[Freddy Kristiansen (freddydk)]

❔What, Why & How

This pull request introduces comprehensive updates to improve compatibility with GitHub Enterprise (GHE) hosts. The main focus is to ensure that all scripts and workflows dynamically use the correct GitHub server and API URLs, rather than hardcoding references to github.com and api.github.com. This enables repositories using AL-Go for GitHub to work seamlessly on both public GitHub and GHE instances. Additionally, documentation has been updated to clarify support and provide guidance for GHE users.

GitHub Enterprise compatibility and dynamic host resolution:

• All PowerShell scripts and workflow files now use the GITHUB_SERVER_URL and GITHUB_API_URL environment variables instead of hardcoded github.com and api.github.com URLs for REST API calls and repository links. This affects actions such as dependency probing, deployments, pull request validation, and workflow post-processing. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]
• The workflow now explicitly verifies that the AL-Go for GitHub repository itself only runs on github.com, preventing unsupported usage on GHE for the main repo.
• The gh CLI commands set the GH_HOST environment variable to ensure API calls target the correct host on GHE. [1] [2] [3]

Documentation and user guidance:

• Added a new scenario guide, Scenarios/UsingGitHubEnterprise.md, detailing how to use AL-Go for GitHub on GHE, including setup instructions and best practices.
• The README.md is updated to reference the new GHE usage guide.
• Release notes summarize the GHE compatibility improvements and clarify the support policy.

Other improvements and fixes:

• Improved template repository download logic to construct API URLs correctly for both public GitHub and GHE, and to use authenticated or anonymous requests as appropriate. [1] [2] [3]
• Minor comments and clarifications added to template scripts regarding authentication requirements.

These changes ensure that AL-Go for GitHub works reliably in both public and enterprise GitHub environments, with clear documentation and robust host detection.

This functionality was sponsored by Fellowmind, Sweden.

[Copilot]

🟡 Changes recommended

API URL changes break local dependency resolution and E2E workflow operations when Actions environment variables are unset.

2 open issues

• Preserve GitHub API fallback when GITHUB_API_URL is unset · New
• Pass API URL through artifact and workflow job lookups · New

What changed in this PR

Adds preview support for GitHub Enterprise Cloud with data residency across AL-Go actions and templates.

Changes:

• Routes API calls, repository links, and CLI commands to the appropriate host.
• Updates template downloads and release uploads for enterprise repositories.
• Documents enterprise setup and adds regression tests.

File	Description
Tests/​PullRequestStatusCheck.Test.ps1	Tests CLI host selection.
Tests/​DownloadProjectDependencies.Test.ps1	Tests whole-URL secrets.
Tests/​DetermineProjectsToBuild.Test.ps1	Tests empty repositories.
Tests/​Deploy.Module.Test.ps1	Initializes the API URL.
Templates/​Per Tenant Extension/​.github/​workflows/​CreateRelease.yaml	Uses returned upload URLs and host-specific email.
Templates/​Per Tenant Extension/​.AL-Go/​localDevEnv.ps1	Clarifies authentication comments.
Templates/​AppSource App/​.github/​workflows/​CreateRelease.yaml	Uses returned upload URLs and host-specific email.
Templates/​AppSource App/​.AL-Go/​localDevEnv.ps1	Clarifies authentication comments.
Scenarios/​UsingGitHubEnterprise.md	Documents enterprise setup.
RELEASENOTES.md	Announces preview support.
README.md	Links the enterprise guide.
Actions/​WorkflowPostProcess/​WorkflowPostProcess.ps1	Sets the CLI host.
Actions/​VerifyPRChanges/​VerifyPRChanges.ps1	Uses the configured API host.
Actions/​PullRequestStatusCheck/​PullRequestStatusCheck.ps1	Sets the CLI host.
Actions/​Github-Helper.psm1	Updates dependency routing and API endpoints.
Actions/​GetArtifactsForDeployment/​GetArtifactsForDeployment.psm1	Uses configured API and server URLs.
Actions/​GetArtifactsForDeployment/​GetArtifactsForDeployment.ps1	Generates host-aware diagnostic links.
Actions/​DownloadProjectDependencies/​DownloadProjectDependencies.psm1	Resolves secrets before classifying paths.
Actions/​DetermineProjectsToBuild/​DetermineProjectsToBuild.psm1	Initializes empty-project dependency information.
Actions/​DetermineProjectsToBuild/​DetermineProjectsToBuild.Action.ps1	Generates host-aware build annotations.
Actions/​Deploy/​Deploy.psm1	Uses the configured API host.
Actions/​CheckForUpdates/​CheckForUpdates.ps1	Sets the CLI host.
Actions/​CheckForUpdates/​CheckForUpdates.HelperFunctions.ps1	Selects template endpoints and authentication.
Actions/​AL-Go-Helper.ps1	Resolves dependency URLs and host-specific credentials.
.github/​workflows/​CI.yaml	Restricts development-repository CI to github.com.

_{Review effort: Balanced}

[Freddy Kristiansen (freddydk)]

@microsoft-github-policy-service agree

[Copilot]

🟡 Changes recommended

Cross-host credential fallbacks can forward unrelated tokens, and template lookup bypasses existing rate-limit recovery.

1 open issue

• Prevent ambient tokens from leaking across hosts · New

1 previously missed issue

In code that hasn't changed since last review

Direct request bypasses rate-limit-aware wrapper

Actions/​CheckForUpdates/​CheckForUpdates.HelperFunctions.ps1:100

Please retain the rate-limit-aware InvokeWebRequest wrapper here. Enterprise workflows now download public templates anonymously, using GitHub's 60-requests/hour quota. In the action's default Windows PowerShell shell, this direct call bypasses the wrapper's 403/reset recovery (Github-Helper.psm1:92–103), so quota exhaustion fails the template update instead of waiting and retrying. The wrapper already supplies UseBasicParsing.

2 resolved since last review

• Pass API URL through artifact and workflow job lookups
• Preserve GitHub API fallback when GITHUB_API_URL is unset

_{Review effort: Balanced}

[Alexander Holstrup (aholstrup1)]

A few small comments but otherwise it looks ready to me 🚀

[Copilot]

🔵 Needs a closer look

Cross-host authentication and release uploads need enterprise integration validation, alongside the requested regression coverage and settings documentation.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Document appDependencyProbingPaths host and authentication rules

Actions/​AL-Go-Helper.ps1:968

Document the new appDependencyProbingPaths host rules in Scenarios/settings.md and Actions/.Modules/settings.schema.json. The settings table still lists latestBuild without this same-host restriction, while the schema only links to that table. A GHE repository configured to consume a public GitHub latestBuild dependency now fails here. Explain that latestBuild requires the current host, owner/repo shorthand resolves against that host, and cross-host dependencies must use an explicit URL and a supported release status such as release or prerelease, with suitable access credentials when required.

Add template host and authentication routing tests

Actions/​CheckForUpdates/​CheckForUpdates.HelperFunctions.ps1:46

Add mocked Pester coverage for these template host/authentication branches in Tests/CheckForUpdates.Action.Test.ps1, which already tests other functions in this helper. Cover a public GitHub template on github.com, a same-host GHE template whose initial request fails and requires the fallback token, and a GHE repository downloading Microsoft's public template. Assert the branch/archive API URLs and which requests carry Authorization, including anonymous access for the cross-host public template. The current tests do not verify this routing or credential selection.

Add regression tests for dependency host selection

Actions/​Github-Helper.psm1:208

Add regression tests for dependency-host selection in Tests/GitHub-Helper.Test.ps1. The existing GetDependencies test exercises only thisBuild, and the new helper tests receive an already-computed API URL, so neither covers this routing. Test github.com and tenant.ghe.com dependencies with a different GITHUB_API_URL, and mock authentication and downloads to assert that the derived API URL reaches GetAccessToken, GetArtifacts, GetReleases, and DownloadRelease in the applicable latestBuild and release cases.

1 resolved since last review

• Prevent ambient tokens from leaking across hosts

_{Review effort: Balanced}

[Freddy Kristiansen (freddydk)]

@microsoft-github-policy-service agree