From c6807f88d49932e9d93331a49bbcc53a1830da09 Mon Sep 17 00:00:00 2001 From: Ve Sharma <62218708+VeVarunSharma@users.noreply.github.com> Date: Wed, 19 Aug 2026 17:01:41 -0700 Subject: [PATCH 1/5] Add agentic workflows skill Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- docs/README.skills.md | 1 + skills/agentic-workflows/SKILL.md | 153 ++++++++++++++++++++++++++++++ 2 files changed, 154 insertions(+) create mode 100644 skills/agentic-workflows/SKILL.md diff --git a/docs/README.skills.md b/docs/README.skills.md index aa492a833..f79833dba 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -39,6 +39,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [agent-skill-stack](../skills/agent-skill-stack/SKILL.md)
`gh skills install github/awesome-copilot agent-skill-stack` | Find, evaluate, and assemble the smallest compatible set of AI Agent Skills for an end-to-end natural-language goal. Use when a user wants Skills for a multi-step workflow, asks which Skills fit a project, needs an installed-Skill audit or conflict check, has low Skill recall, wants indirect helpers such as humanizers or compliance checks, or wants a project-specific Skill Stack with controlled installation. Search local Skills, registries, GitHub, and OpenCLI; compare adoption, verified fit, safety, and overlap. Do not use for locating one known or common Skill; use the generic find-skills workflow. | `agents`
`references/discovery-ranking.md`
`references/local-index-and-profiles.md`
`references/security-installation.md`
`references/workflow-model.md`
`scripts/inventory_skills.py`
`scripts/project_profile.py`
`scripts/render_stack_card.py`
`scripts/skill_index.py`
`scripts/stage_install.py` | | [agent-supply-chain](../skills/agent-supply-chain/SKILL.md)
`gh skills install github/awesome-copilot agent-supply-chain` | Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when:
- Generating SHA-256 integrity manifests for agent plugins or tool packages
- Verifying that installed plugins match their published manifests
- Detecting tampered, modified, or untracked files in agent tool directories
- Auditing dependency pinning and version policies for agent components
- Building provenance chains for agent plugin promotion (dev → staging → production)
- Any request like "verify plugin integrity", "generate manifest", "check supply chain", or "sign this plugin" | None | | [agentic-eval](../skills/agentic-eval/SKILL.md)
`gh skills install github/awesome-copilot agentic-eval` | Patterns and techniques for evaluating and improving AI agent outputs. Use this skill when:
- Implementing self-critique and reflection loops
- Building evaluator-optimizer pipelines for quality-critical generation
- Creating test-driven code refinement workflows
- Designing rubric-based or LLM-as-judge evaluation systems
- Adding iterative improvement to agent outputs (code, reports, analysis)
- Measuring and improving agent response quality | None | +| [agentic-workflows](../skills/agentic-workflows/SKILL.md)
`gh skills install github/awesome-copilot agentic-workflows` | Design, create, update, debug, and upgrade GitHub Agentic Workflows (gh-aw). Use for AI-powered GitHub Actions automation, issue or pull request triage, scheduled repository maintenance, workflow compilation, and gh-aw troubleshooting. | None | | [ai-prompt-engineering-safety-review](../skills/ai-prompt-engineering-safety-review/SKILL.md)
`gh skills install github/awesome-copilot ai-prompt-engineering-safety-review` | Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement recommendations with extensive frameworks, testing methodologies, and educational content. | None | | [ai-ready](../skills/ai-ready/SKILL.md)
`gh skills install github/awesome-copilot ai-ready` | Make any repo AI-ready — analyzes your codebase and generates AGENTS.md, copilot-instructions.md, CI workflows, issue templates, and more. Mines your PR review patterns and creates files customized to your stack. USE THIS SKILL when the user asks to "make this repo ai-ready", "set up AI config", or "prepare this repo for AI contributions". | None | | [ai-team-orchestration](../skills/ai-team-orchestration/SKILL.md)
`gh skills install github/awesome-copilot ai-team-orchestration` | Bootstrap and run a lightweight multi-agent development team. Use when starting or adopting a project, planning work, coordinating implementation and optional QA, brainstorming with distinct perspectives, or preserving context across sessions. | `references/anti-patterns.md`
`references/brainstorm-format.md`
`references/project-brief-template.md`
`references/sprint-plan-template.md` | diff --git a/skills/agentic-workflows/SKILL.md b/skills/agentic-workflows/SKILL.md new file mode 100644 index 000000000..f999c0743 --- /dev/null +++ b/skills/agentic-workflows/SKILL.md @@ -0,0 +1,153 @@ +--- +name: agentic-workflows +description: 'Design, create, update, debug, and upgrade GitHub Agentic Workflows (gh-aw). Use for AI-powered GitHub Actions automation, issue or pull request triage, scheduled repository maintenance, workflow compilation, and gh-aw troubleshooting.' +--- + +# GitHub Agentic Workflows + +Design and maintain secure GitHub Agentic Workflows from natural-language requirements. Use the current upstream `gh-aw` guidance as the source of truth instead of relying on remembered syntax. + +## Start with the Upstream Dispatcher + +For every request: + +1. Fetch and read all of: + `https://raw.githubusercontent.com/github/gh-aw/main/create.md` +2. Classify the request using that dispatcher. +3. Fetch the matching prompt from: + `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/` +4. Resolve relevant relative links in the selected prompt against the same `.github/aw/` base URL and read them before making changes. +5. If `.github/aw/instructions.md` exists in the target repository, read it after the upstream guidance. Repository instructions override upstream defaults when they conflict. + +Use the `main` branch URLs specified by the dispatcher so the guidance stays current. If the upstream prompt cannot be fetched, use the official documentation at `https://github.github.com/gh-aw/`, state the limitation, and do not invent unsupported syntax. + +## Route the Request + +| User intent | Upstream prompt | +|---|---| +| Design requirements are incomplete | `designer.md` | +| Create a workflow | `create-agentic-workflow.md` | +| Update an existing workflow | `update-agentic-workflow.md` | +| Debug, audit, or investigate a run | `debug-agentic-workflow.md` | +| Upgrade workflows or fix deprecations | `upgrade-agentic-workflows.md` | +| Create a reusable component or MCP wrapper | `create-shared-agentic-workflow.md` | + +Read the complete selected prompt before acting. Load only the linked topic references relevant to the request, except when the selected prompt marks references as required. + +## Working Method + +### 1. Establish the requested outcome + +- Distinguish implementation from design-only evaluation. +- If the user asks to create or implement a workflow, produce the workflow files rather than only describing them. +- If the user asks to evaluate an idea without creating files, return a compact design covering trigger, scope, tools, permissions, safe outputs, and `noop` behavior. +- Ask one focused question at a time only for policy choices that cannot be inferred. Do not repeat questions already answered by the request or repository. + +### 2. Inspect the target repository + +Before designing a workflow, inspect: + +- `.github/aw/instructions.md` +- `AGENTS.md`, `CONTRIBUTING.md`, and `CODEOWNERS` +- existing `.github/workflows/*.md` and matching `.lock.yml` files +- issue and pull request templates +- repository labels and team-routing conventions when the workflow will triage work +- manifests, lock files, and validation commands when the workflow will build or test code + +Use bounded GitHub queries and report unavailable data. For maintenance workflows, separate observed repository facts from recommendations. + +### 3. Prepare the CLI for implementation + +For workflow creation, editing, compilation, or debugging, follow the installation and upgrade instructions in the current upstream dispatcher. Verify the result with: + +```bash +gh aw version +``` + +Prefer the official GitHub CLI installation path when installation is needed: + +```bash +gh extension install github/gh-aw +``` + +Do not install or upgrade global tooling for a design-only evaluation. Do not run `gh aw init` unless the user explicitly asks for repository initialization. + +### 4. Apply the security model + +- Keep the agent job read-only. +- Route every GitHub mutation through the most specific `safe-outputs` operation. +- Prefer `tools.github.mode: gh-proxy` for GitHub reads. +- Enable only the required toolsets, MCP servers, secrets, and network destinations. +- Scope safe outputs with allowlists, targets, limits, and file restrictions where supported. +- Never interpolate untrusted issue, pull request, or comment content directly into shell scripts. +- Require the workflow to call `noop` with a short reason when no visible action is needed. +- Recommend traditional GitHub Actions when the request requires multi-job orchestration, cross-job state, long waits, approvals, or rollback logic. + +### 5. Create or edit the workflow + +- Store source workflows at `.github/workflows/.md`. +- Derive a lowercase kebab-case workflow ID and avoid overwriting an existing workflow. +- Keep YAML frontmatter minimal and put agent instructions in the Markdown body. +- Use deterministic prefetch steps for large GitHub datasets and give the agent compact files rather than unbounded context. +- Preserve existing repository conventions and make the smallest complete change. +- Do not commit or push unless the user explicitly requests it. + +### 6. Compile and verify + +Follow the current selected prompt's compile instructions. At minimum: + +```bash +gh aw compile +gh aw compile --validate +``` + +Fix every compile or validation error before stopping. Review both the source and generated lock file. Ensure `.gitattributes` contains: + +```text +.github/workflows/*.lock.yml linguist-generated=true +``` + +For a newly created workflow, the persistent result normally includes: + +- `.github/workflows/.md` +- `.github/workflows/.lock.yml` +- `.gitattributes` only when the generated-file rule was missing + +## Issue Triage Pattern + +For a request such as: + +> Create a workflow that triages new issues by type and priority, identifies duplicates, asks clarifying questions, and assigns the right team members. + +Use the create-workflow route and infer as much as possible from labels, issue templates, `CODEOWNERS`, and existing ownership conventions. + +Design the workflow so it: + +1. Runs when an issue is opened; use the current public-entrypoint guidance when community contributors must be allowed to trigger it. +2. Reads the triggering issue, repository labels, ownership rules, and a bounded set of duplicate candidates with GitHub read tools. +3. Checks for a likely duplicate before routing. When confidence is high, add a comment linking the canonical issue; do not close the issue unless explicitly requested. +4. Applies only allowlisted type and priority labels through `add-labels`. +5. Uses `add-comment` to ask concise clarifying questions when required information is missing. +6. Uses `assign-to-user` with an explicit assignee allowlist when ownership is clear. +7. Avoids assignment when clarification is still required unless repository policy says otherwise. +8. Calls `noop` when no safe visible change is appropriate. + +Ask for the allowed labels, assignees, or routing policy only when they cannot be inferred. Never grant direct issue write permission to the agent job to implement these actions. + +## Completion Criteria + +Do not consider an implementation complete until: + +- the workflow behavior matches the request +- every write maps to a configured safe output +- permissions and network access are minimal +- the source compiles successfully +- validation passes +- the generated lock file is current +- the final diff contains only intended workflow-related changes + +## Official References + +- Overview: `https://github.github.com/gh-aw/` +- Quick start: `https://github.github.com/gh-aw/setup/quick-start/` +- Upstream dispatcher: `https://raw.githubusercontent.com/github/gh-aw/main/create.md` From 71343af793320512c9de1f254317f73767d3e06d Mon Sep 17 00:00:00 2001 From: Ve Sharma <62218708+VeVarunSharma@users.noreply.github.com> Date: Thu, 20 Aug 2026 15:07:33 -0700 Subject: [PATCH 2/5] Fix PR duplicate check model Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8938494a-c76a-4a44-bfd2-a98edff33860 --- .github/workflows/pr-duplicate-check.lock.yml | 10 +++++----- .github/workflows/pr-duplicate-check.md | 1 + 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-duplicate-check.lock.yml b/.github/workflows/pr-duplicate-check.lock.yml index 516c669f7..99324ff2e 100644 --- a/.github/workflows/pr-duplicate-check.lock.yml +++ b/.github/workflows/pr-duplicate-check.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c4bf579582c4086263bafa20678ed2875220919d340720656d7a7511f0ea0078","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.78"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"6c90ad769af998afbe8357ce41a46bcd548b608649a6bfb32e884abba4262627","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","agent_model":"gpt-5-mini","engine_versions":{"copilot":"1.0.78"}} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"2709137ea6c5b0e19aa621454dc643ea8dc526b1","version":"v0.85.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.8","digest":"sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}],"has_pull_request":true} # This file was automatically generated by gh-aw (v0.85.4). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -119,7 +119,7 @@ jobs: env: GH_AW_INFO_ENGINE_ID: "copilot" GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI" - GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }} + GH_AW_INFO_MODEL: "gpt-5-mini" GH_AW_INFO_VERSION: "1.0.78" GH_AW_INFO_AGENT_VERSION: "1.0.78" GH_AW_INFO_CLI_VERSION: "v0.85.4" @@ -778,7 +778,7 @@ jobs: COPILOT_AGENT_RUNNER_TYPE: STANDALONE COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode COPILOT_GITHUB_TOKEN: ${{ github.token }} - COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }} + COPILOT_MODEL: gpt-5-mini GH_AW_LLM_PROVIDER: github GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }} GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} @@ -1375,7 +1375,7 @@ jobs: COPILOT_AGENT_RUNNER_TYPE: STANDALONE COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode COPILOT_GITHUB_TOKEN: ${{ github.token }} - COPILOT_MODEL: detection + COPILOT_MODEL: gpt-5-mini GH_AW_LLM_PROVIDER: github GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }} GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} @@ -1509,7 +1509,7 @@ jobs: GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }} GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }} GH_AW_ENGINE_ID: "copilot" - GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }} + GH_AW_ENGINE_MODEL: "gpt-5-mini" GH_AW_HEAD_SHA: ${{ github.event.pull_request.head.sha }} GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_SAFE_OUTPUTS_STAGED: "true" diff --git a/.github/workflows/pr-duplicate-check.md b/.github/workflows/pr-duplicate-check.md index 3e0106039..692be46e9 100644 --- a/.github/workflows/pr-duplicate-check.md +++ b/.github/workflows/pr-duplicate-check.md @@ -9,6 +9,7 @@ permissions: contents: read pull-requests: read copilot-requests: write +model: gpt-5-mini tools: github: toolsets: [repos, pull_requests] From 94720f51ccc4143c9ce46494d1debf396b052038 Mon Sep 17 00:00:00 2001 From: Ve Sharma <62218708+VeVarunSharma@users.noreply.github.com> Date: Thu, 20 Aug 2026 15:15:20 -0700 Subject: [PATCH 3/5] Expose cached Copilot CLI to sandbox Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8938494a-c76a-4a44-bfd2-a98edff33860 --- .github/workflows/pr-duplicate-check.lock.yml | 8 +++++++- .github/workflows/pr-duplicate-check.md | 6 ++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-duplicate-check.lock.yml b/.github/workflows/pr-duplicate-check.lock.yml index 99324ff2e..9795af984 100644 --- a/.github/workflows/pr-duplicate-check.lock.yml +++ b/.github/workflows/pr-duplicate-check.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"6c90ad769af998afbe8357ce41a46bcd548b608649a6bfb32e884abba4262627","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","agent_model":"gpt-5-mini","engine_versions":{"copilot":"1.0.78"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"26f11b3be587789781521fe56e1bf64b0e90a6dfd9b6749adf3d0928738eb33e","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","agent_model":"gpt-5-mini","engine_versions":{"copilot":"1.0.78"}} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"2709137ea6c5b0e19aa621454dc643ea8dc526b1","version":"v0.85.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.8","digest":"sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}],"has_pull_request":true} # This file was automatically generated by gh-aw (v0.85.4). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -490,6 +490,12 @@ jobs: env: GH_AW_SKILL_DIR: ".github/skills" run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh" + - name: Expose Copilot CLI to the sandbox + run: |- + COPILOT_BIN="$(command -v copilot)" + test -x "$COPILOT_BIN" + sudo ln -sfn "$COPILOT_BIN" /usr/local/bin/copilot + - name: Download container images run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7 ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627 ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8 ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196 ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520 - name: Generate Safe Outputs Config diff --git a/.github/workflows/pr-duplicate-check.md b/.github/workflows/pr-duplicate-check.md index 692be46e9..9b9a3787f 100644 --- a/.github/workflows/pr-duplicate-check.md +++ b/.github/workflows/pr-duplicate-check.md @@ -13,6 +13,12 @@ model: gpt-5-mini tools: github: toolsets: [repos, pull_requests] +pre-agent-steps: + - name: Expose Copilot CLI to the sandbox + run: | + COPILOT_BIN="$(command -v copilot)" + test -x "$COPILOT_BIN" + sudo ln -sfn "$COPILOT_BIN" /usr/local/bin/copilot post-steps: - name: Write PR context artifact if: always() From 3639ac0f342b9bd49eb5961011f69832bbe6019a Mon Sep 17 00:00:00 2001 From: Ve Sharma <62218708+VeVarunSharma@users.noreply.github.com> Date: Thu, 20 Aug 2026 15:21:25 -0700 Subject: [PATCH 4/5] Use authorized Copilot model Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8938494a-c76a-4a44-bfd2-a98edff33860 --- .github/workflows/pr-duplicate-check.lock.yml | 10 +++++----- .github/workflows/pr-duplicate-check.md | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/pr-duplicate-check.lock.yml b/.github/workflows/pr-duplicate-check.lock.yml index 9795af984..8bbf2883b 100644 --- a/.github/workflows/pr-duplicate-check.lock.yml +++ b/.github/workflows/pr-duplicate-check.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"26f11b3be587789781521fe56e1bf64b0e90a6dfd9b6749adf3d0928738eb33e","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","agent_model":"gpt-5-mini","engine_versions":{"copilot":"1.0.78"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a1eee45388b5d75766286a7b1e9819a46c26ff0669427fdf1ba8a7cbe338d708","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","agent_model":"claude-sonnet-5","engine_versions":{"copilot":"1.0.78"}} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"2709137ea6c5b0e19aa621454dc643ea8dc526b1","version":"v0.85.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.8","digest":"sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}],"has_pull_request":true} # This file was automatically generated by gh-aw (v0.85.4). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -119,7 +119,7 @@ jobs: env: GH_AW_INFO_ENGINE_ID: "copilot" GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI" - GH_AW_INFO_MODEL: "gpt-5-mini" + GH_AW_INFO_MODEL: "claude-sonnet-5" GH_AW_INFO_VERSION: "1.0.78" GH_AW_INFO_AGENT_VERSION: "1.0.78" GH_AW_INFO_CLI_VERSION: "v0.85.4" @@ -784,7 +784,7 @@ jobs: COPILOT_AGENT_RUNNER_TYPE: STANDALONE COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode COPILOT_GITHUB_TOKEN: ${{ github.token }} - COPILOT_MODEL: gpt-5-mini + COPILOT_MODEL: claude-sonnet-5 GH_AW_LLM_PROVIDER: github GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }} GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} @@ -1381,7 +1381,7 @@ jobs: COPILOT_AGENT_RUNNER_TYPE: STANDALONE COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode COPILOT_GITHUB_TOKEN: ${{ github.token }} - COPILOT_MODEL: gpt-5-mini + COPILOT_MODEL: claude-sonnet-5 GH_AW_LLM_PROVIDER: github GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }} GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} @@ -1515,7 +1515,7 @@ jobs: GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }} GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }} GH_AW_ENGINE_ID: "copilot" - GH_AW_ENGINE_MODEL: "gpt-5-mini" + GH_AW_ENGINE_MODEL: "claude-sonnet-5" GH_AW_HEAD_SHA: ${{ github.event.pull_request.head.sha }} GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_SAFE_OUTPUTS_STAGED: "true" diff --git a/.github/workflows/pr-duplicate-check.md b/.github/workflows/pr-duplicate-check.md index 9b9a3787f..02b4d41cd 100644 --- a/.github/workflows/pr-duplicate-check.md +++ b/.github/workflows/pr-duplicate-check.md @@ -9,7 +9,7 @@ permissions: contents: read pull-requests: read copilot-requests: write -model: gpt-5-mini +model: claude-sonnet-5 tools: github: toolsets: [repos, pull_requests] From 8c893312726801d16c595848f26fa334149b54a3 Mon Sep 17 00:00:00 2001 From: Ve Sharma <62218708+VeVarunSharma@users.noreply.github.com> Date: Thu, 20 Aug 2026 15:29:31 -0700 Subject: [PATCH 5/5] Skip duplicate check for fork PRs Fork pull_request tokens cannot receive copilot-requests: write, so running the agent always fails authentication. Keep the check enabled for same-repository PRs and preserve the Copilot CLI sandbox path repair. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8938494a-c76a-4a44-bfd2-a98edff33860 --- .github/workflows/pr-duplicate-check.lock.yml | 22 +++++++++---------- .github/workflows/pr-duplicate-check.md | 2 -- 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/.github/workflows/pr-duplicate-check.lock.yml b/.github/workflows/pr-duplicate-check.lock.yml index 8bbf2883b..ebe6863b1 100644 --- a/.github/workflows/pr-duplicate-check.lock.yml +++ b/.github/workflows/pr-duplicate-check.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a1eee45388b5d75766286a7b1e9819a46c26ff0669427fdf1ba8a7cbe338d708","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","agent_model":"claude-sonnet-5","engine_versions":{"copilot":"1.0.78"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"95378716a23d5112c6752185cbbfa66f8b3eb86d2df29eabd2c9e810b059c70d","body_hash":"3cd4ec993ffb688af3d1649a5d4f904f15618da1399e9a2ad903925da60c4468","compiler_version":"v0.85.4","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.78"}} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"2709137ea6c5b0e19aa621454dc643ea8dc526b1","version":"v0.85.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.8","digest":"sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}],"has_pull_request":true} # This file was automatically generated by gh-aw (v0.85.4). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -53,7 +53,6 @@ name: "PR Duplicate Check" on: pull_request: - # forks: "*" # Fork filtering applied via job conditions types: - opened - synchronize @@ -71,8 +70,9 @@ jobs: activation: needs: pre_activation if: > - needs.pre_activation.outputs.activated == 'true' && ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || - github.event.pull_request.stack == null || github.event.pull_request.stack.position == github.event.pull_request.stack.size) + needs.pre_activation.outputs.activated == 'true' && ((github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || github.event.pull_request.stack == null || + github.event.pull_request.stack.position == github.event.pull_request.stack.size)) runs-on: ubuntu-slim permissions: actions: read @@ -119,7 +119,7 @@ jobs: env: GH_AW_INFO_ENGINE_ID: "copilot" GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI" - GH_AW_INFO_MODEL: "claude-sonnet-5" + GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }} GH_AW_INFO_VERSION: "1.0.78" GH_AW_INFO_AGENT_VERSION: "1.0.78" GH_AW_INFO_CLI_VERSION: "v0.85.4" @@ -784,7 +784,7 @@ jobs: COPILOT_AGENT_RUNNER_TYPE: STANDALONE COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode COPILOT_GITHUB_TOKEN: ${{ github.token }} - COPILOT_MODEL: claude-sonnet-5 + COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }} GH_AW_LLM_PROVIDER: github GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }} GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} @@ -1381,7 +1381,7 @@ jobs: COPILOT_AGENT_RUNNER_TYPE: STANDALONE COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode COPILOT_GITHUB_TOKEN: ${{ github.token }} - COPILOT_MODEL: claude-sonnet-5 + COPILOT_MODEL: detection GH_AW_LLM_PROVIDER: github GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }} GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} @@ -1459,9 +1459,9 @@ jobs: pre_activation: if: > - (github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || - github.event.pull_request.stack == null || - github.event.pull_request.stack.position == github.event.pull_request.stack.size + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || github.event.pull_request.stack == null || + github.event.pull_request.stack.position == github.event.pull_request.stack.size) runs-on: ubuntu-slim env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} @@ -1515,7 +1515,7 @@ jobs: GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }} GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }} GH_AW_ENGINE_ID: "copilot" - GH_AW_ENGINE_MODEL: "claude-sonnet-5" + GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }} GH_AW_HEAD_SHA: ${{ github.event.pull_request.head.sha }} GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_SAFE_OUTPUTS_STAGED: "true" diff --git a/.github/workflows/pr-duplicate-check.md b/.github/workflows/pr-duplicate-check.md index 02b4d41cd..b2b58ac78 100644 --- a/.github/workflows/pr-duplicate-check.md +++ b/.github/workflows/pr-duplicate-check.md @@ -3,13 +3,11 @@ description: 'Checks PRs for potential duplicate agents, instructions, skills, a on: pull_request: types: [opened, synchronize, reopened] - forks: "*" checkout: false permissions: contents: read pull-requests: read copilot-requests: write -model: claude-sonnet-5 tools: github: toolsets: [repos, pull_requests]