- Updates the PAT pool shared workflow to latest version
- This requires an input of the agentic environment
- The updated workflow import also addresses the previous issue where
consuming workflows had to declare a 'needs' on the pat_pool job
- The issue-triage job has a new flavor of that 'needs' issue though
since it uses 'roles: all', which eliminates the pre_activation job;
so another workaround is applied there (an skip-if-no-match query).
- Upgrade actions-lock.json to gh-aw v0.79.8
- Migrate PAT secrets from COPILOT_GITHUB_TOKEN[_#] to standard COPILOT_PAT_0..9 naming
- Add environment: copilot-pat-pool to all agentic workflows and pat_pool job
- Replace default fall-back PAT with 'NO COPILOT PAT AVAILABLE' sentinel
- Update pat_pool.md to standard 10-slot version without needs: [pre_activation]
- Update pat_pool.README.md to reflect new naming, environment, and 10-slot pool
- Update agentic-workflows.agent.md: convert URLs to local paths, add repo-specific
requirements for PAT pool, schedule seed, and frontmatter ordering
- Update validate-pat-pool.yml to standard 10-slot version with copilot-pat-pool env
- Recompile all workflows with --schedule-seed dotnet/skills
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adopt the shared workflow import pattern from dotnet/runtime PR #127946,
replacing the per-workflow select-copilot-pat action + custom job (shipped in
#736) with a reusable shared/pat_pool.md import.
What changed:
- Add .github/workflows/shared/pat_pool.md: an import that defines a `pat_pool`
job (inline bash, no separate action) exposing a `pat_number` output, plus an
import-schema mapping COPILOT_PAT_0..7 to this repo's pool secrets
(COPILOT_GITHUB_TOKEN, COPILOT_GITHUB_TOKEN_2..8).
- Add .github/workflows/shared/pat_pool.README.md documenting the pattern.
- Convert all 8 agentic workflows to `imports: - shared/pat_pool.md` +
`engine.env` `case(needs.pat_pool.outputs.pat_number ...)`.
- Delete the now-unused .github/actions/select-copilot-pat action.
- Add .github/workflows/validate-pat-pool.yml: a daily standalone workflow that
validates each pool PAT with a Copilot CLI request and summarizes pool health.
Wiring note (adaptation from runtime): consuming workflows declare
`on.needs: [pat_pool]` instead of runtime's `needs: [pre_activation]` +
`on.permissions: {}`. This wires pat_pool ahead of the pre_activation and
activation jobs so the selected PAT is validated by the activation job and used
by the agent, and it works for `roles: all` workflows (issue-triage), which do
not produce a pre_activation job for the runtime workaround to attach to.
Compiled with gh-aw v0.77.5. Verified end-to-end with a temporary
test-pat-rotation workflow (since removed): a run selected token #2 of the
3-token pool and the agent job observed pat_number='2', confirming the rotated
PAT reaches the agent.
Jeff Handley