Document PR triage workflow failures due to missing COPILOT_CLI_TOKEN

[Copilot]

The PR triage workflow has failed on all recent runs due to a missing COPILOT_CLI_TOKEN repository secret. This investigation documents the root cause and provides remediation options.

Analysis

Examined 9 consecutive workflow failures using GitHub API:

• All runs failed at "Validate COPILOT_CLI_TOKEN secret" step
• Workflow requires this secret for GitHub Copilot CLI (line 719-726 of pr-triage.lock.yml)
• Without it, AI-powered PR analysis and automatic labeling is non-functional

Root Cause

- name: Validate COPILOT_CLI_TOKEN secret
  run: |
    if [ -z "$COPILOT_CLI_TOKEN" ]; then
      echo "Error: COPILOT_CLI_TOKEN secret is not set"
      exit 1
    fi
  env:
    COPILOT_CLI_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}

The workflow exits with code 1 when the secret is unset, causing subsequent jobs (detection, add_labels, missing_tool) to be skipped.

Remediation Options

Option 1: Configure COPILOT_CLI_TOKEN in repository secrets (enables full functionality)

Option 2: Add workflow-level conditional to skip when secret unavailable:

if: secrets.COPILOT_CLI_TOKEN != ''

Option 3: Convert validation step to set output flag instead of failing, allow graceful degradation

Impact

• PR triage completely non-functional since Oct 22, 2025
• Manual PR labeling required
• No AI-assisted analysis of incoming pull requests

---

Comprehensive diagnostic report created at /tmp/pr-triage-workflow-diagnosis.md with detailed analysis and implementation guidance.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/microsoft/wassette/actions/jobs/53711951364/logs
  • Triggering command: curl -s -H Accept: application/vnd.github+json -H Authorization: Bearer REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Examine the last few runs of PR triage workflow using the gh CLI and figure out why it didn't work

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.