
Append after the C6 row:
| C7 | `awf-cli-proxy` DIFC-proxy liveness probe loops retrying; cli-proxy logs show `diagnosis=unknown` (AWF < v0.27.12) or `diagnosis=reachable-but-api-error (HTTP NNN)` with a `*.ghe.com` hint (AWF ≥ v0.27.12); AWF fails to start | DIFC proxy is reachable but the forwarded `gh api rate_limit` call returns an HTTP error because the DIFC proxy is not enterprise-host-aware on data-residency `*.ghe.com` tenants | **Partially mitigated**: upgrade to AWF ≥ v0.27.12 for a targeted `*.ghe.com` hint and HTTP status in cli-proxy logs; root cause (DIFC proxy enterprise-host awareness) is **unresolved** in companion projects (github/gh-aw-mcpg#8202, github/gh-aw#41911) | Check `GITHUB_SERVER_URL` for `*.ghe.com`; inspect cli-proxy logs for `diagnosis=unknown` or `reachable-but-api-error (HTTP NNN)`; confirm AWF ≥ v0.27.12 for the targeted hint | #5615, #5616 |
2 — Add error-string quick-lookup entry
Append to the error-string table (e.g., after the EACCES B6 row):
| `diagnosis=unknown` from `awf-cli-proxy` DIFC probe (proxy reachable, no connection error) with `GITHUB_SERVER_URL=*.ghe.com`, or `diagnosis=reachable-but-api-error (HTTP NNN)` | C7 |
3 — Add C7 to "Known unresolved items"
- C7 / #5615 — DIFC proxy enterprise-host awareness for `*.ghe.com` data-residency (root cause unresolved; tracked in github/gh-aw-mcpg#8202 and github/gh-aw#41911)
Proposed doctor changes
File: .github/workflows/self-hosted-runner-doctor.md
In §3 "Match symptom → failure mode", add to the hint list:
- `diagnosis=unknown` (proxy reachable, no connection error) or `reachable-but-api-error` from DIFC probe with `GITHUB_SERVER_URL=*.ghe.com` → C7 (DIFC proxy not enterprise-host-aware)
In §4 "Check for known unresolved problems", add:
C7 / #5615 — DIFC proxy enterprise-host awareness for `*.ghe.com` data-residency is not yet implemented in the companion projects; AWF ≥ v0.27.12 provides improved diagnostics (HTTP status + targeted hint) but the underlying cause remains unresolved.
Proposed portable agent changes
File: .github/agents/self-hosted-runner-doctor.md
Apply the following identical changes to the embedded catalog and playbook:
1 — Category C table: append C7 row after C6 (same text as the shared-file change above)
2 — Error-string quick-lookup: append C7 entry (same text as the shared-file change above)
3 — Known unresolved items: append C7 (same text as the shared-file change above)
4 — §3 "Match symptom → failure mode": append the C7 hint (same text as the doctor-workflow change above)
5 — §4 "Check for known unresolved problems": append the C7 paragraph (same text as the doctor-workflow change above)
Source issues and PRs
| Citation |
Title |
State |
Lesson |
| #5615 |
Improve awf-cli-proxy DIFC probe diagnostics (replace opaque diagnosis=unknown) |
Closed (completed) |
C7 — diagnosis=unknown on *.ghe.com DIFC probe; better diagnostics in v0.27.12; root cause unresolved |
| #5616 |
fix(cli-proxy): surface HTTP status in DIFC probe diagnostics |
Merged (v0.27.12) |
C7 — firewall-side diagnostics improvement; added reachable-but-api-error (HTTP NNN) classification and *.ghe.com hint |
Context on C7: On GHEC data-residency (*.ghe.com) tenants, the awf-cli-proxy sidecar runs a DIFC-proxy liveness probe (gh api rate_limit). The proxy is reachable, so connection-refused / EAI_AGAIN / timeout buckets do not match, but the forwarded gh api call returns HTTP 404 because the DIFC proxy targets the wrong API host. Before v0.27.12 this fell into the opaque unknown bucket, making the failure nearly impossible to diagnose. AWF v0.27.12 adds a fifth classification bucket (reachable-but-api-error (HTTP NNN)) and a targeted hint when GITHUB_SERVER_URL is a *.ghe.com host. The underlying fix (making the DIFC proxy enterprise-host-aware) is tracked in github/gh-aw-mcpg#8202 and github/gh-aw#41911 and remains unresolved.
Generated by Runner Doctor Updater · 78.3 AIC · ⊞ 10.7K · ◷
Summary
runner-doctorproposals before creating this issueartifact-permissions.ts#5605, refactor: extract sidecar and host-access helpers from addProxyDestinationAcceptRules #5636–refactor: extract shared auth header resolution helper for provider adapters #5641), token-usage reports, no-op runs ([aw] No-Op Runs #5368) — none carry non-hosted-runner lessonsProposed knowledge-base changes
File:
.github/workflows/shared/self-hosted-failure-modes.md1 — Add C7 (new row in Category C — GHES / GHEC /
ghe.com)Append after the C6 row:
2 — Add error-string quick-lookup entry
Append to the error-string table (e.g., after the
EACCESB6 row):3 — Add C7 to "Known unresolved items"
Proposed doctor changes
File:
.github/workflows/self-hosted-runner-doctor.mdIn §3 "Match symptom → failure mode", add to the hint list:
In §4 "Check for known unresolved problems", add:
Proposed portable agent changes
File:
.github/agents/self-hosted-runner-doctor.mdApply the following identical changes to the embedded catalog and playbook:
1 — Category C table: append C7 row after C6 (same text as the shared-file change above)
2 — Error-string quick-lookup: append C7 entry (same text as the shared-file change above)
3 — Known unresolved items: append C7 (same text as the shared-file change above)
4 — §3 "Match symptom → failure mode": append the C7 hint (same text as the doctor-workflow change above)
5 — §4 "Check for known unresolved problems": append the C7 paragraph (same text as the doctor-workflow change above)
Source issues and PRs
diagnosis=unknownon*.ghe.comDIFC probe; better diagnostics in v0.27.12; root cause unresolvedreachable-but-api-error (HTTP NNN)classification and*.ghe.comhintContext on C7: On GHEC data-residency (
*.ghe.com) tenants, theawf-cli-proxysidecar runs a DIFC-proxy liveness probe (gh api rate_limit). The proxy is reachable, so connection-refused / EAI_AGAIN / timeout buckets do not match, but the forwardedgh apicall returns HTTP 404 because the DIFC proxy targets the wrong API host. Before v0.27.12 this fell into the opaqueunknownbucket, making the failure nearly impossible to diagnose. AWF v0.27.12 adds a fifth classification bucket (reachable-but-api-error (HTTP NNN)) and a targeted hint whenGITHUB_SERVER_URLis a*.ghe.comhost. The underlying fix (making the DIFC proxy enterprise-host-aware) is tracked in github/gh-aw-mcpg#8202 and github/gh-aw#41911 and remains unresolved.