fix device auth

Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>

Author: RomanNikitenko

code/extensions/che-github-authentication/src/device-authentication.ts

@@ -15,6 +15,7 @@ import * as vscode from 'vscode';
 import { ExtensionContext } from './extension-context';
 import { GitHubAuthProvider, GithubService } from './github';
 import { CHANNEL_NAME, Logger } from './logger';
+import { DEVICE_AUTH_SCOPES } from './utils';
 
 @injectable()
 export class DeviceAuthentication {
@@ -54,7 +55,7 @@ export class DeviceAuthentication {
   }
 
   async trigger(): Promise<string | undefined> {
-    const scopes = ['user:email'];
+    const scopes = [...DEVICE_AUTH_SCOPES];
     this.logger.info(`Device Authentication is triggered for scopes: ${scopes.join(' ')}`);
 
     try {

code/extensions/che-github-authentication/src/utils.ts

@@ -42,6 +42,9 @@ export function sessionMatchesRequestedScopes(sessionScopes: readonly string[],
   return hasAllScopes([...sessionScopes], [...requestedScopes]);
 }
 
+/** Matches product.json defaultChatAgent.providerScopes[0] and Copilot GITHUB_SCOPE_ALIGNED. */
+export const DEVICE_AUTH_SCOPES = ['read:user', 'user:email', 'repo', 'workflow'] as const;
+
 /** Scope bundles used by Copilot / github / GHPRI / Agent Host — session keys match vanilla createSession. */
 export const HYDRATION_SCOPE_BUNDLES: readonly string[][] = [
   ['read:user', 'user:email', 'repo', 'workflow', 'project', 'read:org'],