Skip to content

Isolate agentic workflow authentication with a Copilot token pool #7652

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kotlarmilos wants to merge 3 commits into
base: main
Choose a base branch
from
+5,160 −1,227
Open

Isolate agentic workflow authentication with a Copilot token pool #7652

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7ff44f7
Isolate agentic workflow authentication with a Copilot token pool
kotlarmilos Jul 2, 2026
2410a42
Fail fast when the Copilot PAT pool is empty
kotlarmilos Jul 3, 2026
4ad0bcb
Trigger report-green pipeline
kotlarmilos Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 3 additions & 13 deletions .github/aw/actions-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,14 @@
{
"entries": {
"actions/github-script@v8": {
"repo": "actions/github-script",
"version": "v8",
"sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
},
"actions/github-script@v9.0.0": {
"repo": "actions/github-script",
"version": "v9.0.0",
"sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
},
"github/gh-aw-actions/setup@v0.71.5": {
"github/gh-aw-actions/setup@v0.80.9": {
"repo": "github/gh-aw-actions/setup",
"version": "v0.71.5",
"sha": "b8068426813005612b960b5ab0b8bd2c27142323"
},
"github/gh-aw/actions/setup@v0.58.0": {
"repo": "github/gh-aw/actions/setup",
"version": "v0.58.0",
"sha": "cb7966564184443e601bd6135d5fbb534300070e"
"version": "v0.80.9",
"sha": "8c7d04ebf1ece56cd381446125da3e0f6896294a"
}
}
}
614 changes: 614 additions & 0 deletions .github/workflows/agentics-maintenance.yml
View file
Open in desktop

Large diffs are not rendered by default.

870 changes: 652 additions & 218 deletions .github/workflows/ci-scan-feedback.agent.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

33 changes: 33 additions & 0 deletions .github/workflows/ci-scan-feedback.agent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,39 @@ on:
schedule: daily
workflow_dispatch:
roles: [admin, maintain, write]
permissions: {}

# ###############################################################
# Select a PAT from the pool and override COPILOT_GITHUB_TOKEN.
# Run agentic jobs in an isolated `copilot-pat-pool` environment.
#
# When org-level billing is available, this will be removed.
# See `shared/pat_pool.README.md` for more information.
# ###############################################################
imports:
- uses: shared/pat_pool.md
with:
environment: copilot-pat-pool

environment: copilot-pat-pool

engine:
id: copilot
env:
COPILOT_GITHUB_TOKEN: |
${{ case(
needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0,
needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1,
needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2,
needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3,
needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4,
needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5,
needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6,
needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7,
needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8,
needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9,
'NO COPILOT PAT AVAILABLE')
Comment thread
kotlarmilos marked this conversation as resolved.
}}

if: github.repository == 'dotnet/machinelearning'

Expand Down
832 changes: 631 additions & 201 deletions .github/workflows/ci-scan.agent.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

33 changes: 33 additions & 0 deletions .github/workflows/ci-scan.agent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,39 @@ on:
schedule: every 6h
workflow_dispatch:
roles: [admin, maintain, write]
permissions: {}

# ###############################################################
# Select a PAT from the pool and override COPILOT_GITHUB_TOKEN.
# Run agentic jobs in an isolated `copilot-pat-pool` environment.
#
# When org-level billing is available, this will be removed.
# See `shared/pat_pool.README.md` for more information.
# ###############################################################
imports:
- uses: shared/pat_pool.md
with:
environment: copilot-pat-pool

environment: copilot-pat-pool

engine:
id: copilot
env:
COPILOT_GITHUB_TOKEN: |
${{ case(
needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0,
needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1,
needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2,
needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3,
needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4,
needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5,
needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6,
needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7,
needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8,
needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9,
'NO COPILOT PAT AVAILABLE')
Comment thread
kotlarmilos marked this conversation as resolved.
}}

if: github.repository == 'dotnet/machinelearning'

Expand Down
785 changes: 587 additions & 198 deletions .github/workflows/issue-triage.agent.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

33 changes: 33 additions & 0 deletions .github/workflows/issue-triage.agent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,39 @@
on:
issues:
types: [opened]

# ###############################################################
# Select a PAT from the pool and override COPILOT_GITHUB_TOKEN.
# Run agentic jobs in an isolated `copilot-pat-pool` environment.
#
# When org-level billing is available, this will be removed.
# See `shared/pat_pool.README.md` for more information.
# ###############################################################
imports:
- uses: shared/pat_pool.md
with:
environment: copilot-pat-pool

environment: copilot-pat-pool

engine:
id: copilot
env:
COPILOT_GITHUB_TOKEN: |
${{ case(
needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0,
needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1,
needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2,
needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3,
needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4,
needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5,
needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6,
needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7,
needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8,
needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9,
'NO COPILOT PAT AVAILABLE')
Comment thread
kotlarmilos marked this conversation as resolved.
}}

permissions:
contents: read
issues: read
Expand Down
Loading