chore(workflows): migrate copilot workflows to copilot-requests auth#6570
Merged
Conversation
COPILOT_GITHUB_TOKEN was removed from the repo, so copilot-engine workflows relying on that PAT fail Copilot auth (HTTP 401 through the api-proxy sidecar, e.g. issue #6561 refactoring-scanner). - Add `copilot-requests: write` to the 15 default-copilot workflows that were missing it, so Copilot inference uses the GitHub Actions token (S2STOKENS) with central org billing instead of the PAT. - Delete smoke-copilot-pat (its sole purpose was testing the now-removed COPILOT_GITHUB_TOKEN PAT path). - Recompile all workflows and run smoke post-processing. Compiled locks now wire the agent to github.token and drop the hard Validate COPILOT_GITHUB_TOKEN step. Recompile also picked up routine toolchain/image version bumps (agent 0.27.37->0.27.41, mcpg v0.4.3->v0.4.5, setup action v0.83.1->v0.83.2). Non-copilot engines (Claude/Codex/Gemini) are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f60b144-4aef-4dd3-8db6-0b2e6f4924b7
Resolve lock-file conflicts by regenerating all workflows with gh aw compile on top of the merged sources. Keeps copilot-requests migration and drops smoke-copilot-pat. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f60b144-4aef-4dd3-8db6-0b2e6f4924b7
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates Copilot workflows from the removed PAT secret to GitHub Actions copilot-requests authentication, addressing #6561.
Changes:
- Grants
copilot-requests: writeto 15 Copilot workflows. - Removes the obsolete Copilot PAT smoke test.
- Regenerates workflows with refreshed action and container pins.
Show a summary per file
| File | Description |
|---|---|
.github/aw/actions-lock.json |
Updates gh-aw action pins. |
.github/workflows/agentics-maintenance.yml |
Regenerates maintenance workflow. |
.github/workflows/ci-doctor.md |
Enables Copilot request authentication. |
.github/workflows/claude-token-optimizer.md |
Enables Copilot request authentication. |
.github/workflows/claude-token-usage-analyzer.md |
Enables Copilot request authentication. |
.github/workflows/cli-flag-consistency-checker.md |
Enables Copilot request authentication. |
.github/workflows/copilot-token-optimizer.md |
Enables Copilot request authentication. |
.github/workflows/dependency-security-monitor.md |
Enables Copilot request authentication. |
.github/workflows/firewall-issue-dispatcher.md |
Enables Copilot request authentication. |
.github/workflows/issue-duplication-detector.md |
Enables Copilot request authentication. |
.github/workflows/model-api-mapping-updater.md |
Enables Copilot request authentication. |
.github/workflows/refactoring-scanner.md |
Enables Copilot request authentication. |
.github/workflows/security-review.md |
Enables Copilot request authentication. |
.github/workflows/self-hosted-runner-doctor-updater.md |
Enables Copilot request authentication. |
.github/workflows/self-hosted-runner-doctor.md |
Enables Copilot request authentication. |
.github/workflows/test-coverage-improver.md |
Enables Copilot request authentication. |
.github/workflows/update-release-notes.md |
Enables Copilot request authentication. |
.github/workflows/smoke-copilot-pat.md |
Removes obsolete PAT smoke workflow. |
.github/workflows/smoke-copilot-pat.lock.yml |
Removes its generated workflow. |
.github/workflows/build-test-network-isolation.lock.yml |
Refreshes generated pins. |
.github/workflows/build-test.lock.yml |
Refreshes generated pins. |
.github/workflows/ci-cd-gaps-assessment.lock.yml |
Refreshes generated pins. |
.github/workflows/ci-doctor.lock.yml |
Compiles new authentication wiring. |
.github/workflows/claude-token-optimizer.lock.yml |
Compiles new authentication wiring. |
.github/workflows/claude-token-usage-analyzer.lock.yml |
Compiles new authentication wiring. |
.github/workflows/cli-flag-consistency-checker.lock.yml |
Compiles new authentication wiring. |
.github/workflows/config-consistency-auditor.lock.yml |
Refreshes generated pins. |
.github/workflows/contribution-check.lock.yml |
Refreshes generated pins. |
.github/workflows/copilot-token-optimizer.lock.yml |
Compiles new authentication wiring. |
.github/workflows/copilot-token-usage-analyzer.lock.yml |
Refreshes generated pins. |
.github/workflows/dependency-security-monitor.lock.yml |
Compiles new authentication wiring. |
.github/workflows/doc-maintainer.lock.yml |
Refreshes generated pins. |
.github/workflows/duplicate-code-detector.lock.yml |
Refreshes generated pins. |
.github/workflows/export-audit.lock.yml |
Refreshes generated pins. |
.github/workflows/firewall-issue-dispatcher.lock.yml |
Compiles new authentication wiring. |
.github/workflows/issue-duplication-detector.lock.yml |
Compiles new authentication wiring. |
.github/workflows/issue-monster.lock.yml |
Refreshes generated pins. |
.github/workflows/model-api-mapping-updater.lock.yml |
Compiles new authentication wiring. |
.github/workflows/network-isolation-test.lock.yml |
Refreshes generated pins. |
.github/workflows/pelis-agent-factory-advisor.lock.yml |
Refreshes generated pins. |
.github/workflows/plan.lock.yml |
Refreshes generated pins. |
.github/workflows/red-team-benchmark.lock.yml |
Refreshes generated pins. |
.github/workflows/refactoring-scanner.lock.yml |
Compiles new authentication wiring. |
.github/workflows/sbx-gvisor-doc-updater.lock.yml |
Refreshes generated pins. |
.github/workflows/schema-sync.lock.yml |
Refreshes generated pins. |
.github/workflows/secret-digger-claude.lock.yml |
Refreshes generated pins. |
.github/workflows/secret-digger-codex.lock.yml |
Refreshes generated pins. |
.github/workflows/secret-digger-copilot.lock.yml |
Refreshes generated pins. |
.github/workflows/security-guard.lock.yml |
Refreshes generated pins. |
.github/workflows/security-review.lock.yml |
Compiles new authentication wiring. |
.github/workflows/self-hosted-runner-doctor-updater.lock.yml |
Compiles new authentication wiring. |
.github/workflows/self-hosted-runner-doctor.lock.yml |
Compiles new authentication wiring. |
.github/workflows/smoke-chroot.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-claude.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-codex.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-copilot-byok-aoai-apikey.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-copilot-byok-aoai-entra.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-copilot-byok.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-copilot-network-isolation.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-copilot.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-docker-sbx-build-test.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-docker-sbx-claude.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-docker-sbx-codex.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-docker-sbx.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-gemini.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-gvisor-build-test.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-gvisor-claude.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-gvisor-codex.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-gvisor.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-otel-tracing.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-services.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-sink-visibility-allowed.lock.yml |
Refreshes generated pins. |
.github/workflows/smoke-sink-visibility-blocked.lock.yml |
Refreshes generated pins. |
.github/workflows/test-coverage-improver.lock.yml |
Compiles new authentication wiring. |
.github/workflows/test-coverage-reporter.lock.yml |
Refreshes generated pins. |
.github/workflows/test-hard-cap-ai-credits.lock.yml |
Refreshes generated pins. |
.github/workflows/update-release-notes.lock.yml |
Compiles new authentication wiring. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 76/76 changed files
- Comments generated: 0
- Review effort level: Medium
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
COPILOT_GITHUB_TOKENwas removed from the repo. Copilot-engine workflows that relied on that PAT now fail Copilot authentication with HTTP 401 through the api-proxy sidecar — e.g. therefactoring-scannerfailure in #6561:What
copilot-requests: writeto the 15 default-copilot workflows that were missing it. With this permission, gh-aw routes Copilot inference through the GitHub Actions token (S2STOKENS) with central org billing, and ignoresCOPILOT_GITHUB_TOKEN:smoke-copilot-pat— its sole purpose was exercising the now-removedCOPILOT_GITHUB_TOKENPAT path.gh aw compile) and run the smoke post-processing script.Result
.mdreferencessecrets.COPILOT_GITHUB_TOKENanymore.copilot-requests: write.COPILOT_GITHUB_TOKEN: ${{ github.token }}withS2STOKENS: true, and the hardValidate COPILOT_GITHUB_TOKENstep is gone from every lock. The only remainingsecrets.COPILOT_GITHUB_TOKENmentions are the non-blockingcheck_oauth_tokens.shdiagnostic (renders empty when the secret is absent) — not a dependency.Note on diff size
Recompiling also picked up routine toolchain/image version bumps (agent
0.27.37→0.27.41, mcpgv0.4.3→v0.4.5, setup actionv0.83.1→v0.83.2), which is why the diff touches all lock files plusagentics-maintenance.ymlandactions-lock.json. These were intentionally kept.