Refactor GitHub Actions workflows to replace 'github-token' with 'copilot-token' for improved access control

austenstone · austenstone · commit c827ff3095db · 2025-11-28T08:32:06.000-05:00
diff --git a/.github/workflows/copilot-ci-fix.yml b/.github/workflows/copilot-ci-fix.yml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: austenstone/copilot-cli@main
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           # enable-all-github-mcp-tools: true
           mcp-config: |
             {
diff --git a/.github/workflows/copilot-comment.yml b/.github/workflows/copilot-comment.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Run Copilot
         uses: austenstone/copilot-cli@main
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           prompt: |
             ${{ steps.sanitize.outputs.prompt }}
 
diff --git a/.github/workflows/copilot-dependabot-update.yml b/.github/workflows/copilot-dependabot-update.yml
@@ -14,14 +14,14 @@ jobs:
         id: metadata
         uses: dependabot/fetch-metadata@v2
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          copilot-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate dependency analysis with Copilot
         uses: austenstone/copilot-cli@main
         env:
           CONTEXT7_API_KEY: ${{ secrets.CONTEXT7_API_KEY }}
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           mcp-config: |
             {
               "mcpServers": {
diff --git a/.github/workflows/copilot-pr-review.yml b/.github/workflows/copilot-pr-review.yml
@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: austenstone/copilot-cli@main
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           prompt: |
             ## Role
 
diff --git a/.github/workflows/copilot-research.yml b/.github/workflows/copilot-research.yml
@@ -11,7 +11,7 @@ jobs:
         env:
           FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           mcp-config: |
             {
               "mcpServers": {
diff --git a/.github/workflows/copilot-security-triage.yml b/.github/workflows/copilot-security-triage.yml
@@ -8,7 +8,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: austenstone/copilot-cli@main
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           prompt: |
             ## Role
 
diff --git a/.github/workflows/copilot-triage.yml b/.github/workflows/copilot-triage.yml
@@ -48,7 +48,7 @@ jobs:
           ISSUE_BODY: '${{ github.event.issue.body }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           prompt: |
             ## Role
 
diff --git a/.github/workflows/copilot-usage-report.yml b/.github/workflows/copilot-usage-report.yml
@@ -7,7 +7,7 @@ jobs:
     steps:
       - uses: austenstone/copilot-cli@main
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           prompt: |
             ## Role
 
diff --git a/.github/workflows/test-copilot.yml b/.github/workflows/test-copilot.yml
@@ -9,7 +9,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: austenstone/copilot-cli@main
         with:
-          github-token: ${{ secrets.PAT }}
+          copilot-token: ${{ secrets.PAT }}
           enable-all-github-mcp-tools: true
           prompt: |
             Who are you?
diff --git a/README.md b/README.md
diff --git a/action.yml b/action.yml
@@ -4,9 +4,13 @@ branding:
   icon: 'cpu'
   color: 'purple'
 inputs:
-  github-token:
+  copilot-token:
     description: 'GitHub Personal Access Token (PAT) with "Copilot Requests" permission. The default github.token does NOT have Copilot access - you must provide a PAT with the "Copilot Requests" scope. See: https://github.com/settings/tokens/new?scopes=copilot'
     required: true
+  repo-token:
+    description: 'Token for standard GitHub repository operations (e.g., pushing commits, creating PRs). Defaults to copilot-token if not specified. You can use the default GITHUB_TOKEN here if you only need repo access.'
+    required: false
+    default: ${{ github.token }}
   prompt:
     description: 'Prompt to send to GitHub Copilot'
     required: true
@@ -121,7 +125,6 @@ runs:
       env:
         CONFIG: ${{ inputs.copilot-config }}
         MCP_CONFIG: ${{ inputs.mcp-config }}
-        GH_TOKEN: ${{ inputs.github-token }}
     - name: Run Copilot CLI
       id: copilot
       shell: bash
@@ -215,8 +218,8 @@ runs:
         echo "logs_path=$HOME/.copilot/logs" >> $GITHUB_OUTPUT
         echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
       env:
-        GH_TOKEN: ${{ inputs.github-token }}
-        COPILOT_GITHUB_TOKEN: ${{ inputs.github-token }}
+        GH_TOKEN: ${{ inputs.repo-token || inputs.copilot-token }}
+        COPILOT_GITHUB_TOKEN: ${{ inputs.copilot-token }}
         PROMPT: ${{ inputs.prompt }}
         ALLOW_ALL_TOOLS: ${{ inputs.allow-all-tools }}
         ALLOWED_TOOLS: ${{ inputs.allowed-tools }}

Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ jobs:`
`11`	`11`	`- uses: actions/checkout@v6`
`12`	`12`	`- uses: austenstone/copilot-cli@main`
`13`	`13`	`with:`
`14`		`- github-token: ${{ secrets.PAT }}`
	`14`	`+ copilot-token: ${{ secrets.PAT }}`
`15`	`15`	`# enable-all-github-mcp-tools: true`
`16`	`16`	`mcp-config: \|`
`17`	`17`	`{`
Parameter	Description	Required	Default
`github-token`	GitHub Personal Access Token with required permissions	✅	-
`prompt`	Natural language prompt to send to GitHub Copilot	✅	-
`mcp-config`	MCP server configuration in JSON format	❌	`{}`
`copilot-config`	GitHub Copilot CLI configuration	❌	See below
`log-level`	Logging verbosity level	❌	`all`
`allow-all-tools`	Allow all tools without approval	❌	`true`
`denied-tools`	Comma-separated list of tools to deny	❌	`''`
`copilot-version`	Version of @github/copilot to install	❌	`latest`
`model`	AI model to use	❌	`''`
`additional-directories`	Additional directories to trust for file access	❌	`''`
`disable-mcp-servers`	MCP servers to disable	❌	`''`
`no-color`	Disable color output	❌	`true`
`screen-reader`	Enable screen reader optimizations	❌	`false`
`resume-session`	Resume from previous session	❌	`''`
`show-banner`	Show animated startup banner	❌	`false`
`upload-artifact`	Upload logs as artifacts	❌	`true`
`cache-cli`	Enable caching for GitHub Copilot CLI	❌	`false`
Output	Description
`logs-path`	Path to the copilot logs directory
`exit-code`	Exit code from the Copilot CLI command (0 = success)