Add GitHub App authentication support for Copilot, Claude, and Codex engines #12272
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| --- | ||
| engine: | ||
| id: copilot | ||
| app: | ||
| app-id: ${{ vars.APP_ID }} | ||
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | ||
| --- | ||
|
|
||
| <!-- | ||
|
|
||
| # GitHub Copilot with App Authentication | ||
|
|
||
| This shared workflow configures the GitHub Copilot engine to use GitHub App authentication instead of personal access tokens. | ||
|
|
||
| ## Configuration | ||
|
|
||
| When imported, this provides: | ||
| - **GitHub App authentication** for Copilot CLI | ||
| - **Short-lived tokens** with `copilot-requests: read` permission | ||
| - **Automatic token invalidation** after workflow completion | ||
|
|
||
| ## Usage | ||
|
|
||
| Import this workflow to enable GitHub App authentication for Copilot: | ||
|
|
||
| ```yaml | ||
| --- | ||
| engine: copilot | ||
| imports: | ||
| - shared/copilot-app.md | ||
| --- | ||
| ``` | ||
|
|
||
| ## Requirements | ||
|
|
||
| Configure the following in your repository: | ||
| - **vars.APP_ID** - GitHub App ID | ||
| - **secrets.APP_PRIVATE_KEY** - GitHub App private key (PEM format) | ||
|
|
||
| ## Permissions | ||
|
|
||
| The generated token will have: | ||
| - `copilot-requests: read` - Required for GitHub Copilot CLI access | ||
|
|
||
| Additional permissions can be inherited from workflow-level `permissions:` configuration. | ||
|
|
||
| ## Benefits | ||
|
|
||
| - **Security**: Short-lived tokens (max 1 hour) instead of long-lived PATs | ||
| - **Audit**: App activity tracked separately in GitHub audit logs | ||
| - **Rotation**: No need to rotate tokens manually | ||
| - **Least privilege**: Minimal permissions for Copilot access | ||
|
|
||
| --> | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| #!/bin/bash | ||
| set -e | ||
|
|
||
| # validate_app_support_engine_field.sh - Validate GitHub App configuration for engine authentication | ||
| # | ||
| # Usage: validate_app_support_engine_field.sh ENGINE_NAME DOCS_URL | ||
| # | ||
| # Arguments: | ||
| # ENGINE_NAME : Name of the engine requiring GitHub App authentication (e.g., "GitHub Copilot CLI") | ||
| # DOCS_URL : Documentation URL for GitHub App configuration | ||
| # | ||
| # Environment variables (required): | ||
| # APP_ID : GitHub App ID (e.g., "${{ vars.APP_ID }}") | ||
| # APP_PRIVATE_KEY: GitHub App private key (e.g., "${{ secrets.APP_PRIVATE_KEY }}") | ||
| # | ||
| # Exit codes: | ||
| # 0 - GitHub App configuration is valid | ||
| # 1 - GitHub App configuration is invalid or missing | ||
|
|
||
| # Parse arguments | ||
| if [ "$#" -ne 2 ]; then | ||
| echo "Usage: $0 ENGINE_NAME DOCS_URL" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| ENGINE_NAME="$1" | ||
| DOCS_URL="$2" | ||
|
|
||
| echo "Validating GitHub App configuration for $ENGINE_NAME..." | ||
| echo "" | ||
|
|
||
| # Validate app-id variable | ||
| if [ -z "$APP_ID" ]; then | ||
| echo "❌ ERROR: GitHub App ID is not set" | ||
| echo "" | ||
| echo "To use GitHub App authentication with $ENGINE_NAME, you need to configure:" | ||
| echo " - vars.APP_ID (GitHub App ID)" | ||
| echo " - secrets.APP_PRIVATE_KEY (GitHub App private key)" | ||
| echo "" | ||
| echo "Documentation: $DOCS_URL" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Validate private-key secret | ||
| if [ -z "$APP_PRIVATE_KEY" ]; then | ||
| echo "❌ ERROR: GitHub App private key is not set" | ||
| echo "" | ||
| echo "To use GitHub App authentication with $ENGINE_NAME, you need to configure:" | ||
| echo " - vars.APP_ID (GitHub App ID)" | ||
| echo " - secrets.APP_PRIVATE_KEY (GitHub App private key)" | ||
| echo "" | ||
| echo "Documentation: $DOCS_URL" | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "✅ GitHub App configuration validated successfully" | ||
|
|
||
| # Set step output to indicate verification succeeded | ||
| if [ -n "$GITHUB_OUTPUT" ]; then | ||
| echo "verification_result=success" >> "$GITHUB_OUTPUT" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1464,4 +1464,3 @@ func TestFormatActionCacheKey(t *testing.T) { | |
| }) | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.