[BUG] GitHub Copilot Doesn't Work in Allowlist

[fishcharlie]

Describe the bug

Yesterday GitHub announced GitHub Copilot coding agent. However I can't get this tool to allow it.

I have tried an allowlist of the following (and none of them work):

• allowlist: dependabot[bot],copilot[bot]
• allowlist: dependabot[bot],copilot
• allowlist: dependabot[bot],copilot[ai]
• allowlist: dependabot[bot],copilot[AI]

https://github.com/dynamoose/dynamoose/actions/runs/15148852501/job/42590932172

To Reproduce

1. Set your allow list to one of the following listed above
2. Use GitHub Copilot coding agent to create a PR from an issue

Expected behavior

The CLA check to pass since it's in the allow list

Screenshots

N/A

[ericnewcomer]

I've tried these and many other variations. Feels like there is some magical incantation out there, but it's very hard to debug this.

[fishcharlie]

@ericnewcomer Try the following

allowlist: dependabot[bot],Copilot

You can remove the dependabot, it's just from my original example. Capitalization does matter.

I'll try to remember to make a PR to update the documentation on this project to make it more clear tomorrow.

[m7pr]

We asked copilot to solve this on his own, and this is what it provided
https://github.com/insightsengineering/.github/pull/31/files

          allowlist: >-
            github-actions[bot],
            dependabot-preview[bot],
            insights-engineering-bot,
            dependabot[bot],
            copilot,
            github-copilot[bot],
            copilot[bot]

just in case will extend with Copilot from capital letters

[reynaldichernando]

This seems to work for me

allowlist: dependabot[bot],Copilot,copilot-swe-agent[bot]

Also, having the allowlist already set before the PR by Copilot also helps (or maybe necessary). Since if the cla.yml change is in the same PR, it didn't work for me

also, i think you can omit dependabot as well if not needed

[fishcharlie]

You do have to have it be pushed to the main branch. GitHub Actions won't run changes normally in a PR. This is done to prevent bad actors from modifying your GitHub Actions and having it run automatically.

So you do have to have it pushed to the main branch.

[andreynering]

I had to try many syntaxes, but just Copilot worked for me.