Enable cross-repo Copilot auth for d-morrison/macros and add macros submodule

[Copilot]

This PR wires in the macros submodule and updates Copilot setup so agent sessions can authenticate with MACROS_REPO_PAT for d-morrison/macros operations. It also adds an explicit setup-time write-permission check to fail fast when token scope is insufficient.

• Submodule integration

  • Added .gitmodules entry for macros
  • Added macros/ gitlink to track https://github.com/d-morrison/macros

• Copilot setup: external repo auth

  • Added optional auth step in .github/workflows/copilot-setup-steps.yml gated on MACROS_REPO_PAT
  • Configures:
    • gh authentication
    • git credential helper via gh auth setup-git
    • GH_TOKEN export for downstream gh flows (including PR creation)

• Permission guardrail

  • Added explicit write-access verification:
    • gh api repos/d-morrison/macros --jq '.permissions.push'
  • Fails setup early if token cannot push to d-morrison/macros

• Docs updates

  • Updated README.md and README.Rmd with:
    • new submodule structure
    • MACROS_REPO_PAT secret requirement
    • behavior of the setup-time write check

- name: Verify macros repository write access
  env:
    MACROS_REPO_PAT: ${{ secrets.MACROS_REPO_PAT }}
  run: |
    if [ -z "${MACROS_REPO_PAT:-}" ]; then
      echo "MACROS_REPO_PAT is not set; skipping macros write check."
      exit 0
    fi
    if [ "$(gh api repos/d-morrison/macros --jq '.permissions.push')" != "true" ]; then
      echo "MACROS_REPO_PAT does not have write permission on d-morrison/macros."
      exit 1
    fi

[d-morrison]

no changes relative to main at present

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-04-21 17:34 UTC