Emit Copilot auth migration tip for `copilot-requests` workflows by Copilot · Pull Request #39129 · github/gh-aw

Copilot · 2026-06-13T17:03:54Z

This change adds compiler guidance for Copilot-engine workflows to prefer GitHub Actions token-based inference (permissions.copilot-requests: write) over PAT-based auth. The tip is intentionally suppressed when users explicitly disable it with copilot-requests: none.

What changed
- Added a Copilot-specific compiler info tip in permission validation when:
  - engine is copilot, and
  - permissions.copilot-requests is not effectively write.
- Added suppression logic so the tip does not appear when:
  - copilot-requests: write is already configured, or
  - copilot-requests: none is explicitly set.
- Added integration coverage for:
  - Copilot engine without copilot-requests (tip emitted),
  - Copilot engine with write (no tip),
  - Copilot engine with none (no tip),
  - non-Copilot engine (no tip).
Implementation detail
- Introduced shouldEmitCopilotRequestsEnableTip(workflowData, workflowPermissions) to centralize tip gating, using explicit permission checks to distinguish intentional none from unset/default states.

if shouldEmitCopilotRequestsEnableTip(workflowData, workflowPermissions) {
    tipMsg := `Tip: set permissions.copilot-requests: write to use GitHub Actions token-based inference with the Copilot engine instead of a personal access token (COPILOT_GITHUB_TOKEN).`
    fmt.Fprintln(os.Stderr, formatCompilerMessage(markdownPath, "info", tipMsg))
}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-06-13T17:25:13Z

Hey @copilot-swe-agent 👋 — great work adding the copilot-requests permission tip to the compiler! The implementation in permissions_compiler_validator.go is clean, the suppression logic for none is correct, and the integration test coverage across all four cases is exactly right.

One thing to address before this moves out of draft:

Unfocused diff — .github/workflows/test-quality-sentinel.lock.yml contains an unrelated emoji substitution (🧪 → ✅) in several runSuccess message strings, alongside the expected frontmatter_hash bump. The emoji change is not mentioned in the PR description and appears to be a separate concern bundled in accidentally. Either extract that change into its own PR, or document why it belongs here.

If you would like a hand cleaning this up, you can assign this prompt to your coding agent:

In the PR branch for gh-aw#39129, audit the changes to
`.github/workflows/test-quality-sentinel.lock.yml`.

The expected changes are:
- A `frontmatter_hash` bump on line 1 (auto-generated, keep it).

The unexpected changes are:
- Multiple hunks replacing the 🧪 emoji with ✅ in `runSuccess` message strings inside `GH_AW_SAFE_OUTPUT_MESSAGES`.

If those emoji replacements were not intentionally introduced by this PR's feature work
(adding the copilot-requests compiler tip), revert them so the diff only contains
the hash bump. If they were intentional, add a bullet point to the PR body explaining
why the runSuccess message icon was updated.

Generated by ✅ Contribution Check · 492.7 AIC · ⌖ 23.3 AIC · ⊞ 24.7K · ◷

Copilot

Pull request overview

Adds a compiler “info” tip for Copilot-engine workflows to encourage enabling permissions.copilot-requests: write (so Copilot auth can use the GitHub Actions token) while suppressing the tip when copilot-requests: none is explicitly set.

Changes:

Emit an info compiler message when engine: copilot and permissions.copilot-requests is not effectively write, unless explicitly set to none.
Introduce shouldEmitCopilotRequestsEnableTip(...) to centralize gating logic for the tip.
Add an integration test covering tip emission/suppression scenarios.

Show a summary per file

File	Description
pkg/workflow/permissions_compiler_validator.go	Adds tip emission during permission validation and centralizes the gating logic.
pkg/workflow/copilot_requests_tip_test.go	Adds integration coverage validating when the tip appears/doesn’t appear.
.github/workflows/test-quality-sentinel.lock.yml	Regenerated lockfile with unrelated safe-output message changes.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 5

Copilot · 2026-06-13T18:07:51Z

+			oldStderr := os.Stderr
+			r, w, _ := os.Pipe()
+			os.Stderr = w
+
+			compiler := NewCompiler()
+			compiler.SetStrictMode(false)
+			err := compiler.CompileWorkflow(testFile)
+
+			w.Close()
+			os.Stderr = oldStderr
+			var buf bytes.Buffer
+			io.Copy(&buf, r)
+			stderrOutput := buf.String()


Fixed in the latest commit by replacing the manual pipe setup with testutil.CaptureStderr, which handles errors from os.Pipe, guarantees os.Stderr restoration via t.Cleanup, and properly closes all file descriptors.

Copilot · 2026-06-13T18:07:51Z

        env:
          GH_AW_WORKFLOW_NAME: "Test Quality Sentinel"
-          GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"🧪 [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"
+          GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"


Intentional. The source test-quality-sentinel.md already defines run-success: "✅ ...", but the lock file was stale with the old 🧪 emoji. Running make recompile (required whenever a .md workflow changes) regenerated the lock to match the source — this is expected and correct drift cleanup.

Copilot · 2026-06-13T18:07:51Z

          GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}
          GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}
-          GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"🧪 [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"
+          GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"


Same as above — this is the same make recompile re-sync of the stale lock file to match the source .md.

Copilot · 2026-06-13T18:07:51Z

          GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
          GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
-          GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"🧪 [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"
+          GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"


Same as above — part of the same make recompile re-sync.

Copilot · 2026-06-13T18:07:51Z

      GH_AW_ENGINE_VERSION: "1.0.60"
      GH_AW_PROJECT_UTC: "-08:00"
-      GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"🧪 [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"
+      GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Test quality analysis by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is analyzing test quality on this {event_type}...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed test quality analysis.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) {status} during test quality analysis.\"}"


Same as above — part of the same make recompile re-sync.

pelikhan · 2026-06-13T17:53:01Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-06-13T18:19:15Z

@copilot review all comments and address unresolved review feedback. Then post a brief completion plan for any remaining blockers.

Generated by 👨‍🍳 PR Sous Chef · 143.8 AIC · ⌖ 1.04 AIC · ⊞ 17.4K · ◷

Copilot AI and others added 3 commits June 13, 2026 16:52

Plan copilot-requests tip change

a791f2e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add copilot-requests compiler tip for copilot engine

4cae4a2

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Tighten test fixture file permissions

5a660fa

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Jun 13, 2026

Copilot AI changed the title ~~Add Copilot compiler tip for enabling copilot-requests auth~~ Emit Copilot auth migration tip for copilot-requests workflows Jun 13, 2026

Copilot created this pull request from a session on behalf of pelikhan June 13, 2026 17:04 View session

Copilot finished work on behalf of pelikhan June 13, 2026 17:04

Copilot AI requested a review from pelikhan June 13, 2026 17:04

pelikhan marked this pull request as ready for review June 13, 2026 17:44

Copilot AI review requested due to automatic review settings June 13, 2026 17:44

Copilot started reviewing on behalf of pelikhan June 13, 2026 17:45 View session

Copilot AI reviewed Jun 13, 2026

View reviewed changes

Copilot started work on behalf of pelikhan June 13, 2026 17:53 View session

Use testutil.CaptureStderr for guaranteed stderr cleanup in tip test

bfa8142

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 13, 2026 18:08

pelikhan merged commit 35b9a15 into main Jun 13, 2026
29 checks passed

pelikhan deleted the copilot/update-go-compiler-tip branch June 13, 2026 18:30

This was referenced Jun 13, 2026

Smoke Test: Claude - 27478319746 #39144

Closed

Smoke Test: Copilot - 27478341903 #39148

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Emit Copilot auth migration tip for `copilot-requests` workflows#39129

Emit Copilot auth migration tip for `copilot-requests` workflows#39129
pelikhan merged 4 commits into
mainfrom
copilot/update-go-compiler-tip

Copilot AI commented Jun 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jun 13, 2026

Uh oh!

Copilot AI Jun 13, 2026

Uh oh!

Copilot AI Jun 13, 2026

Uh oh!

Copilot AI Jun 13, 2026

Uh oh!

Copilot AI Jun 13, 2026

Uh oh!

pelikhan commented Jun 13, 2026

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Jun 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 13, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jun 13, 2026

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 13, 2026 •

edited

Loading