From f62faa6118db80079a75c63910e09c4014b78e47 Mon Sep 17 00:00:00 2001 From: Evan Mattson Date: Thu, 23 Jul 2026 08:31:51 +0900 Subject: [PATCH 1/2] Mask workflow authentication configuration Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479 --- .github/workflows/devflow-pr-review.yml | 14 ++++++------ .github/workflows/issue-triage.yml | 14 ++++++------ .github/workflows/label-issues.yml | 14 ++++++------ .github/workflows/label-pr.yml | 14 ++++++------ .github/workflows/limit-community-prs.yml | 28 +++++++++++------------ .github/workflows/stale-issue-pr-ping.yml | 14 ++++++------ 6 files changed, 49 insertions(+), 49 deletions(-) diff --git a/.github/workflows/devflow-pr-review.yml b/.github/workflows/devflow-pr-review.yml index f3d59fb861..f3b64cb01c 100644 --- a/.github/workflows/devflow-pr-review.yml +++ b/.github/workflows/devflow-pr-review.yml @@ -81,13 +81,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml index 60184def0e..4f358ff785 100644 --- a/.github/workflows/issue-triage.yml +++ b/.github/workflows/issue-triage.yml @@ -80,13 +80,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} diff --git a/.github/workflows/label-issues.yml b/.github/workflows/label-issues.yml index f4f6f23067..8c8d4e793f 100644 --- a/.github/workflows/label-issues.yml +++ b/.github/workflows/label-issues.yml @@ -30,13 +30,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml index eec470bd88..51a275a105 100644 --- a/.github/workflows/label-pr.yml +++ b/.github/workflows/label-pr.yml @@ -36,13 +36,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} diff --git a/.github/workflows/limit-community-prs.yml b/.github/workflows/limit-community-prs.yml index 626e86459a..6d27af202e 100644 --- a/.github/workflows/limit-community-prs.yml +++ b/.github/workflows/limit-community-prs.yml @@ -41,13 +41,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} @@ -96,13 +96,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} diff --git a/.github/workflows/stale-issue-pr-ping.yml b/.github/workflows/stale-issue-pr-ping.yml index 082ae1446f..373d1978a7 100644 --- a/.github/workflows/stale-issue-pr-ping.yml +++ b/.github/workflows/stale-issue-pr-ping.yml @@ -40,13 +40,13 @@ jobs: uses: ./.github/actions/github-app-token with: mode: ${{ vars.GH_APP_AUTH_MODE }} - azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }} - azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }} - azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }} - key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }} - key-name: ${{ vars.GH_APP_KEY_NAME }} - github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }} - github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }} + azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} + azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} + azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} + key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} + key-name: ${{ secrets.GH_APP_KEY_NAME }} + github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} + github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} repository: ${{ github.repository }} fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} From 64872c4f326db0f514f26335996c48f804010097 Mon Sep 17 00:00:00 2001 From: Evan Mattson Date: Thu, 23 Jul 2026 08:43:02 +0900 Subject: [PATCH 2/2] Use run-scoped Copilot authentication Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479 --- .github/workflows/devflow-pr-review.yml | 7 ++++++- .github/workflows/issue-triage.yml | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/devflow-pr-review.yml b/.github/workflows/devflow-pr-review.yml index f3b64cb01c..47d3831999 100644 --- a/.github/workflows/devflow-pr-review.yml +++ b/.github/workflows/devflow-pr-review.yml @@ -119,6 +119,11 @@ jobs: runs-on: ubuntu-latest needs: team_check if: ${{ needs.team_check.outputs.is_team_member == 'true' }} + permissions: + contents: read + copilot-requests: write + issues: write + pull-requests: write timeout-minutes: 60 # Advisory check: failures here should not block the PR. The reviewer # posts comments as a best-effort signal; if the pipeline breaks, the @@ -166,7 +171,7 @@ jobs: working-directory: ${{ env.DEVFLOW_PATH }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_COPILOT_TOKEN: ${{ secrets.GH_COPILOT_TOKEN }} + GH_COPILOT_TOKEN: ${{ github.token }} SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }} AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }} PR_URL: ${{ needs.team_check.outputs.pr_url }} diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml index 4f358ff785..fa49c5759c 100644 --- a/.github/workflows/issue-triage.yml +++ b/.github/workflows/issue-triage.yml @@ -124,6 +124,11 @@ jobs: || needs.team_check.outputs.is_team_member == 'false' }} environment: integration + permissions: + contents: read + copilot-requests: write + id-token: write + issues: write timeout-minutes: 60 steps: @@ -198,7 +203,7 @@ jobs: working-directory: ${{ env.DEVFLOW_PATH }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_COPILOT_TOKEN: ${{ secrets.GH_COPILOT_TOKEN }} + GH_COPILOT_TOKEN: ${{ github.token }} # Not seen by the agent prompt; used only to push a paper-trail # branch back to maf-dashboard at run end. DEVFLOW_TOKEN: ${{ secrets.DEVFLOW_TOKEN }}