From 5730cfa6ad9deb0006ca8316b71d5bad677ce398 Mon Sep 17 00:00:00 2001 From: Ed Burns Date: Tue, 21 Jul 2026 14:19:59 -0400 Subject: [PATCH 1/6] Durably document required secrets --- docs/developer-docs/secrets.md | 68 ++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 docs/developer-docs/secrets.md diff --git a/docs/developer-docs/secrets.md b/docs/developer-docs/secrets.md new file mode 100644 index 000000000..c88c873cc --- /dev/null +++ b/docs/developer-docs/secrets.md @@ -0,0 +1,68 @@ +# Secrets management + +This document covers secrets management for the github/copilot-sdk repository. It lists the GitHub Actions secrets that maintainers must keep configured and not expired. + +> [!WARNING] +> If any of these secrets expire or are revoked, the corresponding workflows will fail silently or with opaque permission errors. Review this list periodically and rotate secrets before they expire. + +## SDK test secrets + +These secrets are used by the per-language SDK test workflows and the canary workflow. + +* **`COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY`**: HMAC key used to authenticate with the Copilot Developer CLI integration endpoint during tests. Injected as `COPILOT_HMAC_KEY` in test environments. + * Workflows: `nodejs-sdk-tests.yml`, `python-sdk-tests.yml`, `go-sdk-tests.yml`, `dotnet-sdk-tests.yml`, `rust-sdk-tests.yml`, `sdk-canary.yml` + +## Agentic workflow secrets + +These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage, code generation, and release automation. + +* **`COPILOT_GITHUB_TOKEN`**: GitHub token used by agentic workflow agents for repository access (reading code, creating PRs, running checks). + * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-check.yml`, `java-codegen-fix.lock.yml`, `java-smoke-test.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` + +* **`GH_AW_GITHUB_TOKEN`**: GitHub token used by the gh-aw runtime for workflow orchestration. + * Workflows: same as `COPILOT_GITHUB_TOKEN` above + +* **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Token used by the GitHub MCP server container within agentic workflows. + * Workflows: same as `COPILOT_GITHUB_TOKEN` above + +* **`GH_AW_CI_TRIGGER_TOKEN`**: Token used to trigger CI workflows from within agentic workflow runs. + * Workflows: `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml` + +* **`RUNTIME_TRIAGE_TOKEN`**: Token with read access to `github/copilot-agent-runtime`. Used to clone that repository for cross-repo issue analysis. + * Workflows: `cross-repo-issue-analysis.lock.yml` + +## Java publishing secrets + +These secrets are used by the Java SDK Maven Central publishing workflow (`java-publish-maven.yml`) and the snapshot publishing workflow (`java-publish-snapshot.yml`). + +* **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username for Maven Central (Sonatype OSSRH) authentication. + * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml` + +* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication. + * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml` + +* **`JAVA_GPG_SECRET_KEY`**: GPG private key used to sign Java release artifacts for Maven Central. + * Workflows: `java-publish-maven.yml` + +* **`JAVA_GPG_PASSPHRASE`**: Passphrase for the GPG signing key. + * Workflows: `java-publish-maven.yml` + +* **`JAVA_RELEASE_TOKEN`**: GitHub token with **push** permission on the repository. Used by the release workflow for `actions/checkout`, pushing release commits and tags to `main`, and running `mvn release:prepare -DpushChanges=true`. + * Workflows: `java-publish-maven.yml` + +* **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission. Used to trigger the `release-changelog.lock.yml` workflow after a release is published. + * Workflows: `java-publish-maven.yml` + +## Rust and Node.js publishing secrets + +* **`CARGO_REGISTRY_TOKEN`**: Authentication token for publishing the Rust SDK crate to crates.io. + * Workflows: `publish.yml` + +## Secrets not managed in this repository + +* **`GITHUB_TOKEN`**: Automatically provided by GitHub Actions. No manual management required. + +## Further reading + +* [GitHub docs: Using secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) +* [Repository secrets settings](https://github.com/github/copilot-sdk/settings/secrets/actions) (maintainer access required) From e0ed03c2f634f26a334d0c95d6ec1fc00d28c539 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:34:41 +0000 Subject: [PATCH 2/6] Fix inaccurate credential descriptions in secrets.md Co-authored-by: edburns <75821+edburns@users.noreply.github.com> --- docs/developer-docs/secrets.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/developer-docs/secrets.md b/docs/developer-docs/secrets.md index c88c873cc..a2f988d85 100644 --- a/docs/developer-docs/secrets.md +++ b/docs/developer-docs/secrets.md @@ -16,19 +16,19 @@ These secrets are used by the per-language SDK test workflows and the canary wor These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage, code generation, and release automation. -* **`COPILOT_GITHUB_TOKEN`**: GitHub token used by agentic workflow agents for repository access (reading code, creating PRs, running checks). +* **`COPILOT_GITHUB_TOKEN`**: GitHub OAuth token consumed by the Copilot CLI for AI authentication. Required by all agentic workflows when invoking `copilot` for AI inference. * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-check.yml`, `java-codegen-fix.lock.yml`, `java-smoke-test.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` -* **`GH_AW_GITHUB_TOKEN`**: GitHub token used by the gh-aw runtime for workflow orchestration. - * Workflows: same as `COPILOT_GITHUB_TOKEN` above +* **`GH_AW_GITHUB_TOKEN`**: GitHub token used by gh-aw agents for repository operations (reading code, creating pull requests, making GitHub API calls). + * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` * **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Token used by the GitHub MCP server container within agentic workflows. - * Workflows: same as `COPILOT_GITHUB_TOKEN` above + * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` * **`GH_AW_CI_TRIGGER_TOKEN`**: Token used to trigger CI workflows from within agentic workflow runs. * Workflows: `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml` -* **`RUNTIME_TRIAGE_TOKEN`**: Token with read access to `github/copilot-agent-runtime`. Used to clone that repository for cross-repo issue analysis. +* **`RUNTIME_TRIAGE_TOKEN`**: Token with read access to `github/copilot-agent-runtime`. Used to clone that repository and make GitHub API calls for cross-repo issue analysis. * Workflows: `cross-repo-issue-analysis.lock.yml` ## Java publishing secrets @@ -50,7 +50,7 @@ These secrets are used by the Java SDK Maven Central publishing workflow (`java- * **`JAVA_RELEASE_TOKEN`**: GitHub token with **push** permission on the repository. Used by the release workflow for `actions/checkout`, pushing release commits and tags to `main`, and running `mvn release:prepare -DpushChanges=true`. * Workflows: `java-publish-maven.yml` -* **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission. Used to trigger the `release-changelog.lock.yml` workflow after a release is published. +* **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission on this repository and `github/copilot-sdk-java`. Used to trigger the `release-changelog.lock.yml` workflow and the documentation site deployment after a release is published. * Workflows: `java-publish-maven.yml` ## Rust and Node.js publishing secrets From 8bd3ebf60003a2305b0fdeddfd535f379a64804c Mon Sep 17 00:00:00 2001 From: Ed Burns Date: Tue, 21 Jul 2026 18:44:18 -0400 Subject: [PATCH 3/6] OSSRH is retired. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/developer-docs/secrets.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/developer-docs/secrets.md b/docs/developer-docs/secrets.md index a2f988d85..d68bb9c13 100644 --- a/docs/developer-docs/secrets.md +++ b/docs/developer-docs/secrets.md @@ -35,7 +35,7 @@ These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage, These secrets are used by the Java SDK Maven Central publishing workflow (`java-publish-maven.yml`) and the snapshot publishing workflow (`java-publish-snapshot.yml`). -* **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username for Maven Central (Sonatype OSSRH) authentication. +* **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username generated by a Maven Central Portal user token. * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml` * **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication. From d03f041675c56ff20ae702015cf52c8fb8689228 Mon Sep 17 00:00:00 2001 From: Ed Burns Date: Tue, 21 Jul 2026 18:44:51 -0400 Subject: [PATCH 4/6] Section heading does not mention Node.js Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/developer-docs/secrets.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/developer-docs/secrets.md b/docs/developer-docs/secrets.md index d68bb9c13..d5862ed9b 100644 --- a/docs/developer-docs/secrets.md +++ b/docs/developer-docs/secrets.md @@ -53,7 +53,7 @@ These secrets are used by the Java SDK Maven Central publishing workflow (`java- * **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission on this repository and `github/copilot-sdk-java`. Used to trigger the `release-changelog.lock.yml` workflow and the documentation site deployment after a release is published. * Workflows: `java-publish-maven.yml` -## Rust and Node.js publishing secrets +## Rust publishing secret * **`CARGO_REGISTRY_TOKEN`**: Authentication token for publishing the Rust SDK crate to crates.io. * Workflows: `publish.yml` From dc00e65e815d0da977661a6c247f2caea3e95ca3 Mon Sep 17 00:00:00 2001 From: Ed Burns Date: Tue, 21 Jul 2026 20:01:07 -0400 Subject: [PATCH 5/6] Optional things are optional Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/developer-docs/secrets.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/developer-docs/secrets.md b/docs/developer-docs/secrets.md index d5862ed9b..b4ba8118e 100644 --- a/docs/developer-docs/secrets.md +++ b/docs/developer-docs/secrets.md @@ -19,10 +19,10 @@ These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage, * **`COPILOT_GITHUB_TOKEN`**: GitHub OAuth token consumed by the Copilot CLI for AI authentication. Required by all agentic workflows when invoking `copilot` for AI inference. * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-check.yml`, `java-codegen-fix.lock.yml`, `java-smoke-test.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` -* **`GH_AW_GITHUB_TOKEN`**: GitHub token used by gh-aw agents for repository operations (reading code, creating pull requests, making GitHub API calls). +* **`GH_AW_GITHUB_TOKEN`**: Optional GitHub token override for repository operations (reading code, creating pull requests, and making GitHub API calls). If unset, workflows use the automatic `GITHUB_TOKEN`. * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` -* **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Token used by the GitHub MCP server container within agentic workflows. +* **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Optional token override for the GitHub MCP server container. If unset, workflows fall back to `GH_AW_GITHUB_TOKEN` and then the automatic `GITHUB_TOKEN`. * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` * **`GH_AW_CI_TRIGGER_TOKEN`**: Token used to trigger CI workflows from within agentic workflow runs. From 541ac310de73e5ff029b672bbc96c0888018addf Mon Sep 17 00:00:00 2001 From: Ed Burns Date: Wed, 22 Jul 2026 12:08:12 -0400 Subject: [PATCH 6/6] More accurate RUNTIME_TRIAGE_TOKEN attributes Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/developer-docs/secrets.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/developer-docs/secrets.md b/docs/developer-docs/secrets.md index b4ba8118e..15788bbe5 100644 --- a/docs/developer-docs/secrets.md +++ b/docs/developer-docs/secrets.md @@ -28,7 +28,7 @@ These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage, * **`GH_AW_CI_TRIGGER_TOKEN`**: Token used to trigger CI workflows from within agentic workflow runs. * Workflows: `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml` -* **`RUNTIME_TRIAGE_TOKEN`**: Token with read access to `github/copilot-agent-runtime`. Used to clone that repository and make GitHub API calls for cross-repo issue analysis. +* **`RUNTIME_TRIAGE_TOKEN`**: GitHub token with issue write access to both `github/copilot-sdk` and `github/copilot-agent-runtime`, and read access to `github/copilot-agent-runtime` contents. Used to clone that repository, add labels to the source issue, create linked runtime issues, and make GitHub API calls. * Workflows: `cross-repo-issue-analysis.lock.yml` ## Java publishing secrets