feat: add Copilot provider to aibridge (#21663)

Adds GitHub Copilot as a supported AI provider in aibridge. 

Depends on: https://github.com/coder/aibridge/pull/137
Closes: https://github.com/coder/internal/issues/1235

cli/testdata/server-config.yaml.golden

@@ -820,13 +820,16 @@ aibridgeproxy:
   # Path to the CA private key file for AI Bridge Proxy.
   # (default: <unset>, type: string)
   key_file: ""
-  # Comma-separated list of domains for which HTTPS traffic will be decrypted and
-  # routed through AI Bridge. Requests to other domains will be tunneled directly
-  # without decryption.
-  # (default: api.anthropic.com,api.openai.com, type: string-array)
+  # Comma-separated list of AI provider domains for which HTTPS traffic will be
+  # decrypted and routed through AI Bridge. Requests to other domains will be
+  # tunneled directly without decryption. Supported domains: api.anthropic.com,
+  # api.openai.com, api.individual.githubcopilot.com.
+  # (default: api.anthropic.com,api.openai.com,api.individual.githubcopilot.com,
+  # type: string-array)
   domain_allowlist:
     - api.anthropic.com
     - api.openai.com
+    - api.individual.githubcopilot.com
   # URL of an upstream HTTP proxy to chain tunneled (non-allowlisted) requests
   # through. Format: http://[user:pass@]host:port or https://[user:pass@]host:port.
   # (default: <unset>, type: string)

codersdk/deployment.go

@@ -3757,11 +3757,11 @@ Write out the current server config as YAML to stdout.`,
 		},
 		{
 			Name:        "AI Bridge Proxy Domain Allowlist",
-			Description: "Comma-separated list of domains for which HTTPS traffic will be decrypted and routed through AI Bridge. Requests to other domains will be tunneled directly without decryption.",
+			Description: "Comma-separated list of AI provider domains for which HTTPS traffic will be decrypted and routed through AI Bridge. Requests to other domains will be tunneled directly without decryption. Supported domains: api.anthropic.com, api.openai.com, api.individual.githubcopilot.com.",
 			Flag:        "aibridge-proxy-domain-allowlist",
 			Env:         "CODER_AIBRIDGE_PROXY_DOMAIN_ALLOWLIST",
 			Value:       &c.AI.BridgeProxyConfig.DomainAllowlist,
-			Default:     "api.anthropic.com,api.openai.com",
+			Default:     "api.anthropic.com,api.openai.com,api.individual.githubcopilot.com",
 			Hidden:      true,
 			Group:       &deploymentGroupAIBridgeProxy,
 			YAML:        "domain_allowlist",

enterprise/aibridgeproxyd/aibridgeproxyd.go

@@ -32,6 +32,7 @@ import (
 const (
 	HostAnthropic = "api.anthropic.com"
 	HostOpenAI    = "api.openai.com"
+	HostCopilot   = "api.individual.githubcopilot.com"
 )
 
 const (
@@ -543,6 +544,8 @@ func defaultAIBridgeProvider(host string) string {
 		return aibridge.ProviderAnthropic
 	case HostOpenAI:
 		return aibridge.ProviderOpenAI
+	case HostCopilot:
+		return aibridge.ProviderCopilot
 	default:
 		return ""
 	}

enterprise/cli/aibridged.go

@@ -48,6 +48,9 @@ func newAIBridgeDaemon(coderAPI *coderd.API) (*aibridged.Server, error) {
 			CircuitBreaker:   cbConfig,
 			SendActorHeaders: cfg.SendActorHeaders.Value(),
 		}, getBedrockConfig(cfg.Bedrock)),
+		aibridge.NewCopilotProvider(aibridge.CopilotConfig{
+			CircuitBreaker: cbConfig,
+		}),
 	}
 
 	reg := prometheus.WrapRegistererWithPrefix("coder_aibridged_", coderAPI.PrometheusRegistry)