Fix assign-to-agent failing with GitHub App tokens — auto-fallback to GH_AW_AGENT_TOKEN by Copilot · Pull Request #19796 · github/gh-aw

Copilot · 2026-03-06T03:19:22Z

The Copilot assignment API rejects GitHub App installation tokens regardless of permissions granted, causing assign-to-agent to fail with "not available as an assignee" when github-app: is the configured auth method.

Changes

safe_outputs_env.go: Removed the early-return in addSafeOutputAgentGitHubTokenForConfig that unconditionally used the App token when github-app: is configured. The function now always resolves through the PAT chain (GH_AW_AGENT_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN). An explicit github-token: on assign-to-agent still takes highest precedence.
compiler.go: Emits a compile-time warning when assign-to-agent + github-app: are both configured without an explicit assign-to-agent.github-token:, so users understand why the App token is bypassed.
compiler_safe_outputs_job_test.go: Two new tests covering the token selection behavior — App token bypassed when absent override, explicit token wins over both App and magic secret.
assign-to-copilot.mdx: Added caution admonition under "Using a GitHub App" clarifying App tokens don't work for Copilot assignment and that the PAT fallback chain is used automatically.

Token precedence for `assign-to-agent`

assign-to-agent.github-token (explicit override)
→ safe-outputs.github-token (global safe-outputs token)
→ ${{ secrets.GH_AW_AGENT_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

The GitHub App token is never used for this operation, even when github-app: is configured for all other safe outputs.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git git init�� ache/node/24.14.--show-toplevel git /usr/bin/git ../pkg/workflow/git ache/node/24.14.rev-parse /usr/bin/bash git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw node /usr/bin/git git comm�� -m Test commit (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel ache/go/1.25.0/xGO111MODULE (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git --show-toplevel go /usr/bin/git git init�� .cfg git /usr/bin/git --show-toplevel go layTitle git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile env 8169735/b419/_pkg_.a GO111MODULE 8169735/b419=> GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha ithub/workflows/auto-triage-issues.md git /home/REDACTED/work/_temp/uv-python-dir/node --show-toplevel x_amd64/vet /usr/bin/git node /opt�� runs/20260306-033629-32551/test-4272634564/custom/workflows --write /opt/hostedtoolcache/node/24.14.0/x64/bin/sh l .prettierignore --log-level=erro--show-toplevel sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 2961148193 git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel node /opt/hostedtoolcache/node/24.14.0/x64/bin/node prettier --check 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/audit-workflows.md git /opt/hostedtoolcache/node/24.14.0/x64/bin/node extensions.objecgit sh 64/bin/go /opt/hostedtoolcache/node/24.14.0/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE eutil.test git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha gSGT/4PU8IGZ3xsiiK_VzgSGT rev-parse /usr/bin/gh ck '**/*.cjs' '*git GO111MODULE 64/bin/go gh 8169�� /repos/github/gh-aw/git/ref/tags/v3.0.0 8169735/b436/_testmain.go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha k/gh-aw/gh-aw/pkg/styles/theme.go k/gh-aw/gh-aw/pkg/styles/theme_test.go /opt/hostedtoolcache/node/24.14.0/x64/bin/node remote.origin.urgit GO111MODULE 64/bin/go node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1108230396/001/test-empty-frontmatter.md ache/go/1.25.0/xGO111MODULE /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha g/stringutil/ansGOINSECURE g/stringutil/ideGOMOD 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 704904/b409/_pkgGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha db83e5df68791969GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE env 704904/b402/_pkgGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/pars-atomic GOMODCACHE go (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /tmp/gh-aw-test-runs/20260306-033231-27843/test-3905243898/.github/workflows rev-parse /tmp/go-build2818169735/b413/repoutil.test ck '**/*.cjs' '*git GO111MODULE 64/bin/go /tmp/go-build2818169735/b413/repoutil.test -tes�� -test.paniconexit0 -test.v=true (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /repos/test-owner/test-repo/actions/secrets --jq (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel infocmp /usr/bin/git xterm-color git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel -tests /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet g/mathutil/mathugit GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -ato�� -bool -buildtags /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.0/xrev-parse (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha 3701-36739/test-2961148193 gh /usr/bin/gh view 12345 /usr/bin/git gh work�� list --json /usr/bin/git --repo owner/repo n-dir/node git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile env 8169735/b412/_pkg_.a GO111MODULE 8169735/b412=> GOINSECURE b/gh-aw/pkg/reporev-parse GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha rite '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path git ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --show-toplevel go /usr/bin/git ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet rev-�� --show-toplevel git /home/REDACTED/work/gh-aw/gh-aw/node_modules/.bin/sh ./../.prettieriggit go /usr/bin/git sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 3701-36739/test-1080710824/.github/workflows git /usr/bin/git .github/workflowinfocmp infocmp /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel resolved$ /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git Name,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --show-toplevel git /opt/hostedtoolcache/node/24.14.--show-toplevel git tion�� --show-toplevel /opt/hostedtoolcache/node/24.14.0/x64/bin/node son ignore go /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git /usr/bin/git -stringintconv (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git /usr/bin/git --show-toplevel /bin/sh /opt/hostedtoolc--show-toplevel git rev-�� *.json' '!../../../pkg/workflow/js/**/*.json' ---errorsas /opt/hostedtoolcache/node/24.14.0/x64/bin/node /usr/bin/git Actor: ${{ githugit go /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git /usr/bin/git r/repo.git git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 node /usr/bin/git /home/REDACTED/worgit go /usr/bin/infocmp--git-dir git rev-�� agent-persona-explorer.md infocmp /usr/bin/git xterm-color go /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 git /usr/bin/git t t DiscussionsEnabl--show-toplevel git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git /usr/bin/git run-script/lib/ngit /opt/hostedtoolcrev-parse /usr/bin/gh git tion�� --show-toplevel gh son ignore --json /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 feature-branch /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git test.txt git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git bin/node --get remote.origin.urremote /usr/bin/git git tion�� agent-persona-explorer.md /usr/bin/git son ignore go /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 --auto /usr/bin/git --detach git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git -m Initial commit /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git ode --show-toplevel /tmp/go-build281config /usr/bin/git git tion�� --show-toplevel /usr/bin/git son ignore ^remote\..*\.gh-rev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git /usr/bin/git /tmp/shared-actigit rev-parse /usr/lib/git-cor--show-toplevel git rev-�� heckout/git/ref/tags/v6 /usr/lib/git-core/git /usr/bin/git run --auto /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 git /usr/bin/git --show-toplevel /opt/hostedtoolcconfig /usr/bin/git git tion�� --show-toplevel git 0/x64/bin/node ignore go /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 ache/node/24.14.0/x64/bin/node /usr/bin/git --show-toplevel -tests /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE At,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE go env 973866501/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel go /usr/bin/git ithub/workflows//opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link resolved$ 0/x64/bin/node git rev-�� js/**/*.json' ---s 0/x64/bin/node e/git ErrorFormatting9git 8169735/b416/_te-C /usr/bin/gh e/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel gh son git rev-�� --show-toplevel git /usr/bin/git 3629-32551/test-git git k/_temp/uv-pytho--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha e=false GO111MODULE 64/bin/go GOINSECURE %H %ct %D 86b9b4eaf76e6fd7-x go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha h ../../../.pret.prettierignore nly /usr/bin/git 8169735/b409/_pk/bin/sh GO111MODULE 8169735/b409=> ; \ fi rev-�� --show-toplevel go /usr/bin/git 8xxG/1YuqbiETwpBgit GO111MODULE /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel on ache/node/24.14.--show-toplevel git rev-�� --show-toplevel sh /usr/bin/git sistency_GoAndJagit git /opt/pipx_bin/sh/tmp/gh-aw-test-runs/20260306-033701-36739/test-3575871813 git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json 86b9b4eaf76e6fd7GOMOD 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 704904/b368/_pkgGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env rEdE/AYBMS5bir_i-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 704904/b368/impo-tests (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 704904/b394/_pkgGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/file-atomic GOMODCACHE go env dyDE/oOxcY6fbL1B-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 704904/b394/impoconfig (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha h ../../../.prettierignore nly /usr/bin/git -json GO111MODULE 8169735/b397/vetactions/setup-cli/install.sh git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /usr/bin/gh git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel on rkflow/js/**/*.j--show-toplevel git rev-�� --show-toplevel sh /usr/bin/git runs/20260306-03infocmp git /home/REDACTED/worxterm-color git (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha re --log-level=error ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.0/xxterm-color git /pre�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/link /usr/bin/infocmp 8169735/b436/scrnode -importcfg clusion,workflow/tmp/TestHashStability_SameInputSameOutput631265349/001/stability-test.md infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel git /usr/bin/git from .github/aw git infocmp k/gh-aw/gh-aw/ac--show-toplevel git rev-�� --show-toplevel git /usr/bin/git 3629-32551/test-git git ache/go/1.25.0/x--show-toplevel git (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --git-dir /opt/hostedtoolcrev-parse /usr/lib/git-cor--show-toplevel 64/pkg/tool/linux_amd64/vet rev-�� --show-toplevel /usr/lib/git-core/git-remote-https k/gh-aw/node_modules/.bin/sh nore go /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git status /usr/bin/git git (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/gh -json GO111MODULE /opt/hostedtoolc--write gh api ath ../../../.pr**/*.json --jq /usr/bin/git -json GO111MODULE ache/go/1.25.0/x"prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---errorsas git (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git -json GO111MODULE /opt/hostedtoolc--write git rev-�� ath ../../../.pr**/*.json go modules/@npmcli/run-script/lib/node-gyp-bin/node runs/20260306-03sh GO111MODULE ache/go/1.25.0/x"prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---s git (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build2818169735/b383/cli.test /tmp/go-build2818169735/b383/cli.test -test.testlogfile=/tmp/go-build2818169735/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE rtcfg k/gh�� ternal/tools/actGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE (http block)
- Triggering command: /tmp/go-build1050294771/b383/cli.test /tmp/go-build1050294771/b383/cli.test -test.testlogfile=/tmp/go-build1050294771/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true test1.md test2.lock.yml /opt/hostedtoolc"prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolcprettier git (http block)
- Triggering command: /tmp/go-build2934507674/b359/cli.test /tmp/go-build2934507674/b359/cli.test -test.testlogfile=/tmp/go-build2934507674/b359/testlog.txt -test.paniconexit0 -test.v=true -test.run=^Test -test.short=true -test.timeout=5m0s /usr/bin/git agent-persona-exgit infocmp /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /js && npm run fgit git m/_npx/b38865467--show-toplevel git (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git 04 GO111MODULE /opt/hostedtoolc--write git rev-�� ath ../../../.pr**/*.json ortcfg /usr/bin/git g/styles/theme.gsh g/styles/theme_t-c ache/node/24.14."prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore git (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel git 86_64/node --show-toplevel /usr/bin/git ache/node/24.14.--show-toplevel git 0/x6�� --show-toplevel git /usr/bin/git --show-toplevel git 64/pkg/tool/linu--show-toplevel git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

The Copilot assignment API rejects GitHub App installation tokens. When github-app: is configured in safe-outputs, assign-to-agent now automatically falls back to the GH_AW_AGENT_TOKEN token chain instead of the App token. - Remove app-token early-return from addSafeOutputAgentGitHubTokenForConfig - Add compiler warning when assign-to-agent is used with github-app: - Add tests for the new token selection behavior - Update assign-to-copilot docs with caution note about App tokens Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Adjusts token selection for assign-to-agent so GitHub App installation tokens are no longer used (they’re rejected by the Copilot assignment API), falling back to a PAT-based token chain and warning users about the behavior.

Changes:

Update assign-to-agent token resolution to prefer explicit tokens and otherwise fall back to ${{ secrets.GH_AW_AGENT_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} even when github-app: is configured.
Add a compiler warning when assign-to-agent is configured alongside github-app: without an explicit assign-to-agent.github-token.
Add tests and documentation clarifying GitHub App token incompatibility for Copilot assignment.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
pkg/workflow/safe_outputs_env.go	Removes GitHub App token short-circuit for agent assignment token selection.
pkg/workflow/compiler.go	Emits a warning when `assign-to-agent` + `github-app:` is configured without an explicit token override.
pkg/workflow/compiler_safe_outputs_job_test.go	Adds tests covering token precedence for `assign-to-agent` when `github-app:` is present.
docs/src/content/docs/reference/assign-to-copilot.mdx	Documents that GitHub App tokens aren’t accepted for Copilot assignment and describes the fallback behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-06T04:13:21Z

+//
+// Note: GitHub App tokens are intentionally NOT used here, even when github-app: is configured.
+// The Copilot assignment API only accepts PATs (fine-grained or classic), not GitHub App
+// installation tokens. Callers must provide an explicit github-token or rely on GH_AW_AGENT_TOKEN.


This comment says callers must provide an explicit github-token or rely on GH_AW_AGENT_TOKEN, but the actual precedence is config token → safe-outputs.github-token → (GH_AW_AGENT_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN). Update the note to reflect that safe-outputs.github-token is also an explicit override and that the full fallback chain may be used.
Suggested change
// installation tokens. Callers must provide an explicit github-token or rely on GH_AW_AGENT_TOKEN.
// installation tokens. Callers must provide an explicit github-token (either via config or
// safe-outputs.github-token) or rely on the fallback of ${{ secrets.GH_AW_AGENT_TOKEN ||
// secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add two new glossary terms based on changes merged 2026-03-06: - GH_AW_AGENT_TOKEN: magic secret for assign-to-agent PAT fallback (PR #19796) - Label Trigger Shorthand: compact label trigger syntax with item_number (PR #19795) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Initial plan
4ee26d1

CopilotAI assigned Copilot and pelikhan Mar 6, 2026

Copilotstarted work on behalf of pelikhan March 6, 2026 03:22 View session

CopilotAI changed the title ~~[WIP] Fix assign-to-agent failure with GitHub App tokens~~Fix assign-to-agent failing with GitHub App tokens — auto-fallback to GH_AW_AGENT_TOKENMar 6, 2026

Copilotfinished work on behalf of pelikhan March 6, 2026 03:42

pelikhan marked this pull request as ready for review March 6, 2026 04:09

CopilotAI review requested due to automatic review settings March 6, 2026 04:09

Copilotstarted reviewing on behalf of pelikhan March 6, 2026 04:10 View session

CopilotAI reviewed Mar 6, 2026
View reviewed changes

Update assign-to-copilot.mdx
6c1d6f6
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

pelikhan merged commit 74480df into mainMar 6, 2026
48 checks passed

pelikhan deleted the copilot/fix-assign-to-agent-issue branch March 6, 2026 08:01

CopilotAI mentioned this pull request Mar 6, 2026
chore: merge main into portable-gh-aw-home and recompile #19817
Merged

github-actionsBot mentioned this pull request Mar 6, 2026
[docs] Update glossary - daily scan #19822
Merged
3 tasks

Navigation Menu

Uh oh!

Fix assign-to-agent failing with GitHub App tokens — auto-fallback to GH_AW_AGENT_TOKEN - #19796

Fix assign-to-agent failing with GitHub App tokens — auto-fallback to GH_AW_AGENT_TOKEN#19796
pelikhan merged 3 commits into
mainfrom
copilot/fix-assign-to-agent-issue

CopilotAI commented Mar 6, 2026•
edited
Loading

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

CopilotAIMar 6, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-// installation tokens. Callers must provide an explicit github-token or rely on GH_AW_AGENT_TOKEN.
+// installation tokens. Callers must provide an explicit github-token (either via config or
+// safe-outputs.github-token) or rely on the fallback of ${{ secrets.GH_AW_AGENT_TOKEN ||
+// secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}.

Uh oh!

Conversation

CopilotAI commented Mar 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Token precedence for assign-to-agent

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

CopilotAIMar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Mar 6, 2026•
edited
Loading

Token precedence for `assign-to-agent`