fix(api-proxy): add missing JS modules to Dockerfile COPY

[lpcox]

Bug Fix

What was the bug?

The api-proxy container has been crashing immediately on startup (exit code 1) since commit 7c25298, breaking all integration test runs on main since 2026-05-11T15:45Z.

The root cause: PR #2887 (and earlier PRs #2811, #2772) added new JS modules to containers/api-proxy/ but did not update the Dockerfile's COPY command. When the container starts, Node.js fails with Cannot find module './github-oidc'.

Missing files added to Dockerfile COPY

File	Added by	Purpose
github-oidc.js	#2772	Shared GitHub OIDC token minting
aws-oidc-token-provider.js	#2811	AWS OIDC credential exchange
gcp-oidc-token-provider.js	#2811	GCP OIDC credential exchange
oidc-refresh-utils.js	#2811	Shared OIDC refresh/sleep utilities

How to verify

After this fix, all tests/integration/api-proxy*.test.ts integration tests should pass again.

Impact

• All integration tests on main have been failing since 7c25298 was merged
• The 28 api-proxy integration test failures on PR refactor: reduce pid-tracker API surface and harden api-proxy startup retry handling #2895 are also caused by this same issue (not by refactor: reduce pid-tracker API surface and harden api-proxy startup retry handling #2895's changes)

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	87.88%	87.96%	📈 +0.08%
Statements	87.83%	87.91%	📈 +0.08%
Functions	83.11%	83.11%	➡️ +0.00%
Branches	79.88%	79.92%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/container-lifecycle.ts	87.1% → 88.2% (+1.14%)	87.5% → 88.6% (+1.11%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test Results

• ❌ GitHub MCP: gh auth failed (credentials issue)
• ✅ Playwright: GitHub page title verified
• ✅ File Writing: Test file created successfully
• ✅ Bash Tool: File verified via cat

Overall: FAIL (1 of 4 tests failed)

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	❌ 401 (no GitHub token in this env)
GitHub.com HTTP	✅ (pre-step confirmed)
File write/read (smoke-test-copilot-byok-25702682982.txt)	✅ confirmed
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅ responding

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

Overall: PASS (MCP auth failure is environment-level, not BYOK-related)

🔑 BYOK report filed by Smoke Copilot BYOK

[Copilot]

Pull request overview

Fixes the api-proxy container build so required OIDC-related runtime modules are actually present in the image, preventing startup crashes like Cannot find module './github-oidc' and restoring integration test stability.

Changes:

• Extends the containers/api-proxy/Dockerfile COPY list to include newly introduced OIDC helper/provider modules.
• Ensures AWS/GCP OIDC providers and shared refresh utilities are available at runtime inside the container image.

Show a summary per file

File	Description
containers/api-proxy/Dockerfile	Adds missing JS modules to the Docker build context so the container includes required OIDC runtime dependencies.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[github-actions]

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	❌ (401 Bad credentials)
GitHub.com HTTP	❌ (template vars not expanded)
File write/read	❌ (template vars not expanded)

Overall: FAIL

Pre-step template variables (${{ steps.smoke-data.outputs.* }}) were not substituted — smoke data was unavailable at agent runtime. GitHub MCP tools returned 401 Bad credentials.

/cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke test Codex: FAIL
PRs: fix(api-proxy): add missing JS modules to Dockerfile COPY; refactor: remove duplicate HTTP helpers from OidcTokenProvider
✅ GitHub PR review via public API
❌ safeinputs-gh unavailable; ❌ Tavily tools unavailable; ❌ discussion query unavailable
✅ Playwright title; ✅ file write/read; ✅ npm ci && npm run build
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke Test Results

Check	Result
Redis PING	❌ Timeout
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Not reached

Overall: FAIL — host.docker.internal is not reachable on ports 6379 or 5432 from this environment.

🔌 Service connectivity validated by Smoke Services

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2950 · ● 673.9K · ◷