Use a user-owned PAT to trigger Copilot's coding agent on Dependabot PRs - #2733
Merged
Merged
Conversation
github-actions[bot]-authored @copilot comments never triggered Copilot's coding agent (org policy requires a write-access user, not a bot/App identity). Switch to a classic PAT with public_repo scope instead.
Copilot started reviewing on behalf of
Akanksha Jain (jainakanksha-msft)
August 13, 2026 14:25
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Dependabot-to-Copilot handoff workflow so the @copilot assignment comment is authored using a user-owned token (PAT), aligning with org policies that prevent the Copilot coding agent from being triggered by github-actions[bot] comments.
Changes:
- Switches
gh pr commentauthentication from the defaultGITHUB_TOKENtoCOPILOT_ASSIGN_TOKENin the Dependabot Copilot assignment workflow.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
33
to
38
| - name: Ask Copilot to work the PR | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GH_TOKEN: ${{ secrets.COPILOT_ASSIGN_TOKEN }} | ||
| GH_REPO: ${{ github.repository }} | ||
| PR_NUMBER: ${{ steps.pr.outputs.number }} | ||
| run: gh pr comment "$PR_NUMBER" --body-file .github/copilot-dependabot-instructions.md |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
copilot-dependabot-agent.ymlposts an@copilot ...comment on new Dependabot PRs to hand them to GitHub Copilot's coding agent. We confirmed (via PR timelinecopilot_work_startedevents) that comments authored bygithub-actions[bot]using the defaultGITHUB_TOKENnever actually trigger the coding agent — only comments from a real user account with write access do. This is enforced by an org-level, locked Copilot Cloud Agent policy ("Only allow automations to be triggered by users with write access").This matches how other Azure-org repos (
apiops-cli,fleet,agents-on-aks,azure-sdk-tools's gh-aw workflows) solve the same problem: a classic/fine-grained PAT from a real account with a Copilot seat, stored as a repo secret.Change
Swap the token used for the
gh pr commentstep fromsecrets.GITHUB_TOKENtosecrets.COPILOT_ASSIGN_TOKEN(a classic PAT,public_reposcope only, since Azurite is public). The secret has already been added to this repo.Test plan
@copilotcomment authored by the PAT ownercopilot_work_startedtimeline event appears shortly after