[Duplicate Code] Repeated GitHub server URL hostname classification in Copilot auth routing

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: The Copilot auth routing code repeats the same GITHUB_SERVER_URL hostname parsing and .ghe.com classification in three separate helpers.
• Locations: containers/api-proxy/providers/copilot-auth.js lines 94-109, 123-140, 224-239, and 280-295.
• Impact: Security-critical auth routing logic is split across multiple copies, which increases the risk of drift when GHES/GHEC handling changes.

Evidence

// deriveCopilotApiTarget
const serverUrl = env.GITHUB_SERVER_URL;
if (serverUrl) {
  try {
    const hostname = new URL(serverUrl).hostname;
    if (hostname !== 'github.com') {
      if (hostname.endsWith('.ghe.com')) {
        const subdomain = hostname.slice(0, -8);
        return `copilot-api.${subdomain}.ghe.com`;
      }
      return 'api.enterprise.githubcopilot.com';
    }
  } catch {
    // Invalid URL — fall through to default
  }
}

// deriveGitHubApiTarget
const serverUrl = env.GITHUB_SERVER_URL;
if (serverUrl) {
  try {
    const hostname = new URL(serverUrl).hostname;
    if (hostname !== 'github.com' && hostname.endsWith('.ghe.com')) {
      const subdomain = hostname.slice(0, -8);
      return `api.${subdomain}.ghe.com`;
    }
  } catch {
    // Invalid URL — fall through to default
  }
}

// isGhesInstance
const serverUrl = env.GITHUB_SERVER_URL;
if (!serverUrl) return false;
try {
  const hostname = new URL(serverUrl).hostname;
  return hostname !== 'github.com' && !hostname.endsWith('.ghe.com');
} catch {
  return false;
}

Suggested Refactoring

Extract a shared helper that parses GITHUB_SERVER_URL once and returns a normalized host classification, for example resolveGithubServerHost(env) or classifyGithubEnterpriseHost(serverUrl). The three callers can then switch on a single shared result instead of reimplementing the URL parsing and .ghe.com detection logic.

Affected Files

• containers/api-proxy/providers/copilot-auth.js — lines 94-109
• containers/api-proxy/providers/copilot-auth.js — lines 123-140
• containers/api-proxy/providers/copilot-auth.js — lines 224-239
• containers/api-proxy/providers/copilot-auth.js — lines 280-295

Effort Estimate

Low

---

Detected by Duplicate Code Detector workflow. Run date: 2026-07-19

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Duplicate Code Detector · 9.8 AIC · ⊞ 20.2K · ◷

• expires on Aug 18, 2026, 6:34 AM UTC