fix: use gh CLI for reliable API access in issue duplication detector#3235
Conversation
The Issue Duplication Detector has been failing with 401 Bad Credentials on every run since at least May 11. The root cause is that the GH_AW_GITHUB_MCP_SERVER_TOKEN secret (used by the GitHub MCP server) appears to be expired/revoked, and since it's non-empty it takes priority over the working automatic GITHUB_TOKEN. This change updates the prompt to use the gh CLI (which uses the automatic GITHUB_TOKEN) for all GitHub API operations instead of relying on the GitHub MCP tools. The gh CLI is available in the sandbox via the bash tool and has reliable authentication. Fixes #3233 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Updates the Issue Duplication Detector agentic workflow instructions to avoid GitHub MCP tool authentication failures by switching GitHub API interactions to the gh CLI.
Changes:
- Replaces “fetch issue” step with a
gh issue view ... --json ...command. - Replaces “search for duplicates” guidance with
gh search issues/gh issue listexamples. - Adds a guideline to prefer
ghCLI over MCP tools for GitHub API access.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/issue-duplication-detector.md | Changes the workflow prompt to use gh CLI for issue fetching/searching to bypass failing MCP auth. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
.github/workflows/issue-duplication-detector.md:58
- Same concern for the
gh search issues/gh issue listcommands: unlessGH_TOKENis explicitly set for bash or the workflow imports/usessafeinputs-gh, these calls may run unauthenticated. Consider updating the prompt to usesafeinputs-gh(or explicitly exportGH_TOKENbefore invokinggh).
4. **Search for potential duplicates via GitHub API**: Always search GitHub for issues with similar keywords, whether or not the cache had data. Use the `gh` CLI for reliable API access:
```bash
gh search issues "<key terms>" --repo ${{ github.repository }} --state open --limit 10 --json number,title,body
gh issue list --repo ${{ github.repository }} --state open --limit 20 --json number,title,body,labels
</details>
- **Files reviewed:** 1/1 changed files
- **Comments generated:** 2
| 2. **Fetch the new issue**: Use the `gh` CLI to get the issue details, since it has reliable authentication: | ||
| ```bash | ||
| gh issue view ${{ github.event.issue.number }} --repo ${{ github.repository }} --json number,title,body,labels,createdAt | ||
| ``` |
| - Be helpful: Always explain why issues appear related | ||
| - Respect the cache: Keep stored data minimal and relevant | ||
| - Use pagination: Always use `perPage` parameter when listing/searching issues No newline at end of file | ||
| - Use pagination: Always use `perPage` parameter when listing/searching issues |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL —
|
This comment has been minimized.
This comment has been minimized.
|
@copilot address review feedback |
Addressed in 9b7bf00:
Lock file was recompiled to include the |
🔍 Smoke Test Results
Overall: FAIL — Workflow template variables (
|
Smoke Test: Copilot BYOK (Offline) ModeRunning in BYOK offline mode (
Overall: FAIL — Pre-step template variables (
|
Smoke Test ResultsTest Results:
Total: 2/3 PASSED — GitHub API test failed due to network constraints in the sandboxed environment.
|
|
Smoke Test Codex Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Smoke Test Results (Gemini)
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Problem
The Issue Duplication Detector has been failing on every single run since at least May 11 with
401 Bad Credentialsfrom the GitHub MCP server. Analysis of 10+ runs confirms this is a persistent failure, not transient.Root Cause
The GitHub MCP server receives its token via the secret chain:
The
GH_AW_GITHUB_MCP_SERVER_TOKENsecret appears to be expired/revoked. Since it exists and is non-empty, it takes priority in the||chain, preventing the fallback to the working automaticGITHUB_TOKEN.Fix
Updated the workflow prompt to use the
ghCLI (which uses the automaticGITHUB_TOKENviaGH_TOKENenv var) for all GitHub API operations instead of relying on the GitHub MCP server tools. TheghCLI is available in the AWF sandbox via thebashtool and has reliable authentication.Recommendation
Additionally, the
GH_AW_GITHUB_MCP_SERVER_TOKENrepo secret should be either:GITHUB_TOKEN(sufficient for read-only operations)This would fix the MCP tool authentication for ALL workflows that use
tools.github, not just this one.Evidence
Every run since May 11 shows:
Fixes #3233