[gh-aw] Migrate workflows to Copilot PAT Pool - #11757
Merged
Merged
Conversation
Add the shared PAT pool import and README, wire the GH-AW workflow sources to use the copilot-pat-pool environment and COPILOT_PAT_0..9 selection, regenerate the lock files, and add the PAT pool validation workflow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
vitek-karas
temporarily deployed
to
copilot-pat-pool
June 26, 2026 13:58 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
vitek-karas
temporarily deployed
to
copilot-pat-pool
June 26, 2026 13:59 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
vitek-karas
had a problem deploying
to
copilot-pat-pool
June 26, 2026 13:59 — with
GitHub Actions
Failure
GitHub Actions
Failure
vitek-karas
temporarily deployed
to
copilot-pat-pool
June 26, 2026 14:04 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
vitek-karas
temporarily deployed
to
copilot-pat-pool
June 29, 2026 12:36 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
vitek-karas
temporarily deployed
to
copilot-pat-pool
June 29, 2026 12:37 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
vitek-karas
had a problem deploying
to
copilot-pat-pool
June 29, 2026 12:38 — with
GitHub Actions
Failure
GitHub Actions
Failure
vitek-karas
temporarily deployed
to
copilot-pat-pool
June 29, 2026 12:42 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
jonathanpeppers
marked this pull request as ready for review
June 30, 2026 15:14
jonathanpeppers
requested review from
jonathanpeppers and
simonrozsival
as code owners
June 30, 2026 15:14
jonathanpeppers
approved these changes
Jun 30, 2026
jonathanpeppers
left a comment
jonathanpeppers
left a comment
Member
There was a problem hiding this comment.
The environment is setup, but I think we have to merge to test.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the repo’s agentic workflows to use a shared “Copilot PAT Pool” (10-slot secret pool) to reduce contention/rate-limiting from a single shared PAT, and adds a scheduled validation workflow to proactively detect stale/empty PAT pools.
Changes:
- Added a reusable
shared/pat_pool.mdimport (plus onboarding README) to select a populated PAT slot and expose it as a job output. - Updated
android-reviewerandnightly-fix-finderagentic workflows to run in thecopilot-pat-poolenvironment and map the selected slot toCOPILOT_GITHUB_TOKENviacase(...). - Added
validate-pat-pool.ymland regenerated compiled.lock.ymlworkflows; updated the agentic actions lock.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/validate-pat-pool.yml |
New scheduled/manual workflow to validate COPILOT_PAT_0..9 via a lightweight Copilot CLI call and summarize results. |
.github/workflows/shared/pat_pool.README.md |
New onboarding + usage documentation for the shared PAT pool import pattern. |
.github/workflows/shared/pat_pool.md |
New reusable import that selects a random non-empty PAT slot (0–9) and outputs the slot number. |
.github/workflows/nightly-fix-finder.md |
Migrates workflow to import pat_pool, run in copilot-pat-pool, and set COPILOT_GITHUB_TOKEN from COPILOT_PAT_0..9. |
.github/workflows/nightly-fix-finder.lock.yml |
Regenerated compiled workflow reflecting PAT-pool secrets, updated gh-aw actions/tooling versions, and other compiler output updates. |
.github/workflows/android-reviewer.md |
Migrates workflow to import pat_pool, run in copilot-pat-pool, and set COPILOT_GITHUB_TOKEN from COPILOT_PAT_0..9. |
.github/workflows/android-reviewer.lock.yml |
Regenerated compiled workflow reflecting PAT-pool secrets and updated gh-aw actions/tooling versions. |
.github/aw/actions-lock.json |
Updates pinned gh-aw setup action entry to v0.80.9 and removes older setup-cli entry. |
Comment on lines
+25
to
+28
| - name: Setup gh-aw scripts | ||
| uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5 | ||
| with: | ||
| destination: ${{ runner.temp }}/gh-aw/actions |
simonrozsival
approved these changes
Jun 30, 2026
simonrozsival
pushed a commit
that referenced
this pull request
Jul 1, 2026
…11823) Follow-up to #11757. The `validate-pat-pool.yml` workflow added in #11757 was still pinned to `github/gh-aw-actions/setup@v0.71.5`, while the compiled agentic workflows and `.github/aw/actions-lock.json` were on v0.80.9. That version drift defeats the purpose of validation, since PATs were being exercised with a different `install_copilot_cli.sh` than the workflows that actually consume them (raised in [this review comment](#11757 (comment)...)). This PR aligns everything to the gh-aw release currently installed in the repo's toolchain (v0.81.6): - Bumps `validate-pat-pool.yml` to use `setup@v0.81.6`. - Re-runs `gh aw compile`, which regenerates `android-reviewer.lock.yml`, `nightly-fix-finder.lock.yml`, `agentics-maintenance.yml`, and the `actions-lock.json` to v0.81.6 (and re-adds the `setup-cli@v0.81.6` lock entry). No behavior change beyond the upstream gh-aw bump itself; the recompile is the standard mechanical output. The other review comments on #11757 (Copilot CLI version, fallback wording, `permissions: {}`) are intentionally left for a separate change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
android-reviewerandnightly-fix-findertocopilot-pat-pooland selectCOPILOT_PAT_0..9viaengine.env.COPILOT_GITHUB_TOKENvalidate-pat-pool.ymland regenerate the compiled lock filesValidation
gh aw compile android-reviewer nightly-fix-finder --strict --schedule-seed dotnet/androidSecurity review note
COPILOT_PAT_0,COPILOT_PAT_1,COPILOT_PAT_2,COPILOT_PAT_3,COPILOT_PAT_4,COPILOT_PAT_5,COPILOT_PAT_6,COPILOT_PAT_7,COPILOT_PAT_8,COPILOT_PAT_9ANDROID_TEAM_PATgithub/gh-aw-actions/setup@v0.80.9as part of thegh aw compileoutput, alongside the PAT-pool secret additionspat_pooljob to choose a populated slot and by thecase(...)expression that maps the selected slot intoCOPILOT_GITHUB_TOKEN; the workflow outputs continue to use the normal Actions tokens and do not expose PAT valuesFollow-up
copilot-pat-poolenvironment withCOPILOT_PAT_0..9;nightly-fix-finderalso needsANDROID_TEAM_PATavailable in that environment