fix: use gh auth login --with-token to persist auth into gh store for copilot CLI

Co-authored-by: craxal <3473026+craxal@users.noreply.github.com>

Author: Copilot

.github/workflows/stale-issue-cleanup.yml

@@ -2,28 +2,27 @@ name: Stale Issue Cleanup
 
 # # Authentication
 #
-# This workflow uses a single secret, `STALE_ISSUES_TOKEN`, for all operations, set as
-# both `COPILOT_GITHUB_TOKEN` and `GH_TOKEN`.
+# This workflow uses a single secret, `STALE_ISSUES_TOKEN`, set as `GH_TOKEN`.
 #
 # `STALE_ISSUES_TOKEN` is a Classic PAT with the following scopes:
-#   - `copilot`    — required by the Copilot CLI for model inference.
-#                    Set as `COPILOT_GITHUB_TOKEN` (the first env var the CLI checks).
-#                    The CLI does not reliably honour `GH_TOKEN` for Copilot model auth,
-#                    so this must be set explicitly.
-#   - `repo`       — lets the gh CLI comment on and close issues (via `GH_TOKEN`)
+#   - `copilot`    — required by the Copilot CLI for model inference
+#   - `repo`       — lets the gh CLI comment on and close issues
 #   - `read:org`   — required to list members of the microsoft/azure-storage-explorer team
 #   - `project`    — required to update the Resolution field on the org-level project
 #
-# Note: `github.token` (the built-in Actions token) cannot be used for Copilot auth —
-# it is a machine installation token, rejected by the Copilot CLI regardless of any
-# `permissions: models: read` setting. A user PAT with the `copilot` scope is required.
+# The `copilot` CLI reads auth from gh's persistent auth store, not from env vars directly.
+# `echo "$GH_TOKEN" | gh auth login --with-token` writes the token into that store so
+# `copilot` can find it. `GH_TOKEN` is still read by the `gh` CLI for subsequent API calls.
+#
+# Note: `github.token` cannot be substituted here — it is a machine installation token
+# that the Copilot CLI rejects. A user PAT with the `copilot` scope is required.
 #
 # `read:org` and `project` are org-level scopes that cannot be granted to `github.token`
 # via the `permissions` block, which is why an external PAT is always required here.
 #
-# For production, consider replacing this PAT with a GitHub App token for the gh CLI calls,
-# using `actions/create-github-app-token`. A GitHub App cannot hold a Copilot seat, so
-# `COPILOT_GITHUB_TOKEN` will always require a user PAT with the `copilot` scope.
+# For production, consider using a GitHub App token for the `gh` CLI calls and keeping a
+# dedicated user PAT (with `copilot` scope) for Copilot inference, since a GitHub App
+# cannot hold a Copilot seat.
 #
 # # Install Step Note
 #
@@ -50,21 +49,11 @@ jobs:
           curl -fsSL https://gh.io/copilot-install | bash
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
-      - name: Diagnostics
-        env:
-          GH_TOKEN: ${{ secrets.STALE_ISSUES_TOKEN }}
-        run: |
-          echo "Token prefix: ${GH_TOKEN:0:12}"
-          echo "Token length: ${#GH_TOKEN}"
-          copilot --version
-          echo '--- gh auth status ---'
-          gh auth status
-
       - name: Run stale issue cleanup agent
         env:
-          COPILOT_GITHUB_TOKEN: ${{ secrets.STALE_ISSUES_TOKEN }}
           GH_TOKEN: ${{ secrets.STALE_ISSUES_TOKEN }}
         run: |
+          echo "$GH_TOKEN" | gh auth login --with-token
           copilot \
             --agent issue-manager \
             --prompt "Find and close stale bug issues." \