fix(daily-issues-report): switch engine from codex to copilot

[Copilot]

daily-issues-report has been failing since Mar 24 because engine: codex is blocked by an OpenAI API restriction ("access temporarily limited for potentially suspicious activity"). The agent job was completing in ~2 seconds with no output — Codex rejecting the request immediately.

Changes

• daily-issues-report.md: engine: codex → engine: copilot; retains runs-on: aw-gpu-runner-T4 custom runner
• daily-issues-report.lock.yml: recompiled — now invokes copilot CLI with appropriate allowed domains (PyPI, GitHub Copilot API, etc.) instead of codex CLI with OpenAI domains

Notes

• Same Codex restriction is blocking duplicate-code-detector; that workflow is left as-is pending OpenAI policy resolution
• The route.endpoint is not a function Issue Monster regression and the 17 stale lock files reported in the dashboard were already addressed in recent main commits (4916f0947, db73fef0b, c4772b4d3) before this PR

[pelikhan]

@copilot keep running on custom runner

[Copilot]

Done — runs-on: aw-gpu-runner-T4 restored in d533176.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Switches the daily-issues-report agent workflow from the blocked codex engine to the copilot engine to restore successful daily runs.

Changes:

• Updated workflow frontmatter to use engine: copilot.
• Recompiled the workflow lock to install and execute GitHub Copilot CLI (including updated allowed domains and log parsing).
• Updated engine metadata, secret validation/redaction, and added inference-access error detection output.

Show a summary per file

File	Description
.github/workflows/daily-issues-report.md	Changes workflow engine selection from Codex to Copilot.
.github/workflows/daily-issues-report.lock.yml	Updates compiled workflow to run Copilot CLI instead of Codex, including secrets, MCP gateway config, and log parsing.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1

[Copilot]

The workflow executes node ${RUNNER_TEMP}/gh-aw/actions/generate_safe_outputs_tools.cjs, but this PR removes the actions/setup-node step. On a custom runner (aw-gpu-runner-T4), Node.js availability/version isn’t guaranteed, which can make the job fail or behave inconsistently across runner images. Consider re-adding actions/setup-node (pin a Node version) or running this script in a known Node runtime (e.g., via a container) to keep the workflow deterministic.