[awf] DIFC proxy: gh api /issues/{n}/comments returns wrong type under min-integrity: approved

[lpcox]

Problem

Under min-integrity: approved, a run: step calling gh api "repos/{owner}/{repo}/issues/{n}/comments" exits 1 with expected an object but got: array. The same call succeeds against api.github.com directly. Removing min-integrity restores correct behaviour.

Context

Upstream issue: github/gh-aw#34904

Reproduced across gh-aw v0.71.5 and v0.74.8, DIFC proxy versions 0.25.40 and 0.25.49. The proxy logs are available via gh run download --repo polmichel/infrahub -n agent.

Root Cause

The DIFC proxy (min-integrity enforcement path) wraps or transforms the GitHub API response for the /issues/{n}/comments endpoint, converting the top-level JSON array into an object (or vice versa), breaking the gh api JSON schema expectation.

Proposed Solution

Audit the DIFC proxy response-handling layer (containers/api-proxy/ or equivalent) for the /issues/{n}/comments path. Ensure array responses are passed through verbatim without wrapping. Add an integration test that calls gh api repos/.../issues/.../comments through the proxy under min-integrity: approved and asserts the response is a JSON array.

Generated by Firewall Issue Dispatcher · sonnet46 1.6M · ◷

[github-actions]

👋 Hello! I noticed this issue might be a duplicate of an existing issue:

• [awf] DIFC Proxy: gh api array responses rejected under min-integrity: approved #3844 — [awf] DIFC Proxy: gh api array responses rejected under min-integrity: approved (closed as completed on 2026-05-26)

Both issues describe the same problem: the DIFC proxy transforming JSON array responses from the /issues/{n}/comments endpoint under min-integrity: approved, causing gh api to fail with expected an object but got: array. They share the same root cause and proposed solution.

Since #3844 was closed as completed, it may be worth checking whether that fix was fully deployed — if the issue persists in newer proxy versions, this may be a regression rather than a true duplicate.

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #3903 · sonnet46 504.2K · ◷

[lpcox]

MCPG tracking issue: github/gh-aw-mcpg#6537