[bug] GH‑AW failing with exit code 1 for unclear reasons

[biz-tiwo]

Hey githubnext,

We’re trying to use gh‑aw to trigger a couple of Copilot Jobs on a regular basis (version 0.36) and make use of Copilot in our runners.
We followed the docs step by step and set up both tokens (COPILOT_GITHUB_TOKEN and GH_AW_TOKEN) with the right fine‑grained permissions.
Tokens look perfectly fine — not pending, correct scopes.

Our setup:

• All our repos are org-owned, so switching to user-owned isn’t really an option.
• Copilot licensing is user-based, so the org itself doesn’t hold a Copilot license.
• Copilot + Copilot CLI access is enabled for the users involved.

To test things, we tried two of your sample workflows (ci‑doctor and docs‑updater).
Both fail at exactly the same point: the “Execute GitHub Copilot CLI” step, always with exit code 1.
After going in circles for two days, we figured it's time to ask you guys :)
I still have the feeling it’s token‑related somehow.
So just to double‑check: Do org-owned repos really work as stated in the docs?

If that helps: I tried assigning Copilot to an issue via workflow (using a PAT, no gh-aw) - that works just fine.

  </important>
  <instructions>
  To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
  
  **Available tools**: create_pull_request, missing_tool, noop
  
  **Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
  </instructions>
  </safe-outputs>
  <github-context>
  The following GitHub context information is available for this workflow:
  - **actor**: biz-tiwo
  - **repository**:**
  - **workspace**: /home/runner/work/**/**
  - **workflow-run-id**: 21064374455
  </github-context>'
  
  [INFO] Stopping containers...
   Container awf-agent  Stopping
   Container awf-agent  Stopped
   Container awf-agent  Removing
   Container awf-agent  Removed
   Container awf-squid  Stopping
   Container awf-squid  Stopped
   Container awf-squid  Removing
   Container awf-squid  Removed
  [SUCCESS] Containers stopped successfully
  [INFO] Squid logs available at: /tmp/gh-aw/sandbox/firewall/logs
  [WARN] Command completed with exit code: 1
  Process exiting with code: 1
  Error: Process completed with exit code 1.

[pelikhan]

Could you try your copilot token in the interactive copilot cli? The provide better diagnostics in that mode.

[biz-tiwo]

Thx for your quick response @pelikhan ! Copilot CLI fails to list models when trying to prompt.

 Welcome to GitHub Copilot CLI
 Version 0.0.384 · Commit 0b21260

 Copilot can write, test and debug code right from your terminal. Describe a task to get started or enter ? for help. Copilot uses AI, 
 check for mistakes.

 ● Logged in with GITHUB_TOKEN as user: **

 ● Connected to GitHub MCP Server

 ● Logged in with GITHUB_TOKEN as user: **

 ✗ Execution failed: Error: Failed to list models: 401

Interestingly, even though we followed the guidelines (e.g. setting github copilot business permission for the token on org level), I doubt the token has any copilot scope (in contrast to my default token):

  ✓ Logged in to github.com account ** (GITHUB_TOKEN)
  - Active account: true
  - Git operations protocol: https
  - Token: *************************************************************

  ✓ Logged in to github.com account biz-tiwo (keyring)
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'copilot', 'gist', 'read:org', 'repo', 'workflow'

[pelikhan]

How did you query the scope of the token?

[pelikhan]

I can maybe add this in the help

[biz-tiwo]

I used gh auth status to check the token scope. So any clue why it is not working for us?

[biz-tiwo]

So #10328 is telling us that also org-owned repos need copilot request permission on repo level. We actually don't see this permission on repo level for org-owned repos. Is this an admin config? Please also note that it's missing in your docs:

Issue not solved for us tbh.

[biz-tiwo]

@pelikhan @mnkiefer

[biz-tiwo]

@pelikhan @mnkiefer What is the solution? Can gh-aw used with org-owned repos?