Add CI repro test for GH_HOST proxy/PR checkout mismatch (issue #23461) (#23496)

Author: Copilot

.github/workflows/ci.yml

@@ -2991,3 +2991,96 @@ jobs:
           echo "2. \`gh\` CLI calls are routed through the proxy (\`GH_HOST=localhost:18443\`)" >> $GITHUB_STEP_SUMMARY
           echo "3. \`actions/github-script\` sees the proxy env (\`GH_HOST=localhost:18443\`)" >> $GITHUB_STEP_SUMMARY
           echo "4. \`stop_difc_proxy.sh\` stops the proxy container" >> $GITHUB_STEP_SUMMARY
+
+  sh-gh-host-pr-checkout-repro:
+    name: GH_HOST Proxy PR Checkout Repro (Issue #23461)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: validate-yaml
+    permissions:
+      contents: read
+    concurrency:
+      group: ci-${{ github.ref }}-sh-gh-host-pr-checkout-repro
+      cancel-in-progress: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Start local proxy
+        run: |
+          # Start a simple HTTP server on port 19443 to simulate a local proxy.
+          # This is the "local proxy" referenced in the repro scenario for issue #23461:
+          # a server IS running on the proxy host, but git remotes still point to the real
+          # GitHub host, causing `gh pr checkout` to fail.
+          python3 -m http.server 19443 --bind 127.0.0.1 --directory /tmp >/tmp/local-proxy.log 2>&1 &
+          echo "LOCAL_PROXY_PID=$!" >> "$GITHUB_ENV"
+          sleep 1
+          echo "Local proxy started on port 19443 (simulating a DIFC-style proxy)"
+
+      - name: Set GH_HOST to simulate proxy-rewritten environment
+        run: |
+          # Set GH_HOST=localhost:19443 directly to simulate the proxy-rewritten environment
+          # described in issue #23461.  We write directly to $GITHUB_ENV here because
+          # GITHUB_SERVER_URL is a runner-managed variable that cannot be overridden via
+          # step-level env:, so running configure_gh_for_ghe.sh with
+          # GITHUB_SERVER_URL=http://localhost:19443 would be silently ignored.
+          echo "GH_HOST=localhost:19443" >> "$GITHUB_ENV"
+          echo "Set GH_HOST=localhost:19443 (simulating a DIFC proxy-rewritten environment)"
+
+      - name: Repro - gh pr checkout fails when GH_HOST points to proxy without matching remote
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          echo "GH_HOST=${GH_HOST}"
+          echo "Git remotes (origin still points to github.com, not the local proxy):"
+          git remote -v
+
+          # Attempt gh pr checkout.  GH_HOST=localhost:19443 but the only git remote
+          # is origin pointing to github.com — no remote matches the proxy host.
+          # gh CLI should exit non-zero with the characteristic mismatch error.
+          # Any PR number works here: gh validates GH_HOST against git remotes before
+          # making any API call, so the failure occurs regardless of whether PR #1 exists.
+          set +e
+          error_output=$(gh pr checkout 1 2>&1)
+          exit_code=$?
+          set -e
+
+          echo "gh pr checkout exit code: ${exit_code}"
+          echo "Output: ${error_output}"
+
+          if [ "${exit_code}" -eq 0 ]; then
+            echo "❌ Expected gh pr checkout to fail but it succeeded unexpectedly"
+            exit 1
+          fi
+
+          if echo "${error_output}" | grep -q "none of the git remotes"; then
+            echo "✅ Issue #23461 reproduced: GH_HOST mismatch causes gh pr checkout to fail"
+            echo "   Error: ${error_output}"
+          else
+            echo "❌ gh pr checkout failed, but not with the expected GH_HOST/git remote mismatch error"
+            echo "   Unexpected error output: ${error_output}"
+            exit 1
+          fi
+
+      - name: Stop local proxy
+        if: always()
+        run: |
+          if [ -n "${LOCAL_PROXY_PID:-}" ]; then
+            kill "${LOCAL_PROXY_PID}" 2>/dev/null || true
+            echo "Local proxy stopped"
+          fi
+
+      - name: Generate summary
+        if: always()
+        run: |
+          echo "## GH_HOST Proxy PR Checkout Repro (Issue [#23461](https://github.com/github/gh-aw/issues/23461))" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "This test reproduces the failure mode described in issue #23461:" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "1. A local HTTP server starts on \`localhost:19443\` (the \"local proxy\")" >> $GITHUB_STEP_SUMMARY
+          echo "2. \`configure_gh_for_ghe.sh\` sets \`GH_HOST=localhost:19443\` (simulating a proxy-rewritten environment)" >> $GITHUB_STEP_SUMMARY
+          echo "3. Git remote \`origin\` still points to the real GitHub host (not the proxy)" >> $GITHUB_STEP_SUMMARY
+          echo "4. \`gh pr checkout\` fails because no git remote matches \`GH_HOST\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "The existing \`sh-difc-proxy\` job uses the full Docker-based DIFC proxy; this job" >> $GITHUB_STEP_SUMMARY
+          echo "provides a lightweight local-proxy repro that does not require Docker." >> $GITHUB_STEP_SUMMARY