Use Actions token for Copilot inference in issue-triage workflow - #13830
Merged
Conversation
Add copilot-requests: write permission so the workflow uses the built-in GitHub Actions token for LLM calls, removing the need for a separate COPILOT_GITHUB_TOKEN secret. Co-authored-by: Copilot App <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the agentic issue-triage workflow to use the built-in GitHub Actions token for Copilot inference by granting copilot-requests: write, eliminating reliance on a separate COPILOT_GITHUB_TOKEN repository secret.
Changes:
- Adds
copilot-requests: writepermissions to the issue-triage workflow definition and compiled lock workflow jobs that perform inference. - Switches
COPILOT_GITHUB_TOKENfrom${{ secrets.COPILOT_GITHUB_TOKEN }}to${{ github.token }}in the compiled workflow and removes the secret validation step/outputs.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/issue-triage.md | Grants copilot-requests: write at the workflow definition level to enable Actions-token Copilot inference. |
| .github/workflows/issue-triage.lock.yml | Propagates permission and token-source changes into the compiled workflow; removes the dedicated secret dependency/validation. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Low
Comment on lines
+902
to
905
| GH_AW_SECRET_NAMES: 'GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN' | ||
| SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} | ||
| SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} | ||
| SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
pabrahamsson
pushed a commit
to pabrahamsson/containers
that referenced
this pull request
Aug 3, 2026
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@​dependabot](https://github.com/dependabot) in [#​13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@​dependabot](https://github.com/dependabot) in [#​13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@​dependabot](https://github.com/dependabot) in [#​13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@​dependabot](https://github.com/dependabot) in [#​13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot) in [#​13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@​dependabot](https://github.com/dependabot) in [#​13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@​dependabot](https://github.com/dependabot) in [#​13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@​dependabot](https://github.com/dependabot) in [#​13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@​dependabot](https://github.com/dependabot) in [#​13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@​dependabot](https://github.com/dependabot) in [#​13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@​dependabot](https://github.com/dependabot) in [#​13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@​dependabot](https://github.com/dependabot) in [#​13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@​dependabot](https://github.com/dependabot) in [#​13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@​dependabot](https://github.com/dependabot) in [#​13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@​dependabot](https://github.com/dependabot) in [#​13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@​dependabot](https://github.com/dependabot) in [#​13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in [#​13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@​dependabot](https://github.com/dependabot) in [#​13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@​dependabot](https://github.com/dependabot) in [#​13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot) in [#​13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@​dependabot](https://github.com/dependabot) in [#​13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@​dependabot](https://github.com/dependabot) in [#​13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@​dependabot](https://github.com/dependabot) in [#​13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@​dependabot](https://github.com/dependabot) in [#​13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@​dependabot](https://github.com/dependabot) in [#​13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@​dependabot](https://github.com/dependabot) in [#​13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot) in [#​13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@​dependabot](https://github.com/dependabot) in [#​14018](cli/cli#14018) #### New Contributors - [@​lukewar](https://github.com/lukewar) made their first contribution in [#​13777](cli/cli#13777) - [@​niik](https://github.com/niik) made their first contribution in [#​13780](cli/cli#13780) - [@​kofuk](https://github.com/kofuk) made their first contribution in [#​13787](cli/cli#13787) - [@​zwick](https://github.com/zwick) made their first contribution in [#​13807](cli/cli#13807) - [@​kobihikri](https://github.com/kobihikri) made their first contribution in [#​13886](cli/cli#13886) - [@​pstoeckle](https://github.com/pstoeckle) made their first contribution in [#​13940](cli/cli#13940) - [@​Solaris-star](https://github.com/Solaris-star) made their first contribution in [#​13927](cli/cli#13927) - [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#​13900](cli/cli#13900) - [@​alondahari](https://github.com/alondahari) made their first contribution in [#​13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41LjMiLCJ1cGRhdGVkSW5WZXIiOiI0NC41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28
1 task
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Aug 11, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@​me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
copilot-requests: writepermission to the issue-triage workflow so it uses the built-in GitHub Actions token for LLM inference calls, removing the need for a separateCOPILOT_GITHUB_TOKENsecret.This requires centralized Copilot billing to be enabled on the org.
Follow-up to #13777.