Use PAT pool for agentic workflows

.github/aw/actions-lock.json

@@ -35,20 +35,15 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup@v0.79.8": {
+    "github/gh-aw-actions/setup-cli@v0.80.9": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.80.9",
+      "sha": "8c7d04ebf1ece56cd381446125da3e0f6896294a"
+    },
+    "github/gh-aw-actions/setup@v0.80.9": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.79.8",
-      "sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
-    },
-    "github/gh-aw/actions/setup@v0.43.19": {
-      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.43.19",
-      "sha": "7fe5515d71ccec397a3a81ff32f79217e9bc7ba6"
-    },
-    "github/gh-aw/actions/setup@v0.46.0": {
-      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.46.0",
-      "sha": "f88ec26c65cc20ebb8ceabe809c9153385945bfe"
+      "version": "v0.80.9",
+      "sha": "8c7d04ebf1ece56cd381446125da3e0f6896294a"
     }
   }
 }

.github/workflows/agentic-labeler.md

@@ -6,7 +6,19 @@ description: |
   type, severity, partner, regression, or any other label families — those
   remain the responsibility of human triagers.
 
-environment: gh-aw-agents
+# ###############################################################
+# Select a PAT from the pool and override COPILOT_GITHUB_TOKEN.
+# Run agentic jobs in an isolated `copilot-pat-pool` environment.
+#
+# When org-level billing is available, this will be removed.
+# See `shared/pat_pool.README.md` for more information.
+# ###############################################################
+imports:
+  - uses: shared/pat_pool.md
+    with:
+      environment: copilot-pat-pool
+
+environment: copilot-pat-pool
 
 on:
   issues:
@@ -19,7 +31,11 @@ on:
         description: 'Issue or PR number to label'
         required: true
         type: number
+  steps:
+    - name: Prepare PAT pool activation
+      run: echo "PAT pool pre-activation"
   reaction: eyes
+  permissions: {}
   # Allow this workflow to run for any actor (including first-time community
   # contributors). It is labeling-only — the agent runs with read-only tokens,
   # and label writes happen through the sandboxed safe-output job capped at
@@ -42,6 +58,24 @@ permissions:
   issues: read
   pull-requests: read
 
+engine:
+  id: copilot
+  env:
+    COPILOT_GITHUB_TOKEN: |
+      ${{ case(
+        needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0,
+        needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1,
+        needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2,
+        needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3,
+        needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4,
+        needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5,
+        needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6,
+        needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7,
+        needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8,
+        needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9,
+        'NO COPILOT PAT AVAILABLE')
+      }}
+
 network: defaults
 
 safe-outputs: