Remove actions: write from triage workflow - #271
Conversation
📝 WalkthroughWalkthroughThe reusable issue triage workflow removes the ChangesIssue triage workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates the reusable issue/PR triage workflow’s permissions and bumps the AI inference action version used for label selection.
Changes:
- Removed
actions: writefrom the workflow-levelpermissionsblock. - Updated
actions/ai-inferencefrom pinned v2 SHA to pinned v3 SHA (in both triage jobs).
Suppressed comments (1)
.github/workflows/reusable-issue-triage.yml:270
actions/ai-inferencev3 is Copilot-CLI-only and (per its README) requires installing@github/copiloton the runner and providingCOPILOT_GITHUB_TOKEN(typically a PAT) before invoking the action. This workflow currently doesn't install/authenticate the Copilot CLI, so this step will fail. Either add the required setup/authentication steps (and wire a secret throughworkflow_call), or keep using v2 which uses the GitHub Models API.
- name: Analyze with AI
id: ai-triage
uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3
env:
AVAILABLE_LABELS: ${{ steps.get-labels.outputs.result }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| issues: write | ||
| pull-requests: write | ||
| actions: write | ||
| contents: read | ||
| models: read |
| - name: Analyze with AI | ||
| id: ai-triage | ||
| uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2 | ||
| uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3 | ||
| env: | ||
| AVAILABLE_LABELS: ${{ steps.get-labels.outputs.result }} |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/reusable-issue-triage.yml (1)
14-14: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAdd job-level
actions: writefor bulk workflow dispatches.
issue-triage.ymlsetsactions: write, but the reused workflow has a top-level permissions block andtriage-unlabeled-itemscallsgithub.rest.actions.createWorkflowDispatch. The caller’s permission cannot supply the omitted reusable-workflow permission, so batching all unlabeled items will fail while thetry/catchonly logs the error.Add
actions: writetotriage-unlabeled-itemspermissions, or remove the dispatch loop.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-issue-triage.yml at line 14, Add actions: write to the job-level permissions for triage-unlabeled-items so its github.rest.actions.createWorkflowDispatch calls can dispatch workflows successfully; keep the existing dispatch loop and error handling unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/reusable-issue-triage.yml:
- Line 39: Update both ai-triage steps using actions/ai-inference v3 to
provision and authenticate the GitHub Copilot CLI, grant the required
credentials and permissions, and configure copilot-cli-path before invoking the
action; alternatively, revert both steps to the approved GitHub
Models-compatible v2/revision if Copilot CLI is not permitted for this workflow.
---
Outside diff comments:
In @.github/workflows/reusable-issue-triage.yml:
- Line 14: Add actions: write to the job-level permissions for
triage-unlabeled-items so its github.rest.actions.createWorkflowDispatch calls
can dispatch workflows successfully; keep the existing dispatch loop and error
handling unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d6dd79f1-ceeb-49ea-ba78-1b5704d66b63
📒 Files selected for processing (1)
.github/workflows/reusable-issue-triage.yml
| - name: Analyze with AI | ||
| id: ai-triage | ||
| uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2 | ||
| uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 6 \
'actions/ai-inference@|`@github/copilot`|setup-node|copilot-cli-path|COPILOT_GITHUB_TOKEN|GH_TOKEN|GITHUB_TOKEN' \
.github/workflows/reusable-issue-triage.ymlRepository: wp-cli/.github
Length of output: 1504
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== workflow outline around ai steps =="
sed -n '1,80p' .github/workflows/reusable-issue-triage.yml
sed -n '220,295p' .github/workflows/reusable-issue-triage.yml
echo "== referenced workflow files for pin =="
rg -n 'actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222|# v3' .github/workflows || trueRepository: wp-cli/.github
Length of output: 5966
🌐 Web query:
actions/ai-inference v3 setup-node copilot-cli-path COPILOT_GITHUB_TOKEN GH_TOKEN
💡 Result:
In GitHub Actions workflows, you can authenticate and use the GitHub Copilot CLI using the built-in GITHUB_TOKEN, eliminating the need for a Personal Access Token (PAT) [1][2][3]. For modern workflows, the following practices apply: Authentication and Environment Variables The Copilot CLI looks for authentication tokens in specific environment variables with a defined order of precedence: COPILOT_GITHUB_TOKEN, GH_TOKEN, and GITHUB_TOKEN [4]. When using the built-in authentication in Actions, you should set GITHUB_TOKEN as the environment variable [1][5]. The COPILOT_GITHUB_TOKEN variable is primarily used when you need to provide a separate token (such as a specific PAT) with different permissions than those granted to the default workflow token [2][6]. Workflow Requirements 1. Permissions: Your workflow must explicitly grant the copilot-requests: write permission to authorize Copilot CLI operations [1][7]. 2. Installation: You must install the Copilot CLI on the runner, typically using npm install -g @github/copilot after setting up a Node.js environment (e.g., using actions/setup-node) [1][2][5]. 3. Non-Interactive Usage: When running in non-interactive CI/CD environments, always use the --yolo flag (to suppress prompts) or --no-ask-user, and define your prompt using the -p or --prompt flag [1][8]. Regarding the actions/ai-inference Action The actions/ai-inference action has been updated to focus on the Copilot CLI as its primary inference provider [9][10]. Recent updates have simplified its architecture to exclusively use the Copilot CLI for inference, requiring it to be pre-installed and authenticated on the runner [11][10]. Recommended Approach GitHub recommends using GitHub Agentic Workflows (gh-aw) for most automation tasks, as they are designed to use GITHUB_TOKEN by default and provide necessary guardrails for automated environments [1][2]. If you must invoke the Copilot CLI directly, ensure you are using a recent version of the CLI to support GITHUB_TOKEN authentication [1][3].
Citations:
- 1: https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions
- 2: https://docs.github.com/en/copilot/how-tos/copilot-cli/automate-copilot-cli/automate-with-actions
- 3: https://dev.to/pwd9000/run-github-copilot-cli-in-github-actions-without-pats-or-runaway-ai-costs-3dpf
- 4: https://docs.github.com/en/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli
- 5: https://github.com/github/copilot-cli-for-beginners/blob/main/appendices/ci-cd-integration.md
- 6: https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-cli/automate-copilot-cli/automate-with-actions
- 7: https://github.com/marketplace/actions/github-copilot-cli
- 8: https://docs.github.com/en/copilot/how-tos/copilot-cli/automate-copilot-cli/run-cli-programmatically
- 9: https://github.com/actions/ai-inference/releases
- 10: Feat: remove github-models support and make copilot the only provider actions/ai-inference#236
- 11: https://github.com/actions/ai-inference?tab=readme-ov-file
🌐 Web query:
actions/ai-inference 2c43c91ae16266ca159d311430343c67a5ffa222 copilot-cli-path
💡 Result:
The identifier 2c43c91ae16266ca159d311430343c67a5ffa222 appears to be a Git commit hash associated with the actions/ai-inference GitHub repository [1][2]. This commit introduced the ability to use the GitHub Copilot CLI as an inference provider for the action [3]. Specifically, the action supports a provider parameter (provider: copilot), which allows users to route inference requests through the GitHub Copilot CLI rather than the default GitHub Models REST API [1][4][2]. When this provider is enabled, the action requires the Copilot CLI to be pre-installed and authenticated on the runner [1][4][2]. The copilot-cli-path is an optional input parameter for this action [2][3]. It allows you to specify a custom path to the Copilot CLI binary [2]. If this input is not provided, the action defaults to using whatever binary is found at copilot on the system PATH [2]. To use this feature, you must install and authenticate the GitHub Copilot CLI in your workflow steps prior to running the AI inference action [2][3]. Authentication is typically handled by setting environment variables like COPILOT_GITHUB_TOKEN [2][5].
Citations:
- 1: https://github.com/actions/ai-inference
- 2: https://github.com/actions/ai-inference?tab=readme-ov-file
- 3: actions/ai-inference@479b2ef
- 4: https://github.com/marketplace/actions/ai-inference
- 5: https://github.com/github/copilot-sdk/blob/c638a5e3/docs/setup/local-cli.md
🌐 Web query:
actions/ai-inference v3 action.yml provider copilot cli-provider GITHUB_TOKEN
💡 Result:
The actions/ai-inference GitHub Action provides two primary ways to perform AI inference in your workflows: the default GitHub Models REST API and the GitHub Copilot CLI [1][2]. Inference Providers and Configuration: 1. GitHub Models (Default): By default, the provider is set to github-models [3][2]. It calls the GitHub Models REST API [1]. When using this provider, the action typically uses the GITHUB_TOKEN to authenticate requests [3][4]. 2. Copilot CLI: You can route inference through the GitHub Copilot CLI by setting the provider input to copilot [1][5]. Because the Copilot CLI is not pre-installed on GitHub-hosted runners, you must install it (e.g., via npm) and authenticate it in previous steps before running the action [1][2][5]. Authentication for the Copilot CLI is handled via a separate environment variable, such as COPILOT_GITHUB_TOKEN, which typically requires a personal access token (PAT) with Copilot-related permissions [1][2]. Key inputs for the action include: - provider: Defaults to github-models; set to copilot to use the CLI [3][2]. - token: Used for the primary inference request (typically github.token) [3][4]. - copilot-cli-path: Used only when provider is set to copilot to specify the CLI binary path (defaults to copilot on the PATH) [1][2]. - copilot-allow-tools: Used to opt in to specific tools when using the Copilot provider [1][2]. Note that when using provider: copilot, several inputs specific to the GitHub Models REST API, such as custom-headers and endpoint, are ignored [1][2]. For more complex setups involving the Model Context Protocol (MCP), a dedicated github-mcp-token may be required if the default GITHUB_TOKEN is insufficient [3][4].
Citations:
- 1: https://github.com/actions/ai-inference?tab=readme-ov-file
- 2: https://github.com/actions/ai-inference
- 3: https://github.com/marketplace/actions/ai-inference
- 4: https://p.rst.im/q/github.com/actions/ai-inference
- 5: actions/ai-inference@479b2ef
🌐 Web query:
actions/ai-inference commit 2c43c91ae16266ca159d311430343c67a5ffa222 action.yml
💡 Result:
The GitHub Actions repository actions/ai-inference [1] provides an action for running AI models within workflows [2]. The specific commit 2c43c91ae16266ca159d311430343c67a5ffa222 does not appear in the publicly indexed history of the actions/ai-inference repository [1][3][4][5]. The repository has undergone significant structural changes throughout 2026, including the addition of a Copilot CLI provider [6][7] and a major pull request (#236) proposing to remove support for GitHub Models and Model Context Protocol (MCP) in favor of making the Copilot CLI the sole provider [3]. Given the high volume of commits and rapid development in this repository, the provided hash may be from a private fork, a deleted branch, or an internal development commit not reflected in the main repository's public history [1][3]. The official action.yml file, which defines the action's inputs and configuration, has been frequently updated to reflect these evolving provider and feature requirements [8][6][3][9][10][11].
Citations:
- 1: https://github.com/actions/ai-inference
- 2: https://github.com/actions/ai-inference?tab=readme-ov-file
- 3: Feat: remove github-models support and make copilot the only provider actions/ai-inference#236
- 4: actions/ai-inference@48235f7
- 5: actions/ai-inference@9693b13...0cbed4a
- 6: actions/ai-inference@17ff458
- 7: https://github.com/actions/ai-inference/releases/tag/v2.1.0
- 8: actions/ai-inference@6360e0d
- 9: actions/ai-inference@419f171
- 10: actions/ai-inference@3dfda41
- 11: actions/ai-inference@479b2ef
🌐 Web query:
actions/ai-inference pull/236 Copilot CLI provider default Copilot
💡 Result:
As of August 3, 2026, Pull Request #236 for the repository actions/ai-inference is a significant update that transforms the action by removing support for direct GitHub Models integration (and its associated MCP/tool execution logic) [1]. This change establishes the Copilot CLI as the exclusive provider for the action, simplifying the runtime to a single Copilot-based flow [1]. Key aspects of this change include: * Provider Simplification: The action now operates solely via the Copilot CLI, removing the previously available paths that used GitHub Models or alternative MCP clients [1]. * Updated Configuration: Action inputs have been updated to align with Copilot-specific options, and the README has been revised to reflect a Copilot-only setup [1]. * Technical Debt Reduction: The pull request removes unused dependencies (such as modelcontextprotocol/sdk) and refactors the test suite to match the new implementation [1]. * Usage: Users should now configure the action using inputs specific to Copilot, as the previous GitHub Models/OpenAI/MCP inference paths are no longer supported [1]. For general context on the Copilot CLI, it remains a distinct tool from the actions/ai-inference action, though they share the broader ecosystem [2]. The Copilot CLI itself supports custom "Bring Your Own Key" (BYOK) providers—such as Azure OpenAI, Anthropic, or OpenAI-compatible endpoints—by setting environment variables like COPILOT_PROVIDER_TYPE and COPILOT_PROVIDER_BASE_URL, with 'openai' serving as the default provider type [3][4]. However, within the specific scope of the actions/ai-inference repository, PR #236 forces the action into this streamlined Copilot-only provider model [1].
Citations:
- 1: Feat: remove github-models support and make copilot the only provider actions/ai-inference#236
- 2: https://github.com/github/copilot-cli
- 3: https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/use-byok-models
- 4: https://github.blog/changelog/2026-04-07-copilot-cli-now-supports-byok-and-local-models/
🌐 Web query:
site:github.com/actions/ai-inference v3 actions/ai-inference@v3 release
💡 Result:
As of August 3, 2026, there is no v3 release for the actions/ai-inference GitHub Action [1]. The latest stable release for this repository is v2.1.1, which was published on May 25, 2026 [2][3]. The project has recently undergone significant architectural changes, specifically moving to a Copilot-only provider model [4]. Recent development efforts, as seen in pull requests such as PR #236, have focused on removing previous dependencies—such as GitHub Models, OpenAI, and Model Context Protocol (MCP) integrations—to streamline the action to interact exclusively with the GitHub Copilot CLI [4]. For users integrating this action, it is recommended to monitor the official repository releases page for future updates and version changes [1]. Major versions in this repository are typically managed via release tags and accompanying branches (e.g., releases/v2) as part of the project's release workflow [3][5].
Citations:
- 1: https://github.com/actions/ai-inference/releases
- 2: https://github.com/actions/ai-inference/releases/tag/v2.1.1
- 3: https://github.com/actions/ai-inference
- 4: Feat: remove github-models support and make copilot the only provider actions/ai-inference#236
- 5: https://github.com/actions/ai-inference/blob/main/script/release
🌐 Web query:
actions/ai-inference v3 actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 commit
💡 Result:
The repository actions/ai-inference is an official GitHub action designed to facilitate calls to AI models from GitHub Models within GitHub Actions workflows [1][2]. As of August 3, 2026, the repository does not have a released "v3" version. The latest release for the action is v2.1.1, published on May 25, 2026 [1][2]. The specific commit hash 2c43c91ae16266ca159d311430343c67a5ffa222 is not associated with an official tag or release version for this repository in the public records [3]. The action is maintained by GitHub and enables users to integrate AI capabilities, such as those from the GitHub Models catalog, directly into their automation pipelines [1][4]. It supports providers including the native GitHub Models REST API and the GitHub Copilot CLI [1][5].
Citations:
- 1: https://github.com/actions/ai-inference
- 2: https://github.com/actions/ai-inference?tab=readme-ov-file
- 3: https://github.com/actions/ai-inference/releases
- 4: https://github.blog/ai-and-ml/generative-ai/automate-your-project-with-github-models-in-actions/
- 5: https://github.com/marketplace/actions/ai-inference
Set up Copilot CLI for the v3 actions/ai-inference pins.
The two v3 actions/ai-inference steps do not install or authenticate the GitHub Copilot CLI, so the AI step can fail before the action can produce response. Add @github/copilot installation, the required credentials/permissions, and any copilot-cli-path setting before both ai-triage steps, or keep the GitHub Models-compatible v2/revision if Copilot CLI is not approved for this workflow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/reusable-issue-triage.yml at line 39, Update both
ai-triage steps using actions/ai-inference v3 to provision and authenticate the
GitHub Copilot CLI, grant the required credentials and permissions, and
configure copilot-cli-path before invoking the action; alternatively, revert
both steps to the approved GitHub Models-compatible v2/revision if Copilot CLI
is not permitted for this workflow.
Summary by CodeRabbit