From d2d234e5983dd699efa9b694fc702a313b4285e4 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 16 Feb 2026 20:34:06 +0000 Subject: [PATCH 1/3] Initial plan From 76c981669f837e1551e4da8c206cea7484a2087a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 16 Feb 2026 20:36:36 +0000 Subject: [PATCH 2/3] feat(config): add GitHub Copilot network allowlist for external APIs Add .github/copilot.yml configuration to allow connections to: - api.openai.com (OpenAI API) - oauth2.googleapis.com (Google OAuth) - test.cognitiveservices.azure.com (Azure services) - Additional related domains for full integration test support This fixes firewall blocking issues when running integration tests. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- .github/copilot.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/copilot.yml diff --git a/.github/copilot.yml b/.github/copilot.yml new file mode 100644 index 00000000..a3ea4229 --- /dev/null +++ b/.github/copilot.yml @@ -0,0 +1,34 @@ +# GitHub Copilot Workspace Configuration +# This file configures GitHub Copilot coding agent settings for the DocuElevate repository + +# Network allowlist for external API services +# These domains are required for integration tests and external service connectivity +network: + allowlist: + # OpenAI API - Required for AI-powered metadata extraction and GPT integration + - api.openai.com + + # Google OAuth2 - Required for Google Drive integration and OAuth authentication + - oauth2.googleapis.com + - accounts.google.com + - www.googleapis.com + + # Azure Cognitive Services - Required for Azure Document Intelligence and OCR + - test.cognitiveservices.azure.com + - "*.cognitiveservices.azure.com" + + # Additional Azure endpoints that may be needed + - login.microsoftonline.com + - graph.microsoft.com + + # AWS S3 - Required for S3 storage integration tests + - s3.amazonaws.com + - "*.s3.amazonaws.com" + + # Dropbox API - Required for Dropbox storage integration + - api.dropboxapi.com + - content.dropboxapi.com + + # Package registries (if needed for dependency installation during tests) + - pypi.org + - files.pythonhosted.org From 10ff772fbeced0f32ada3cf7703aa34fe8dc48d6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 16 Feb 2026 20:37:13 +0000 Subject: [PATCH 3/3] docs: add GitHub Copilot configuration documentation Add comprehensive documentation for .github/copilot.yml network allowlist configuration. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- docs/GitHubCopilotConfiguration.md | 115 +++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) create mode 100644 docs/GitHubCopilotConfiguration.md diff --git a/docs/GitHubCopilotConfiguration.md b/docs/GitHubCopilotConfiguration.md new file mode 100644 index 00000000..04692454 --- /dev/null +++ b/docs/GitHubCopilotConfiguration.md @@ -0,0 +1,115 @@ +# GitHub Copilot Configuration + +## Overview + +This document explains the GitHub Copilot workspace configuration for the DocuElevate repository. + +## Network Allowlist + +The `.github/copilot.yml` file configures the network allowlist for GitHub Copilot coding agents. This allowlist enables the agents to connect to external API services during development and testing workflows. + +### Purpose + +GitHub Copilot coding agents run in a sandboxed environment with firewall restrictions. By default, most external network connections are blocked for security reasons. The network allowlist explicitly permits connections to trusted domains that are required for: + +- Running integration tests with real API services +- Installing dependencies from package registries +- Validating external service configurations +- Testing cloud storage integrations + +### Configured Domains + +The following domains are currently allowed: + +#### AI/ML Services +- **api.openai.com** - OpenAI API for GPT-based metadata extraction +- **test.cognitiveservices.azure.com** - Azure Document Intelligence for OCR +- **\*.cognitiveservices.azure.com** - Additional Azure AI endpoints + +#### Cloud Storage & Authentication +- **oauth2.googleapis.com** - Google OAuth2 authentication +- **accounts.google.com** - Google account services +- **www.googleapis.com** - Google Drive API +- **login.microsoftonline.com** - Microsoft authentication +- **graph.microsoft.com** - Microsoft Graph API +- **s3.amazonaws.com** - AWS S3 storage +- **\*.s3.amazonaws.com** - Regional S3 endpoints +- **api.dropboxapi.com** - Dropbox API +- **content.dropboxapi.com** - Dropbox content endpoints + +#### Package Registries +- **pypi.org** - Python Package Index +- **files.pythonhosted.org** - PyPI content distribution + +## Configuration File Format + +The configuration uses YAML format: + +```yaml +network: + allowlist: + - domain1.com + - domain2.com + - "*.wildcard-domain.com" # Wildcards must be quoted +``` + +## Modifying the Allowlist + +To add new domains to the allowlist: + +1. Edit `.github/copilot.yml` +2. Add the domain under `network.allowlist` +3. Use quotes for wildcard domains (e.g., `"*.example.com"`) +4. Add a comment explaining why the domain is needed +5. Validate YAML syntax: `python -c "import yaml; yaml.safe_load(open('.github/copilot.yml'))"` +6. Commit and push the changes + +## Testing the Configuration + +After updating the allowlist, verify that: + +1. The YAML syntax is valid (no parse errors) +2. Integration tests can connect to the required services +3. No unnecessary domains are allowed (principle of least privilege) + +## Security Considerations + +- Only add domains that are **absolutely required** for development or testing +- Prefer specific subdomains over wildcards when possible +- Document the purpose of each domain in comments +- Review and audit the allowlist periodically +- Remove domains that are no longer needed + +## Troubleshooting + +### Firewall Blocking Errors + +If you encounter errors like: +``` +Firewall rules blocked me from connecting to one or more addresses +``` + +1. Check if the domain is in the allowlist +2. Verify the domain spelling and format +3. Ensure wildcards are properly quoted +4. Wait a few minutes for the configuration to propagate + +### YAML Syntax Errors + +If the configuration file has syntax errors: + +1. Check for proper indentation (2 spaces per level) +2. Ensure wildcards are quoted: `"*.domain.com"` +3. Validate with: `python -c "import yaml; yaml.safe_load(open('.github/copilot.yml'))"` + +## References + +- [GitHub Copilot Documentation](https://docs.github.com/en/copilot) +- [YAML Specification](https://yaml.org/spec/) +- [DocuElevate Testing Guide](../tests/README_INTEGRATION_TESTS.md) + +## Related Files + +- `.github/copilot.yml` - Network allowlist configuration +- `tests/test_external_integrations.py` - Integration tests using external APIs +- `tests/conftest.py` - Test fixtures and configuration