* Pin github/gh-aw-actions to commit SHA and add pinning guard
The agentic workflows referenced github/gh-aw-actions/setup and
setup-cli by mutable tag (@v0.77.5) because .github/aw/actions-lock.json
still carried a stale pre-migration entry (github/gh-aw/actions/setup@v0.71.5)
with no entry for the action the compiled workflows actually use. With no
matching lock entry, gh aw compile fell back to emitting the bare tag.
Refresh the lock with SHA-pinned entries for github/gh-aw-actions/setup@v0.77.5
and setup-cli@v0.77.5 (commit 3ea13c02...), and regenerate the workflows via
gh aw compile so every uses: ref, decorative comment, and manifest sha is
pinned. This mirrors how dotnet/msbuild pins the same action and unblocks
enabling org-level "require actions pinned to a full-length commit SHA".
Also add enforce-action-pinning.yml, a self-contained PR/push check that
fails any workflow referencing an action by tag/branch. The agentic
workflows are schedule/issue-triggered and never run on PRs, so neither
/evaluate nor the runtime org policy gates them pre-merge; this check does.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Remove enforce-action-pinning guard workflow
Drop the CI guard in favor of relying on the org/repo 'Require actions
pinned to a full-length commit SHA' setting, per review feedback. The
lock-file fix and SHA pins remain the root-cause fix.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix Copilot PAT rotation for gh-aw v0.77.5 runtime
The PAT-rotation stop-gap wired the rotated token into engine.env via needs.pre_activation.outputs.copilot_pat_number. Because the compiled agent job depends only on 'activation' (not the built-in 'pre_activation'), that needs reference evaluated to an empty string in the agent job, so the case() fell through to the default COPILOT_GITHUB_TOKEN and rotation never reached the agent. gh-aw v0.77.5 surfaces this as a compiler warning.
Replace the pre_activation step-injection with a 'select_copilot_pat' custom job wired via on.needs. As a user-defined job referenced in engine.env, the compiler makes it a direct dependency of the agent job, so needs.select_copilot_pat.outputs.copilot_pat_number resolves correctly in both the activation and agent jobs. Same action, same secret pool, same case() expression. Recompiled all workflows with gh-aw v0.77.5.
* Add temporary test-pat-rotation workflow to validate rotation
Non-destructive pull_request-triggered workflow that selects a pool token and asserts, in the agent job, that needs.select_copilot_pat.outputs.copilot_pat_number is non-empty (the exact value that was silently empty with the old pre_activation wiring). To be removed after validation.
* Work around gh-aw v0.77.5 invalid-YAML rendering of top-level if
gh-aw v0.77.5 emits the top-level frontmatter `if:` on the built-in
pre_activation job WITHOUT a ${{ }} wrapper. When the condition starts with
`!` (the fork guards), the emitted `if: !(...)` is invalid YAML (a leading `!`
starts a YAML tag), which GitHub rejects as a workflow-file startup failure.
v0.68.3 wrapped it (valid); v0.77.5 does not. Confirmed independent of the
PAT-rotation change via a minimal probe.
Wrap the fork-guard conditions in parentheses so the emitted scalar starts
with `(` instead of `!` (semantically identical). Affects close-stale-prs,
devops-health-check, devops-health-groom, markdown-linter, pr-malicious-scan.
* Update select-copilot-pat README for the custom-job + on.needs pattern
* Remove temporary test-pat-rotation workflow (rotation validated)
Adds a new agentic workflow (.github/workflows/markdown-linter.md) that
runs Super Linter on weekdays at 2 PM UTC and on manual dispatch. The
agent analyzes linter output and creates GitHub issues with categorized
findings, severity breakdown, and fix recommendations.
Adapted from https://github.com/githubnext/agentics/blob/main/workflows/markdown-linter.md
with repo-specific conventions: PAT pool rotation, fork protection,
pinned action SHAs, scoped bash tools, and safe-outputs.
* Copy PATs rotation from dotnet/core
* Recompile agentic workflows with gh-aw v0.67.1
Remove unsupported 'failure' safe-output (dropped in gh-aw v0.67.1).
Regenerate lock files with the new compiler version.
No functional changes.
* Add Copilot PAT pool rotation to agentic workflows
Use the select-copilot-pat action to randomly select from a pool of
COPILOT_GITHUB_TOKEN / COPILOT_GITHUB_TOKEN_2..8 secrets, distributing
Copilot API load across multiple PATs.
This is a stop-gap until organization-level billing is available for
Agentic Workflows. See .github/actions/select-copilot-pat/README.md.
github-actions[bot]