Repository navigation
Feature request to support GitHub app-based authentication for copilot requests #18379
Description
Problem Statement
GitHub Agentic Workflows currently require a fine‑grained Personal Access Token (PAT) with the copilot requests permission in order to run the Copilot CLI.
We maintain multiple repositories across our projects and would like to adopt GitHub Agentic Workflows broadly for various use cases. However, relying on PAT‑based authentication introduces operational challenges:
PATs must be created, rotated, and managed manually
Tokens need to be updated across multiple repositories
This does not scale well and increases maintenance overhead
Current Workaround
As part of a proof of concept, we implemented a workaround where:
The PAT is stored securely in Azure Key Vault
A GitHub Agent Workflow runner step retrieves the token from Key Vault
The token is then injected into the repository as a secret using the gh aw CLI
While functional, this approach adds complexity and is not ideal for long‑term or large‑scale usage.
Feature Request
Support for GitHub App–based authentication in GitHub Agentic Workflows would significantly simplify adoption. GitHub Apps provide:
Centralized and scalable authentication
Easier permission management
Reduced operational burden compared to PATs
Enabling GitHub App–based auth would make GitHub Agentic Workflows easier to consume and manage across multiple repositories and organizations.
Activity
pelikhan commentedon Feb 26, 2026
This should do it https://github.github.com/gh-aw/reference/auth/#using-a-github-app-for-authentication
praveenkuttappan commentedon Feb 26, 2026
@pelikhan I am referring Authenticating Your Coding Agent (AI Engine)
for which the document still says PAT is required. Document that you linked above says:
This does not apply to COPILOT_GITHUB_TOKEN, which must currently be a PAT. A single GitHub App can be used for all other GitHub authentication needs in GitHub Agentic Workflows, including tool authentication and safe outputs.
nzthiago commentedon Apr 10, 2026
@pelikhan - I don't think this should be closed. I agree with the request and what you linked to doesn't solve it. The request is to be able to authenticate a Coding Agent with a GitHub App-based authentication as well.
pelikhan commentedon Apr 10, 2026
Ha right. This is not support for CCA yet. Will keep open until this gets supported.
navidpadid commentedon Apr 13, 2026
Related issue: github/copilot-cli#223
JasonYeMSFT commentedon Jun 5, 2026
Copilot Request should be surfaced as one of the available permissions of a GitHub App. We have traditional workflows where we programmatically acquire tokens for our GitHub App to perform GitHub operations. The lack of Copilot Request permission is blocking us from migrating from a manually maintained PAT to reusing the same GitHub App for everything else.
pelikhan commentedon Oct 7, 2026
Status (2026-10-07; Cross-repo dependency): A maintainer said on April 10 to keep this open until GitHub App authentication supports the coding agent, and a related Copilot CLI issue was linked on April 13. The next step is to check the current Copilot authentication and GitHub App permission support before reassessing the gh-aw request.
pelikhan commentedon Oct 16, 2026
Current-state refresher (2026-10-16): PAT-free Copilot inference is supported in Actions, but that is not general GitHub App authentication. The current authentication reference recommends
permissions: { copilot-requests: write }, using the built-in per-run Actions token with centralized organization billing. The compiler/runtime selection implements that path, and the upstream github/copilot-cli#223 announcement explicitly includes Agentic Workflows.This addresses much of the stated PAT-rotation/scalability pain for eligible organization workflows. It does not establish that arbitrary App installation tokens now have a Copilot Requests permission: the PAT-specific documentation still excludes GitHub App tokens for
COPILOT_GITHUB_TOKEN. App credentials for tools/safe outputs remain a separate capability.Accordingly, this is partially addressed: use the Actions-token route where available, but keep the explicit general App-auth request distinct. No live inference or billing test was performed.
pelikhan commentedon Oct 22, 2026
2026-10-22 assessment (corrected after platform-documentation review): organization-installed GitHub App inference is documented in public preview; gh-aw integration remains incomplete. The platform contract supports installation-token requests with organization Copilot Requests: Read-only, billed to the installation's organization without user sign-in. This is distinct from Actions
GITHUB_TOKENand does not require the separate CLI organization-billing policy. The SDK contract specifiesorganization_copilot_requests: read, an enabled organization, and one-hour installation tokens. This corrects the earlier implication that App inference permission/issuance was wholly unverified.Unmet gh-aw criterion: a supported end-to-end App-owned coding-engine authentication path. At checked main
ffdd9c9efe6a, built-in selection still chooses Actions-token or PAT mode, and activation's PAT-secret validator rejects non-github_pat_tokens, includingghs_installation tokens. The blanket PAT-only guidance needs reconciliation with this preview, not extrapolation into a claim that every organization/runtime already supports it.Next step: gh-aw maintainers should define explicit inference-App configuration, precise permission/minting and expiry/revocation handling, mode-aware validation/diagnostics, and regression coverage. Copilot runtime owners must confirm target-organization enablement, compatible CLI/SDK versions and refresh behavior; verify mint-action support for the exact organization permission. No organization rollout, credential issuance, inference, or billing transaction was tested. Keeping open for integration evidence; per-App budgets are a separate requirement.