refactor: streamline PR verification agent by removing unnecessary permissions and updating workflow triggers

Author: YunchuWang

.github/workflows/pr-verification.yaml

@@ -1,11 +1,11 @@
 name: 🔎 PR Verification Agent
 
+# Security: This workflow has write permissions to issues and PRs, so it must NOT
+# use the `pull_request` trigger (which checks out untrusted PR code and could
+# exfiltrate the job token). Instead, it runs on schedule/manual dispatch only.
+# The agent fetches each PR's branch itself before building and verifying.
 on:
-  # Trigger when a PR is labeled
-  pull_request:
-    types: [labeled]
-
-  # Safety-net: run periodically to catch any missed PRs
+  # Run periodically to pick up PRs labeled pending-verification
   schedule:
     - cron: "0 */6 * * *" # Every 6 hours
 
@@ -19,14 +19,14 @@ permissions:
 
 jobs:
   verify-prs:
-    # For the labeled trigger, only run when the label is 'pending-verification'
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.label.name == 'pending-verification'
-
     runs-on: ubuntu-latest
     timeout-minutes: 30
 
+    # Prevent overlapping runs from racing on label updates / comment posts
+    concurrency:
+      group: pr-verification
+      cancel-in-progress: false
+
     env:
       NODE_VER: "22"
 
@@ -35,21 +35,13 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          # For pull_request events, this checks out the PR merge commit (includes PR changes).
-          # For schedule/workflow_dispatch, this checks out main. The agent will
-          # switch to each PR's branch before building and verifying.
+          persist-credentials: false
 
       - name: ⚙️ Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
 
-      - name: 📦 Install dependencies and build (PR trigger only)
-        if: github.event_name == 'pull_request'
-        run: |
-          npm ci
-          npm run build
-
       - name: 🐳 Start DTS Emulator
         run: |
           docker run --name dts-emulator -d --rm -p 8080:8080 \
@@ -68,14 +60,68 @@ jobs:
             sleep 1
           done
 
-      - name: 🤖 Run PR Verification Agent
-        uses: github/copilot-agent@v1
-        with:
-          agent: pr-verification
+      - name: 🤖 Install GitHub Copilot CLI
+        run: npm install -g @github/copilot
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+
+      - name: 🔎 Run PR Verification Agent
+        run: |
+          AGENT_PROMPT=$(cat .github/agents/pr-verification.agent.md)
+
+          FULL_PROMPT=$(cat <<PROMPT_EOF
+          $AGENT_PROMPT
+
+          ---
+
+          ## Execution Context
+
+          You are running in CI. Today's date is $(date +%Y-%m-%d).
+          Repository: ${{ github.repository }}
+
+          Environment variables available:
+          - ENDPOINT=$ENDPOINT
+          - TASKHUB=$TASKHUB
+
+          Execute the full workflow described above:
+          1. Find PRs labeled pending-verification
+          2. For each PR: understand the fix, extract the scenario, checkout the PR branch, build, create and run verification sample
+          3. Post verification results to the linked issue
+          4. Update PR labels accordingly
+
+          Remember:
+          - Process PRs one at a time
+          - Always checkout the PR branch and rebuild before verifying
+          - If a verification sample fails, retry up to 2 times before reporting failure
+          - Maximum timeout per PR: 5 minutes
+          PROMPT_EOF
+          )
+
+          EXIT_CODE=0
+          timeout --foreground --signal=TERM --kill-after=30s 1200s \
+            copilot \
+              --prompt "$FULL_PROMPT" \
+              --model "claude-opus-4.6" \
+              --allow-all-tools \
+              --allow-all-paths \
+              < /dev/null 2>&1 || EXIT_CODE=$?
+
+          if [ $EXIT_CODE -eq 124 ]; then
+            echo "::warning::Agent timed out after 20 minutes"
+          elif [ $EXIT_CODE -ne 0 ]; then
+            echo "::warning::Agent exited with code $EXIT_CODE"
+          fi
+
+          echo "PR verification agent completed."
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           ENDPOINT: localhost:8080
           TASKHUB: default
+          CI: "true"
+          NO_COLOR: "1"
+          TERM: "dumb"
 
       - name: 🧹 Stop DTS Emulator
         if: always()