Add environment: gh-aw-agents to remaining workflows - #35974
Merged
Conversation
Follow-up to #35951 — extend environment gating to the 3 remaining gh-aw workflows (agentic-labeler, copilot-evaluate-tests, copilot-review-tests) and the review-trigger.yml GHA workflow. After #35951 merged, repo-level secrets were deleted in favor of environment-scoped secrets on gh-aw-agents. These 4 workflows need the environment reference to access COPILOT_GITHUB_TOKEN and AZDO_TRIGGER_* secrets. Recompiled all 3 gh-aw locks with gh-aw v0.79.8. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 35974Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 35974" |
This comment has been minimized.
This comment has been minimized.
github-actions
Bot
added
the
area-infrastructure
Contributor
Tests Failure Analysis
Test Failure Review: Likely unrelated - click to expandOverall verdict: Likely unrelated The single
Recommended actionNo action needed. The transient activation failure resolved on re-run, the PR is merged, and there are no test failures to investigate. Evidence details
|
This was referenced Jun 18, 2026
PureWeen
added a commit
that referenced
this pull request
Jun 18, 2026
The OIDC federated credential on the Testing-MI-gh2zdo managed identity doesn't have a subject for the gh-aw-agents environment, causing AADSTS700213 on every /review command. Revert to repo-level AZDO_TRIGGER_* secrets until the federated credential is updated. Fixes the /review trigger broken by #35974. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PureWeen
added a commit
that referenced
this pull request
Jun 18, 2026
<!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ## Summary Removes `environment: gh-aw-agents` from the `trigger-review` job in `review-trigger.yml`. ## Why PR #35974 added `environment: gh-aw-agents` to `review-trigger.yml`, which changed the GitHub OIDC token subject from `repo:dotnet/maui:ref:refs/heads/main` to `repo:dotnet/maui:environment:gh-aw-agents`. The managed identity (`Testing-MI-gh2zdo`) behind `AZDO_TRIGGER_CLIENT_ID` has no federated credential for that environment subject, so every `/review` command fails with: ``` AADSTS700213: No matching federated identity record found for presented assertion subject 'repo:dotnet/maui:environment:gh-aw-agents' ``` The `AZDO_TRIGGER_*` secrets have been re-added at the repo level. Once the federated credential is updated (requires Azure access to the managed identity), the environment gating can be re-added. ## What changed - Removed `environment: gh-aw-agents` from the `trigger-review` job (1 line) - All gh-aw workflows remain gated — only `review-trigger.yml` (regular GHA) is affected Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!
Summary
Follow-up to #35951 — extends
environment: gh-aw-agentsgating to the remaining 4 workflows that were not included in the initial PR:agentic-labeler.mdenvironment: gh-aw-agentscopilot-evaluate-tests.mdenvironment: gh-aw-agentscopilot-review-tests.mdenvironment: gh-aw-agentsreview-trigger.ymlenvironment: gh-aw-agentstotrigger-reviewjobWhy
After #35951 merged, repo-level secrets (
COPILOT_GITHUB_TOKEN,AZDO_TRIGGER_TENANT_ID,AZDO_TRIGGER_CLIENT_ID) were deleted in favor of environment-scoped secrets on thegh-aw-agentsenvironment. These 4 workflows need theenvironment:reference to access those secrets.Details
gh aw v0.79.8environment: gh-aw-agentsverified on agent + safe-outputs + threat-detection jobs in all lock filesreview-trigger.ymlis a regular GHA workflow — environment added at job level, no compile neededpull_request_target, copilot-evaluate-testsslash_command+bots:) are unchanged and intentional