Repository navigation
Use Actions token for Copilot workflow authentication - #1295
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The authentication wiring matches the existing Copilot smoke configuration, with only non-blocking documentation feedback remaining.
1 open finding
What changed in this PR
Moves four scheduled workflows from an expired Copilot PAT to the built-in Actions token, restoring authentication for monitoring and reporting.
Changes:
- Adds Copilot inference permission and regenerates agent and detector authentication.
- Clears unused Copilot credentials from Claude and Codex smokes.
- Updates authentication documentation without upgrading runtime versions.
| File | Description |
|---|---|
scratchpad/security_review.md |
Updates the documented token fallback. |
README.md |
Documents Actions-token authentication. |
CLAUDE.md |
Updates engine authentication guidance. |
.github/workflows/smoke-codex-standalone.md |
Clears the unused Copilot credential. |
.github/workflows/smoke-codex-standalone.lock.yml |
Regenerates Codex credential handling. |
.github/workflows/smoke-claude-standalone.md |
Clears the unused Copilot credential. |
.github/workflows/smoke-claude-standalone.lock.yml |
Regenerates Claude credential handling. |
.github/workflows/gh-aw-parity-monitor.md |
Grants Copilot inference permission. |
.github/workflows/gh-aw-parity-monitor.lock.yml |
Switches agent and detector authentication. |
.github/workflows/gh-aw-issue-digest.md |
Grants Copilot inference permission. |
.github/workflows/gh-aw-issue-digest.lock.yml |
Switches agent and detector authentication. |
.github/workflows/detection-stats-daily.md |
Grants Copilot inference permission. |
.github/workflows/detection-stats-daily.lock.yml |
Switches agent and detector authentication. |
.github/workflows/detection-failure-monitor.md |
Grants Copilot inference permission. |
.github/workflows/detection-failure-monitor.lock.yml |
Switches agent and detector authentication. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| > | ||
| > If you build the gh-aw compiler from source rather than installing the released extension, you must pass **both** `-X main.version=<TAG>` and `-X main.isRelease=true`. Without the latter, gh-aw normalizes the emitted `compiler_version` / `GH_AW_VERSION` to `dev` and skips release-only generation. | ||
|
|
||
| Copilot workflows and their detection jobs use the built-in Actions token with `permissions: copilot-requests: write`; no Copilot Actions secret is required. |
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four scheduled workflows failed before inference because the expired Copilot PAT returned HTTP 401 from the model catalog endpoint, preventing
autoresolution. Use the built-in Actions token, matching the working Copilot smoke.copilot-requests: writeto the detection failure monitor, parity monitor, daily statistics, and issue digest sources. Regenerated agent and detector jobs use${{ github.token }}with S2S authentication.Validation:
make fmt lint build testpassed; all seven agentic workflows compiled successfully, with only the existing statistics concurrency warning. Verified both Copilot jobs in each affected workflow use the Actions token and no repository files reference either deleted Copilot Actions-secret spelling. Hosted execution remains to be verified after merge.Fixes #1287
Fixes #1289
Fixes #1290
Fixes #1292