Request Copilot review on agent PRs via the shared workflow

[Quasar-Apps-Agent]

Adds the org-wide Copilot review caller. Proven in scanprs-skill: an agent PR opened at 21:54:01 had a Copilot review at 21:55:32 — 1m31s, fully automatic.

Why it's needed

GitHub's "Automatically request Copilot code review" ruleset only fires when the PR author has Copilot access and quota (documented limitation). PRs here are authored by Quasar-Apps-Agent, which has no subscription — a personal plan on Quasar-Apps covers only that account, org membership notwithstanding. So the ruleset has never fired on them, and coverage has depended on the agent remembering to request a review by hand.

This repo has a live example: #29 — "Fix two latent sync-dispatch bugs" — sat over an hour with no review at all, because nothing asked for one.

This supplies the requester identity the ruleset cannot: the review is requested as Quasar-Apps, whose subscription covers it.

What this file does and doesn't do

All logic lives in QuasarApps/.github; this is 16 lines of trigger and secret. A fix lands once rather than in every repo.

pull_request_target, not pull_request — the former reads the workflow definition from the base branch. Under pull_request anyone with push access could edit the caller on a branch and exfiltrate the PAT. That trigger is only safe because the called workflow never checks out or executes PR code; don't add steps here that do.

No synchronize — each Copilot review costs 13 premium requests, so re-reviews after pushes stay a judgement call. Close and reopen to re-request.

Two things to expect

This PR won't be auto-reviewed. pull_request_target reads from the base branch, which doesn't have the workflow yet. Same bootstrap everywhere — the first PR after this merges is the one that proves it.

Runs won't appear in the PR's checks list. They attach to the base commit. Confirm via the Actions tab.

Requires

The org secret COPILOT_REVIEW_PAT must reach this repo, and the PAT's own repository-access list must include it. Those are two separate settings: miss the first and the run says COPILOT_REVIEW_PAT is not set; miss the second and it's a bare HTTP 404. The workflow distinguishes them deliberately.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Copilot]

Pull request overview

Adds a repository-level GitHub Actions workflow that calls the org-wide reusable workflow (QuasarApps/.github) to automatically request Copilot review for PRs, addressing the limitation where GitHub’s built-in auto-request rules don’t trigger for PRs authored by a non-subscribed agent account.

Changes:

• Introduces a new pull_request_target workflow that calls the shared Copilot review requester workflow.
• Passes COPILOT_REVIEW_PAT explicitly (instead of secrets: inherit) to minimize secret exposure.
• Documents key security/operational expectations (base-branch attachment, no synchronize, and why pull_request_target is used).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/copilot-review.yml:28

• The caller workflow is missing actions: read in its permissions. GitHub requires both contents: read and actions: read for the caller’s GITHUB_TOKEN to fetch and run a reusable workflow from another repository (especially if the called repo is private). Without actions: read, this job may fail to resolve QuasarApps/.github/.github/workflows/copilot-review.yml@main.

permissions:
  # Minimum needed to resolve the called workflow from another repository.
  # Not `{}`: zero permissions can leave the job unable to fetch it.
  contents: read