Skip to content

Commit 071d314

Browse files
jeffhandleyCopilot
andauthored
Upgrade gh-aw to v0.79.8 and isolate PAT pool into copilot-pat-pool environment (dotnet#10450)
- Add copilot-pat-pool environment to pat_pool.md shared workflow - Add copilot-pat-pool environment to validate-pat-pool.yml - Add copilot-pat-pool environment to release-notes.md workflow - Remove default fall-back PAT (secrets.COPILOT_GITHUB_TOKEN) from case statement, use 'NO COPILOT PAT AVAILABLE' sentinel - Update comment block to describe environment isolation - Upgrade actions-lock.json to gh-aw-actions/setup v0.79.8 and actions/checkout v6.0.3 - Recompile release-notes.lock.yml with gh-aw v0.79.8 (--schedule-seed dotnet/core) - Update agentic-workflows.agent.md: restore/retain repo-specific instructions for copilot-pat-pool usage Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 6b98876 commit 071d314

6 files changed

Lines changed: 423 additions & 163 deletions

File tree

.github/agents/agentic-workflows.agent.md

Lines changed: 52 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,10 @@ This is a **dispatcher agent** that routes your request to the appropriate speci
1919
- **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
2020
- **Fixing Dependabot PRs**: Routes to `dependabot` prompt — use this when Dependabot opens PRs that modify generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`). Never merge those PRs directly; instead update the source `.md` files and rerun `gh aw compile --dependabot` to bundle all fixes
2121
- **Analyzing test coverage**: Routes to `test-coverage` prompt — consult this whenever the workflow reads, analyzes, or reports on test coverage data from PRs or CI runs
22+
- **Rendering ASCII charts in markdown**: Routes to `asciicharts` guide — consult this whenever the workflow needs compact charts that render reliably in GitHub issues, comments, or discussions
2223
- **CLI commands and triggering workflows**: Routes to `cli-commands` guide — consult this whenever the user asks how to run, compile, debug, or manage workflows from the command line, or when they need the MCP tool equivalent of a `gh aw` command
24+
- **Reducing token consumption / cost optimization**: Routes to `token-optimization` guide — consult this whenever the user asks how to reduce token usage, lower costs, speed up workflows, or measure the impact of prompt changes with experiments
25+
- **Choosing workflow architectures and design patterns**: Routes to `patterns` guide — consult this whenever the user asks for strategy, architecture, operating models, or pattern selection for agentic workflows
2326

2427
Workflows may optionally include:
2528

@@ -31,7 +34,7 @@ Workflows may optionally include:
3134
- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
3235
- Workflow lock files: `.github/workflows/*.lock.yml`
3336
- Shared components: `.github/workflows/shared/*.md`
34-
- Configuration: [github-agentic-workflows.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/github-agentic-workflows.md)
37+
- Configuration: `.github/aw/github-agentic-workflows.md`
3538

3639
## Problems This Solves
3740

@@ -54,7 +57,7 @@ When you interact with this agent, it will:
5457

5558
**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
5659

57-
**Prompt file**: [create-agentic-workflow.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/create-agentic-workflow.md)
60+
**Prompt file**: `.github/aw/create-agentic-workflow.md`
5861

5962
**Use cases**:
6063

@@ -66,7 +69,7 @@ When you interact with this agent, it will:
6669

6770
**Load when**: User wants to modify, improve, or refactor an existing workflow
6871

69-
**Prompt file**: [update-agentic-workflow.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/update-agentic-workflow.md)
72+
**Prompt file**: `.github/aw/update-agentic-workflow.md`
7073

7174
**Use cases**:
7275

@@ -78,7 +81,7 @@ When you interact with this agent, it will:
7881

7982
**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
8083

81-
**Prompt file**: [debug-agentic-workflow.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/debug-agentic-workflow.md)
84+
**Prompt file**: `.github/aw/debug-agentic-workflow.md`
8285

8386
**Use cases**:
8487

@@ -90,7 +93,7 @@ When you interact with this agent, it will:
9093

9194
**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
9295

93-
**Prompt file**: [upgrade-agentic-workflows.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/upgrade-agentic-workflows.md)
96+
**Prompt file**: `.github/aw/upgrade-agentic-workflows.md`
9497

9598
**Use cases**:
9699

@@ -102,7 +105,7 @@ When you interact with this agent, it will:
102105

103106
**Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
104107

105-
**Prompt file**: [report.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/report.md)
108+
**Prompt file**: `.github/aw/report.md`
106109

107110
**Use cases**:
108111

@@ -114,7 +117,7 @@ When you interact with this agent, it will:
114117

115118
**Load when**: User wants to create a reusable workflow component or wrap an MCP server
116119

117-
**Prompt file**: [create-shared-agentic-workflow.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/create-shared-agentic-workflow.md)
120+
**Prompt file**: `.github/aw/create-shared-agentic-workflow.md`
118121

119122
**Use cases**:
120123

@@ -126,7 +129,7 @@ When you interact with this agent, it will:
126129

127130
**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
128131

129-
**Prompt file**: [dependabot.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/dependabot.md)
132+
**Prompt file**: `.github/aw/dependabot.md`
130133

131134
**Use cases**:
132135

@@ -138,7 +141,7 @@ When you interact with this agent, it will:
138141

139142
**Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
140143

141-
**Prompt file**: [test-coverage.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/test-coverage.md)
144+
**Prompt file**: `.github/aw/test-coverage.md`
142145

143146
**Use cases**:
144147

@@ -150,7 +153,7 @@ When you interact with this agent, it will:
150153

151154
**Load when**: The user asks how to run, compile, debug, or manage workflows from the command line; needs the MCP tool equivalent of a `gh aw` command; or is in a restricted environment (e.g., Copilot Cloud) without direct CLI access.
152155

153-
**Reference file**: [cli-commands.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/cli-commands.md)
156+
**Reference file**: `.github/aw/cli-commands.md`
154157

155158
**Use cases**:
156159

@@ -159,12 +162,40 @@ When you interact with this agent, it will:
159162
- "I'm in Copilot Cloud — how do I compile a workflow?"
160163
- "Show me all available gh aw commands"
161164

165+
### Token Consumption Optimization
166+
167+
**Load when**: The user asks how to reduce token usage, lower workflow costs, make a workflow faster or cheaper, or measure the impact of prompt or configuration changes.
168+
169+
**Reference file**: `.github/aw/token-optimization.md`
170+
171+
**Use cases**:
172+
173+
- "How do I reduce the token cost of this workflow?"
174+
- "My workflow is too expensive — how do I optimize it?"
175+
- "How do I compare token usage between two runs?"
176+
- "Should I use gh-proxy or the MCP server?"
177+
- "How do I use sub-agents to reduce costs?"
178+
- "How do I measure the impact of a prompt change?"
179+
180+
### Workflow Pattern Selection
181+
182+
**Load when**: The user asks for architecture, strategy, operating model selection, or pattern recommendations for building agentic workflows.
183+
184+
**Reference file**: `.github/aw/patterns.md`
185+
186+
**Use cases**:
187+
188+
- "Which pattern should I use for multi-repo rollout?"
189+
- "How should I structure this workflow architecture?"
190+
- "What pattern fits slash-command triage?"
191+
- "Should this be DispatchOps or DailyOps?"
192+
162193
## Instructions
163194

164195
When a user interacts with you:
165196

166197
1. **Identify the task type** from the user's request
167-
2. **Load the appropriate prompt** from the GitHub repository URLs listed above
198+
2. **Load the appropriate prompt** from the repository paths listed above
168199
3. **Follow the loaded prompt's instructions** exactly
169200
4. **If uncertain**, ask clarifying questions to determine the right prompt
170201

@@ -203,36 +234,40 @@ gh aw compile --validate
203234

204235
## Important Notes
205236

206-
- Always reference the instructions file at [github-agentic-workflows.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/github-agentic-workflows.md) for complete documentation
237+
- Always reference the instructions file at `.github/aw/github-agentic-workflows.md` for complete documentation
207238
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
208239
- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
209240
- **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
210241
- Follow security best practices: minimal permissions, explicit network access, no template injection
211-
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See [network.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/network.md) for the full list of valid ecosystem identifiers and domain patterns.
242+
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See `.github/aw/network.md` for the full list of valid ecosystem identifiers and domain patterns.
212243
- **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.
213244
- **Triggering runs**: Always use `gh aw run <workflow-name>` to trigger a workflow on demand — not `gh workflow run <file>.lock.yml`. `gh aw run` handles workflow resolution by short name, input parsing and validation, and correct run-tracking for agentic workflows. Use `--ref <branch>` to run on a specific branch.
214-
- **CLI commands reference**: For a complete guide on all `gh aw` commands and their MCP tool equivalents (for restricted environments), see [cli-commands.md](https://github.com/github/gh-aw/blob/v0.71.5/.github/aw/cli-commands.md)
245+
- **CLI commands reference**: For a complete guide on all `gh aw` commands and their MCP tool equivalents (for restricted environments), see `.github/aw/cli-commands.md`
215246
- **Repository-specific requirements**: There are multiple sets of repository-specific instructions below that must be respected. They affect workflow authoring, updates, compilation, and reviews.
216247

217248
## Repository-Specific Requirements: Copilot PAT Pool
218249

219-
**⚠️ MANDATORY**: Every agentic workflow in this repository **must** utilize the Copilot PAT Pool as detailed in `.github/workflows/shared/pat_pool.README.md`. This mechanism selects a random Copilot PAT from a numbered pool of secrets to avoid rate-limiting from a single shared PAT.
250+
**⚠️ MANDATORY**: Every agentic workflow in this repository **must** utilize the Copilot PAT Pool in the `copilot-pat-pool` environment as detailed in `.github/workflows/shared/pat_pool.README.md`. This mechanism selects a random Copilot PAT from a numbered pool of environment secrets to avoid rate-limiting from a single shared PAT, while preventing agentic workflows from having access to secrets from other environments.
220251

221252
When **creating** or **updating** an agentic workflow, always include the following frontmatter that integrates the PAT pool. This should be used verbatim when first added.
222253

223254
```yml
224255
# ###############################################################
225256
# Override COPILOT_GITHUB_TOKEN with a random PAT from the pool.
257+
# Ensure this agentic jobs run from the isolated
258+
# `copilot-pat-pool` environment where the PAT pool is available.
226259
# This stop-gap will be removed when org billing is available.
227260
# See: .github/workflows/shared/pat_pool.README.md for more info.
228261
# ###############################################################
229262
imports:
230263
- shared/pat_pool.md
231264

265+
environment: copilot-pat-pool
266+
232267
engine:
233268
id: copilot
234269
env:
235-
COPILOT_GITHUB_TOKEN: ${{ case(needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0, needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1, needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2, needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3, needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4, needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5, needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6, needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7, needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8, needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9, secrets.COPILOT_GITHUB_TOKEN) }}
270+
COPILOT_GITHUB_TOKEN: ${{ case(needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0, needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1, needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2, needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3, needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4, needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5, needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6, needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7, needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8, needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9, 'NO COPILOT PAT AVAILABLE') }}
236271
```
237272
238273
When the workflow is being updated by hand, the `engine.env.COPILOT_GITHUB_TOKEN` may be reformatted to use a multi-line YAML string for the expression if desired for improved readability.
@@ -266,4 +301,4 @@ Arrange top-level frontmatter keys in this order within the `---` markers:
266301
3. **Environment** — `resources`, `dependencies`, `runtimes`, `features`, environment variables, `services`, `container`, `checkout`, etc.
267302
4. **Execution** — conditions (`if`), `concurrency`, `bots`/`skip-bots`, triggers (`on`), `jobs`, `engine`, etc.
268303

269-
The PAT pool integration naturally falls into the **Execution** group at the bottom. Keep the PAT pool content together as the last items in the frontmatter.
304+
The PAT pool integration naturally falls into the **Execution** group at the bottom, including the `environment` property that defines the _execution environment_ for the agentic job. Keep the PAT pool content together as the last items in the frontmatter.

.github/aw/actions-lock.json

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
22
"entries": {
3-
"actions/checkout@v6.0.2": {
3+
"actions/checkout@v6.0.3": {
44
"repo": "actions/checkout",
5-
"version": "v6.0.2",
6-
"sha": "de0fac2e4500dabe0009e67214ff5f5447ce83dd"
5+
"version": "v6.0.3",
6+
"sha": "df4cb1c069e1874edd31b4311f1884172cec0e10"
77
},
88
"actions/download-artifact@v8.0.1": {
99
"repo": "actions/download-artifact",
@@ -15,10 +15,10 @@
1515
"version": "v9.0.0",
1616
"sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
1717
},
18-
"actions/setup-dotnet@v5.2.0": {
18+
"actions/setup-dotnet@v5.3.0": {
1919
"repo": "actions/setup-dotnet",
20-
"version": "v5.2.0",
21-
"sha": "c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7"
20+
"version": "v5.3.0",
21+
"sha": "9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"
2222
},
2323
"actions/setup-node@v6.4.0": {
2424
"repo": "actions/setup-node",
@@ -30,10 +30,10 @@
3030
"version": "v7.0.1",
3131
"sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
3232
},
33-
"github/gh-aw-actions/setup@v0.71.5": {
33+
"github/gh-aw-actions/setup@v0.79.8": {
3434
"repo": "github/gh-aw-actions/setup",
35-
"version": "v0.71.5",
36-
"sha": "b8068426813005612b960b5ab0b8bd2c27142323"
35+
"version": "v0.79.8",
36+
"sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
3737
}
3838
}
3939
}

0 commit comments

Comments
 (0)