Validate PAT pool entries before selection

[nagilson]

The PAT Pool Provider will still use an expired pat. validate_pat_pool only runs periodically to tell users to update their PAT but that doesn't mean that the PATs get updated right away, and this blocks workflows from running, which is why some issues randomly have not been triaged by the agentic triager.

See https://github.com/dotnet/sdk/actions/runs/31006386647 as an example.

The only repo or skill doing PAT validation is https://github.com/dotnet/runtime/blob/main/.github/workflows/ci-eval.yml which uses this same pattern but did not apply the fix to the overall PAT pool PAT selector.

If this is acceptable, this should likely be migrated to the other PAT pool implementations.
https://github.com/nagilson/sdk/actions/runs/31051484546 demonstrates a run where PAT_0 is valid and PAT_1 is invalid, and the PAT pool provider disregards expired PATs. It does not disregard PATS with incorrect permissions.

A ❌ now appears on invalid tokens in the provider summary.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Updates the GitHub Actions PAT pool selection logic in dotnet/sdk’s agentic workflows so expired/revoked/unauthenticated PATs are filtered out before random selection, reducing workflow failures caused by selecting an unusable PAT.

Changes:

• Add an authentication pre-check (GET https://api.github.com/user) for each configured COPILOT_PAT_# entry and exclude non-200 entries from selection.
• Fail fast when PATs are configured but none authenticate, and surface per-slot status in the step summary.
• Update PAT pool documentation and refresh generated workflow lockfiles / action pinning metadata.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/shared/pat_pool.README.md	Documents the new “validate before select” behavior and safety properties (noted list-format indentation issues).
.github/workflows/shared/pat_pool.md	Implements the pre-selection auth check and “all configured invalid” failure behavior.
.github/workflows/parallel-safety-audit-command.lock.yml	Regenerates the compiled workflow to include the updated PAT selection behavior.
.github/workflows/issue-triage.lock.yml	Regenerates the compiled workflow to include the updated PAT selection behavior.
.github/workflows/add-tactics-template-on-comment.lock.yml	Regenerates the compiled workflow to include the updated PAT selection behavior.
.github/aw/actions-lock.json	Updates the pinned github/gh-aw-actions/setup action version/SHA entry.

Suppressed comments (1)

.github/workflows/shared/pat_pool.README.md:173

• The continuation lines for this numbered list item are indented with only 2 spaces (lines 170-174), while other list continuations in this section use 3 spaces. This can cause the text to render outside the list in Markdown.

1. **The `select-pat-number` action does not require any permissions.** It
  reads only the `COPILOT_PAT_#` environment variables passed to it, makes
  authentication checks against GitHub, and writes only the selected number
  to `GITHUB_OUTPUT`. The job that hosts it sets `permissions:` to the workflow
  defaults (no elevated scopes). PAT values and API response bodies are never

[jeffhandley]

Fantastic!!!