Merge branch 'main' into alerting/experimental-setup

Author: nastasha-solomon

.github/workflows/add-new-team-label.yml

@@ -4,10 +4,14 @@ on:
   issues:
     types: [opened]
 
+permissions: {}
+
 jobs:
   add-needs-triage-label:
     name: Add `needs-team` label
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - name: Add the needs-team label
         uses: actions-ecosystem/action-add-labels@v1

.github/workflows/docs-ai-menu.yml

@@ -14,6 +14,7 @@ on:
 
 permissions:
   contents: read
+  copilot-requests: write
   issues: write
 
 jobs:
@@ -152,6 +153,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      copilot-requests: write
       discussions: write
       issues: write
       pull-requests: write
@@ -174,8 +176,6 @@ jobs:
         **Shared ownership**: Some paths have shared ownership (e.g., `/explore-analyze/machine-learning/` is shared by Developer and Experience). Pick the team whose keywords best match the issue content.
         **Internal projects**: If the issue seems related to an internal documentation project, initiative, or content strategy effort, apply `Team:Projects`.
         **Fallback**: If you genuinely cannot determine the owning team, apply `cross-team` so the issue stays visible to all teams.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
 
   run-docs-issue-scope:
     name: Docs AI / issue scope
@@ -184,12 +184,11 @@ jobs:
     permissions:
       actions: read
       contents: read
+      copilot-requests: write
       discussions: write
       issues: write
       pull-requests: write
     uses: elastic/docs-actions/.github/workflows/gh-aw-docs-issue-scope.lock.yml@v1
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
 
   refresh-menu-after-docs-triage:
     name: Refresh AI menu after docs triage

.github/workflows/docs-applies-to-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-coherence-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-frontmatter-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-issue-scope.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -17,5 +18,3 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.comment.body, '/docs-issue-scope')
     uses: elastic/docs-actions/.github/workflows/gh-aw-docs-issue-scope.lock.yml@v1
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-openings-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-pr-ai-menu.yml

@@ -15,6 +15,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   checks: read
   contents: read
   discussions: write
@@ -190,6 +191,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      copilot-requests: write
       discussions: write
       issues: write
       pull-requests: write
@@ -199,8 +201,6 @@ jobs:
       additional-instructions: |
         This repository stores documentation as markdown across the repository, not only under `docs/`.
         Prefer concise, high-signal review comments with exact replacement text when possible.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
 
   refresh-menu-after-docs-review:
     name: Refresh AI PR menu after docs review

.github/workflows/docs-staleness-sweep.yml

@@ -33,6 +33,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -49,5 +50,3 @@ jobs:
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
       stale-content-months: ${{ inputs.stale-content-months }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-style-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}