Upgrade gh-aw to v0.79.8 and isolate PAT pool into copilot-pat-pool environment#10450
Open
jeffhandley wants to merge 1 commit into
Open
Upgrade gh-aw to v0.79.8 and isolate PAT pool into copilot-pat-pool environment#10450jeffhandley wants to merge 1 commit into
jeffhandley wants to merge 1 commit into
Conversation
…nvironment - Add copilot-pat-pool environment to pat_pool.md shared workflow - Add copilot-pat-pool environment to validate-pat-pool.yml - Add copilot-pat-pool environment to release-notes.md workflow - Remove default fall-back PAT (secrets.COPILOT_GITHUB_TOKEN) from case statement, use 'NO COPILOT PAT AVAILABLE' sentinel - Update comment block to describe environment isolation - Upgrade actions-lock.json to gh-aw-actions/setup v0.79.8 and actions/checkout v6.0.3 - Recompile release-notes.lock.yml with gh-aw v0.79.8 (--schedule-seed dotnet/core) - Update agentic-workflows.agent.md: restore/retain repo-specific instructions for copilot-pat-pool usage Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jeffhandley
commented
Jun 17, 2026
| - **CLI commands reference**: For a complete guide on all `gh aw` commands and their MCP tool equivalents (for restricted environments), see `.github/aw/cli-commands.md` | ||
| - **Repository-specific requirements**: There are multiple sets of repository-specific instructions below that must be respected. They affect workflow authoring, updates, compilation, and reviews. | ||
|
|
||
| ## Repository-Specific Requirements: Copilot PAT Pool |
Member
Author
There was a problem hiding this comment.
Everything above here came from upgrading gh-aw, with those changes being part of that update.
Everything below here is to retain (and update) our repo-specific instructions.
|
|
||
| jobs: | ||
| pat_pool: | ||
| environment: copilot-pat-pool |
Member
Author
There was a problem hiding this comment.
This is the key. By introducing an environment for our agentic jobs to run in, we can isolate the copilot-pat-pool secrets into that environment. Then agentic workflows have access to those PATs but never any other environment-specific secrets. This is the security hardening we gain from this update.
Comment on lines
49
to
+64
| # ############################################################### | ||
| # Override COPILOT_GITHUB_TOKEN with a random PAT from the pool. | ||
| # Ensure this agentic jobs run from the isolated | ||
| # `copilot-pat-pool` environment where the PAT pool is available. | ||
| # This stop-gap will be removed when org billing is available. | ||
| # See: .github/workflows/shared/pat_pool.README.md for more info. | ||
| # ############################################################### | ||
| imports: | ||
| - shared/pat_pool.md | ||
|
|
||
| environment: copilot-pat-pool | ||
|
|
||
| engine: | ||
| id: copilot | ||
| env: | ||
| COPILOT_GITHUB_TOKEN: ${{ case(needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0, needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1, needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2, needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3, needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4, needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5, needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6, needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7, needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8, needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9, secrets.COPILOT_GITHUB_TOKEN) }} | ||
| COPILOT_GITHUB_TOKEN: ${{ case(needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0, needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1, needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2, needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3, needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4, needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5, needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6, needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7, needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8, needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9, 'NO COPILOT PAT AVAILABLE') }} |
Member
Author
There was a problem hiding this comment.
These changes are updating this workflow to the updated guidance.
|
|
||
| jobs: | ||
| validate: | ||
| environment: copilot-pat-pool |
Member
Author
There was a problem hiding this comment.
And here's the change in the actual workflow import that yields the environment isolation for all agentic workflow.
Member
Author
|
Before we merge this PR, we need to configure the new |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There is a high degree of code in this PR that either came from upgrading gh-aw, or recompiling agentic workflow(s). I will leave comments on the places that have the substance of this change.