Add support for GITHUB_ACTOR and GITHUB_REPOSITORY environment variables with --validate-actor flag in mcp-server command by Copilot · Pull Request #15084 · github/gh-aw

Copilot · 2026-02-12T04:05:18Z

Implementation Plan: Add GITHUB_ACTOR and GITHUB_REPOSITORY Environment Variable Support to mcp-server Command

Overview

Add support for the GITHUB_ACTOR and GITHUB_REPOSITORY environment variables to the mcp-server command to determine the role of the current actor (admin, maintain, write) for access control. The actor information is required for audit and logs functionality to work properly. The --validate-actor flag enforces actor validation when enabled.

Changes Made

GITHUB_ACTOR Support: mcp-server command now reads the GITHUB_ACTOR environment variable to determine the current actor
GITHUB_REPOSITORY Support: Added GITHUB_REPOSITORY environment variable to MCP server configuration for repository context
- Passed to agentic-workflows MCP server in both dev and release modes
- Enables fast path for repository lookup (avoids gh CLI calls)
- Used by permission checking to determine repository context
--validate-actor Flag: New flag to enforce actor validation
- When enabled: Logs and audit tools query GitHub API to verify actor has write+ access
- When disabled (default): Logs and audit tools work without actor validation (backward compatible)
Always Mount Tools: Logs and audit tools are always mounted and visible to MCP clients; permission checks happen at runtime when tools are invoked
GitHub API Integration: Added real-time permission checking via GitHub API
- Queries /repos/{owner}/{repo}/collaborators/{username}/permission endpoint
- Validates actor has write, maintain, or admin access
- Caches permission results for 1 hour (TTL) to avoid excessive API calls
- Returns detailed error messages with actual role vs required role
- Fails open if repository context cannot be determined
Repository Caching: Added repository information caching with 1-hour TTL
- Caches repository name (owner/repo) for 1 hour
- Checks GITHUB_REPOSITORY env var first (fast path)
- Falls back to gh repo view if env var not set
- Avoids repeated CLI calls for repository lookup
Runtime Permission Checking: Added checkActorPermission function that validates permissions when restricted tools are called
- Queries GitHub API to get actor's actual repository role
- Returns clear error message: "permission denied: insufficient role" with detailed context
- Error includes actor's actual role, required role, and repository information
Role-Based Access Control: Logs and audit tools require write+ repository access (updated from maintainer to write)
Workflow Compilation: GITHUB_ACTOR and GITHUB_REPOSITORY environment variables are passed to agentic-workflows MCP server in both dev and release modes
- Updated JSON renderer (Copilot/Claude engines)
- Updated TOML renderer (Codex engine) in both mcp_config_builtin.go and mcp_renderer.go
- Recompiled all 148 workflows with updated environment variables
Dockerfile Update: CMD now includes --validate-actor flag to enforce validation in containerized environments

Caching Strategy

Permission Cache TTL: 1 hour per actor-repository combination
- Cache Key: {actor}:{repository}
- Stores actor's permission level in the repository
Repository Cache TTL: 1 hour
- Single global cache for repository information
- Avoids repeated gh repo view CLI calls
Automatic Expiration: All cache entries automatically expire after TTL
API Query: GET /repos/{owner}/{repo}/collaborators/{username}/permission
Accepted Roles: admin, maintain, write

Behavior

Scenario	--validate-actor	GITHUB_ACTOR	Actor Role	Logs/Audit Tools
Default (no flag)	Disabled	Not set	N/A	✅ Mounted, ✅ Allowed
Default (no flag)	Disabled	Set	Any	✅ Mounted, ✅ Allowed
Validation enabled	Enabled	Not set	N/A	✅ Mounted, ❌ Permission denied
Validation enabled	Enabled	Set	read/triage	✅ Mounted, ❌ Permission denied (insufficient role)
Validation enabled	Enabled	Set	write+	✅ Mounted, ✅ Allowed

Error Messages

When GITHUB_ACTOR is not set:

{
  "error": "GITHUB_ACTOR environment variable not set",
  "tool": "logs",
  "reason": "This tool requires at least write access to the repository. Set GITHUB_ACTOR environment variable to enable access."
}

When actor has insufficient permissions:

{
  "error": "insufficient repository permissions",
  "actor": "username",
  "repository": "owner/repo",
  "role": "read",
  "required": "write, maintain, or admin",
  "reason": "Actor username has read access to owner/repo. This tool requires at least write access."
}

Original prompt

The mcp-server command should support a flag called --actor, which receives the value of GITHUB_ACTOR. The command uses this flag to determine the role of the current actor, such as admin, maintainer, or write.

To access logs and use the audit functionality, the actor must have at least maintainer access. Otherwise, these functions are not mounted.

When setting up the agentic-workflows tool, pass this new flag to the CLI so that the server is configured correctly based on the user identity. You can pass the actor value either through the standard GITHUB_ACTOR environment variable or via the --actor flag. The CLI must support both options and handle them consistently in release mode (container) and in development mode (using the build command). Update the documentation to reflect this behavior.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Added the MCP server actor validation flag along with GITHUB_ACTOR/GITHUB_REPOSITORY support and documentation updates.

Generated by Changeset Generator

pelikhan · 2026-02-12T04:07:13Z

@copilot update the minimum required role to write instead of maintainer.

- Add --actor flag to NewMCPServerCommand with support for GITHUB_ACTOR env var - Implement conditional tool mounting for logs and audit tools - Update workflow compilation to pass --actor flag in release mode - Add GITHUB_ACTOR to environment variables in MCP config - Update both JSON (Copilot/Claude) and TOML (Codex) renderers - Update Dockerfile documentation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…dit tools Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-12T04:44:58Z

@copilot update the minimum required role to write instead of maintainer.

Updated the minimum required role from maintainer to write for logs and audit tools in commit ce674cf.

Changes include:

Help text now shows "requires write+ access"
Function documentation updated to reflect write access requirement
Log messages updated to mention "write+ access"
All comments in the code updated accordingly

github-actions · 2026-02-12T06:37:06Z

🔍 PR Triage Results

Category: feature | Risk: medium | Priority: 38/100

Scores Breakdown

Impact: 28/50 - New CLI feature adding --actor flag to mcp-server command for access control
Urgency: 4/30 - WIP status, 2.5 hours old, new feature not blocking any critical work
Quality: 6/20 - CI pending, WIP status, large changeset (572 lines across 27 files suggests extensive workflow recompilation)

📋 Recommended Action: defer

Explanation: This WIP PR adds access control functionality via --actor flag. The large changeset (27 files) includes workflow lock file regeneration. Should wait for completion and thorough CI validation given the scope.

Next Steps:

Complete implementation and remove [WIP] tag
Validate all workflow lock files are correctly regenerated
Ensure comprehensive test coverage
Wait for CI validation
Request review

Triaged by PR Triage Agent on 2026-02-12

AI generated by PR Triage Agent

pelikhan · 2026-02-12T11:02:36Z

@copilot remove --actor flag support, only support env var GITHUB_ACTOR

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-12T11:08:20Z

@copilot remove --actor flag support, only support env var GITHUB_ACTOR

Removed the --actor flag in commit ff20818. The mcp-server command now only supports the GITHUB_ACTOR environment variable for actor-based access control.

Changes:

Removed --actor flag from command definition
Updated help text to only reference GITHUB_ACTOR environment variable
Simplified examples to show environment variable usage only
Log messages now mention "GITHUB_ACTOR environment variable" instead of "flag or environment variable"

pelikhan · 2026-02-12T11:20:18Z

@copilot

add flag --validate-actor to enforce the actor check
add flag in Dockerfile entry point args
when flag is enabled, enforce actor check; otherwise ignore

- Add --validate-actor flag to mcp-server command - When enabled, requires GITHUB_ACTOR to mount logs and audit tools - When disabled (default), mounts all tools regardless of actor - Update Dockerfile CMD to include --validate-actor flag - Update help text and examples to document the new flag Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…flows MCP server - Add GITHUB_REPOSITORY to envVars in renderAgenticWorkflowsMCPConfigWithOptions (JSON) - Add GITHUB_REPOSITORY to env_vars in renderAgenticWorkflowsMCPConfigTOML (TOML, mcp_config_builtin.go) - Add GITHUB_REPOSITORY to env_vars in renderAgenticWorkflowsTOML (TOML, mcp_renderer.go) - Update --validate-actor flag in release mode entrypointArgs (both renderers) - Update dev mode comments to reflect --validate-actor in Dockerfile CMD - Recompile all 148 workflows with updated environment variables Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…env var (#15154)

github-actions · 2026-02-12T14:44:54Z

✅ Changeset Generator completed successfully!

github-actions · 2026-02-12T14:44:56Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-12T14:44:57Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-12T14:44:57Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-12T14:44:58Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-12T14:47:47Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.52.2
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.12
java	✅	21.0.10
dotnet	✅	10.0.102

Result: 12/12 tools available ✅

All required development tools are accessible in the agent container environment.

AI generated by Agent Container Smoke Test

github-actions · 2026-02-12T14:48:19Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-12T14:49:58Z

Smoke Test Results: ✅ PASS

PR Titles Tested:

Neutralize GitHub Actions workflow commands in user-generated log output #15150: Neutralize GitHub Actions workflow commands in user-generated log output
Add support for GITHUB_ACTOR and GITHUB_REPOSITORY environment variables with --validate-actor flag in mcp-server command #15084: Add support for GITHUB_ACTOR and GITHUB_REPOSITORY environment variables with --validate-actor flag

Test Results: 8/9 passed

✅ GitHub MCP, Safe Inputs, Playwright, File I/O, Discussion, Build, Workflow Dispatch
❌ Serena MCP (not available)

Overall: PASS

cc: @pelikhan @Copilot

AI generated by Smoke Copilot

github-actions · 2026-02-12T14:50:01Z

Merged PRs: chore: add account summary table (#15176); chore: enhance bot report summary (#15175)
GitHub MCP: ✅
Serena MCP: ✅
Playwright: ✅
File write: ✅
Bash cat: ✅
Build: ✅
Overall: PASS

AI generated by Smoke Codex

github-actions · 2026-02-12T14:50:13Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Add documentation for the new --validate-actor flag and environment variable support (GITHUB_ACTOR, GITHUB_REPOSITORY) added in PR #15084. - Document actor validation behavior and requirements - Explain permission checking via GitHub API with 1-hour caching - Add error message examples for troubleshooting - Update both CLI reference and MCP server guide Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Initial plan

a4e666a

Copilot AI assigned Copilot and pelikhan Feb 12, 2026

Copilot started work on behalf of pelikhan February 12, 2026 04:05 View session

Copilot AI and others added 3 commits February 12, 2026 04:24

Recompile all workflows with --actor flag changes

2e40cec

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Changes before error encountered

709f370

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan February 12, 2026 04:39

Copilot started work on behalf of pelikhan February 12, 2026 04:40 View session

Update minimum required role from maintainer to write for logs and au…

ce674cf

…dit tools Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 12, 2026 04:45

github-actions bot added pr-action:defer pr-priority:low pr-risk:medium pr-type:feature labels Feb 12, 2026

github-actions bot mentioned this pull request Feb 12, 2026

[PR Triage Report] PR Triage Report - February 12, 2026 #15098

Closed

Copilot started work on behalf of pelikhan February 12, 2026 11:03 View session

github-actions bot mentioned this pull request Feb 12, 2026

[agentics] No-Op Runs #14645

Closed

Remove --actor flag, keep only GITHUB_ACTOR env var support

ff20818

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add support for --actor flag in mcp-server command~~ Add support for GITHUB_ACTOR environment variable in mcp-server command Feb 12, 2026

Copilot finished work on behalf of pelikhan February 12, 2026 11:09

Copilot started work on behalf of pelikhan February 12, 2026 11:20 View session

github-actions bot mentioned this pull request Feb 12, 2026

[PR Triage Report] Analysis of 2 Open Agent PRs - February 12, 2026 #15149

Closed

Copilot AI changed the title ~~Add support for GITHUB_ACTOR environment variable and --validate-actor flag in mcp-server command~~ Add support for GITHUB_ACTOR and GITHUB_REPOSITORY environment variables with --validate-actor flag in mcp-server command Feb 12, 2026

Copilot AI requested a review from pelikhan February 12, 2026 12:31

Copilot finished work on behalf of pelikhan February 12, 2026 12:31

Copilot AI added 2 commits February 12, 2026 04:36

[WIP] Fix issues in tests (#15146)

3473a0b

Fix MCP config tests for --validate-actor flag and GITHUB_REPOSITORY …

398e4d1

…env var (#15154)

pelikhan added the smoke label Feb 12, 2026

Add changeset [skip-ci]

f97be9f

github-actions bot mentioned this pull request Feb 12, 2026

Smoke Test: Copilot - 21951229381 #15178

Closed

github-actions bot added smoke-copilot and removed smoke labels Feb 12, 2026

github-actions bot added the smoke-codex label Feb 12, 2026

github-actions bot mentioned this pull request Feb 12, 2026

Smoke Test: Claude - 21951229420 #15179

Closed

github-actions bot added the smoke-claude label Feb 12, 2026

pelikhan merged commit bcfb18a into main Feb 12, 2026
1 check passed

pelikhan deleted the copilot/add-actor-flag-support branch February 12, 2026 15:02

This was referenced Feb 12, 2026

[docs] Update documentation for --validate-actor flag in mcp-server command #15181

Merged

[PR Triage Report] PR Triage Report - 2026-02-12 #15220

Closed

Conversation

Copilot AI commented Feb 12, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Plan: Add GITHUB_ACTOR and GITHUB_REPOSITORY Environment Variable Support to mcp-server Command

Overview

Changes Made

Caching Strategy

Behavior

Error Messages

Changeset

Uh oh!

pelikhan commented Feb 12, 2026

Uh oh!

Copilot AI commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

🔍 PR Triage Results

Scores Breakdown

📋 Recommended Action: defer

Uh oh!

pelikhan commented Feb 12, 2026

Uh oh!

Copilot AI commented Feb 12, 2026

Uh oh!

pelikhan commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Smoke Test Results: ✅ PASS

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 12, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading