Skip to content

Remove actions: write from triage workflow #271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swissspidy merged 2 commits into from
Aug 3, 2026
+2 −3
Merged

Remove actions: write from triage workflow #271

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
64ec8b3
Remove `actions: write` from triage workflow
swissspidy Aug 3, 2026
38c767c
Update `actions/ai-inference` to v3
swissspidy Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/workflows/reusable-issue-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ name: Issue and PR Triage
permissions:
issues: write
pull-requests: write
actions: write
contents: read
models: read
Comment on lines 12 to 16

Expand All @@ -37,7 +36,7 @@ jobs:

- name: Analyze with AI
id: ai-triage
uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2
uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -C 6 \
  'actions/ai-inference@|`@github/copilot`|setup-node|copilot-cli-path|COPILOT_GITHUB_TOKEN|GH_TOKEN|GITHUB_TOKEN' \
  .github/workflows/reusable-issue-triage.yml

Repository: wp-cli/.github

Length of output: 1504

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow outline around ai steps =="
sed -n '1,80p' .github/workflows/reusable-issue-triage.yml
sed -n '220,295p' .github/workflows/reusable-issue-triage.yml

echo "== referenced workflow files for pin =="
rg -n 'actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222|# v3' .github/workflows || true

Repository: wp-cli/.github

Length of output: 5966

🌐 Web query:

actions/ai-inference v3 setup-node copilot-cli-path COPILOT_GITHUB_TOKEN GH_TOKEN

💡 Result:

In GitHub Actions workflows, you can authenticate and use the GitHub Copilot CLI using the built-in GITHUB_TOKEN, eliminating the need for a Personal Access Token (PAT) [1][2][3]. For modern workflows, the following practices apply: Authentication and Environment Variables The Copilot CLI looks for authentication tokens in specific environment variables with a defined order of precedence: COPILOT_GITHUB_TOKEN, GH_TOKEN, and GITHUB_TOKEN [4]. When using the built-in authentication in Actions, you should set GITHUB_TOKEN as the environment variable [1][5]. The COPILOT_GITHUB_TOKEN variable is primarily used when you need to provide a separate token (such as a specific PAT) with different permissions than those granted to the default workflow token [2][6]. Workflow Requirements 1. Permissions: Your workflow must explicitly grant the copilot-requests: write permission to authorize Copilot CLI operations [1][7]. 2. Installation: You must install the Copilot CLI on the runner, typically using npm install -g @github/copilot after setting up a Node.js environment (e.g., using actions/setup-node) [1][2][5]. 3. Non-Interactive Usage: When running in non-interactive CI/CD environments, always use the --yolo flag (to suppress prompts) or --no-ask-user, and define your prompt using the -p or --prompt flag [1][8]. Regarding the actions/ai-inference Action The actions/ai-inference action has been updated to focus on the Copilot CLI as its primary inference provider [9][10]. Recent updates have simplified its architecture to exclusively use the Copilot CLI for inference, requiring it to be pre-installed and authenticated on the runner [11][10]. Recommended Approach GitHub recommends using GitHub Agentic Workflows (gh-aw) for most automation tasks, as they are designed to use GITHUB_TOKEN by default and provide necessary guardrails for automated environments [1][2]. If you must invoke the Copilot CLI directly, ensure you are using a recent version of the CLI to support GITHUB_TOKEN authentication [1][3].

Citations:

🌐 Web query:

actions/ai-inference 2c43c91ae16266ca159d311430343c67a5ffa222 copilot-cli-path

💡 Result:

The identifier 2c43c91ae16266ca159d311430343c67a5ffa222 appears to be a Git commit hash associated with the actions/ai-inference GitHub repository [1][2]. This commit introduced the ability to use the GitHub Copilot CLI as an inference provider for the action [3]. Specifically, the action supports a provider parameter (provider: copilot), which allows users to route inference requests through the GitHub Copilot CLI rather than the default GitHub Models REST API [1][4][2]. When this provider is enabled, the action requires the Copilot CLI to be pre-installed and authenticated on the runner [1][4][2]. The copilot-cli-path is an optional input parameter for this action [2][3]. It allows you to specify a custom path to the Copilot CLI binary [2]. If this input is not provided, the action defaults to using whatever binary is found at copilot on the system PATH [2]. To use this feature, you must install and authenticate the GitHub Copilot CLI in your workflow steps prior to running the AI inference action [2][3]. Authentication is typically handled by setting environment variables like COPILOT_GITHUB_TOKEN [2][5].

Citations:

🌐 Web query:

actions/ai-inference v3 action.yml provider copilot cli-provider GITHUB_TOKEN

💡 Result:

The actions/ai-inference GitHub Action provides two primary ways to perform AI inference in your workflows: the default GitHub Models REST API and the GitHub Copilot CLI [1][2]. Inference Providers and Configuration: 1. GitHub Models (Default): By default, the provider is set to github-models [3][2]. It calls the GitHub Models REST API [1]. When using this provider, the action typically uses the GITHUB_TOKEN to authenticate requests [3][4]. 2. Copilot CLI: You can route inference through the GitHub Copilot CLI by setting the provider input to copilot [1][5]. Because the Copilot CLI is not pre-installed on GitHub-hosted runners, you must install it (e.g., via npm) and authenticate it in previous steps before running the action [1][2][5]. Authentication for the Copilot CLI is handled via a separate environment variable, such as COPILOT_GITHUB_TOKEN, which typically requires a personal access token (PAT) with Copilot-related permissions [1][2]. Key inputs for the action include: - provider: Defaults to github-models; set to copilot to use the CLI [3][2]. - token: Used for the primary inference request (typically github.token) [3][4]. - copilot-cli-path: Used only when provider is set to copilot to specify the CLI binary path (defaults to copilot on the PATH) [1][2]. - copilot-allow-tools: Used to opt in to specific tools when using the Copilot provider [1][2]. Note that when using provider: copilot, several inputs specific to the GitHub Models REST API, such as custom-headers and endpoint, are ignored [1][2]. For more complex setups involving the Model Context Protocol (MCP), a dedicated github-mcp-token may be required if the default GITHUB_TOKEN is insufficient [3][4].

Citations:

🌐 Web query:

actions/ai-inference commit 2c43c91ae16266ca159d311430343c67a5ffa222 action.yml

💡 Result:

The GitHub Actions repository actions/ai-inference [1] provides an action for running AI models within workflows [2]. The specific commit 2c43c91ae16266ca159d311430343c67a5ffa222 does not appear in the publicly indexed history of the actions/ai-inference repository [1][3][4][5]. The repository has undergone significant structural changes throughout 2026, including the addition of a Copilot CLI provider [6][7] and a major pull request (#236) proposing to remove support for GitHub Models and Model Context Protocol (MCP) in favor of making the Copilot CLI the sole provider [3]. Given the high volume of commits and rapid development in this repository, the provided hash may be from a private fork, a deleted branch, or an internal development commit not reflected in the main repository's public history [1][3]. The official action.yml file, which defines the action's inputs and configuration, has been frequently updated to reflect these evolving provider and feature requirements [8][6][3][9][10][11].

Citations:

🌐 Web query:

actions/ai-inference pull/236 Copilot CLI provider default Copilot

💡 Result:

As of August 3, 2026, Pull Request #236 for the repository actions/ai-inference is a significant update that transforms the action by removing support for direct GitHub Models integration (and its associated MCP/tool execution logic) [1]. This change establishes the Copilot CLI as the exclusive provider for the action, simplifying the runtime to a single Copilot-based flow [1]. Key aspects of this change include: * Provider Simplification: The action now operates solely via the Copilot CLI, removing the previously available paths that used GitHub Models or alternative MCP clients [1]. * Updated Configuration: Action inputs have been updated to align with Copilot-specific options, and the README has been revised to reflect a Copilot-only setup [1]. * Technical Debt Reduction: The pull request removes unused dependencies (such as modelcontextprotocol/sdk) and refactors the test suite to match the new implementation [1]. * Usage: Users should now configure the action using inputs specific to Copilot, as the previous GitHub Models/OpenAI/MCP inference paths are no longer supported [1]. For general context on the Copilot CLI, it remains a distinct tool from the actions/ai-inference action, though they share the broader ecosystem [2]. The Copilot CLI itself supports custom "Bring Your Own Key" (BYOK) providers—such as Azure OpenAI, Anthropic, or OpenAI-compatible endpoints—by setting environment variables like COPILOT_PROVIDER_TYPE and COPILOT_PROVIDER_BASE_URL, with 'openai' serving as the default provider type [3][4]. However, within the specific scope of the actions/ai-inference repository, PR #236 forces the action into this streamlined Copilot-only provider model [1].

Citations:

🌐 Web query:

site:github.com/actions/ai-inference v3 actions/ai-inference@v3 release

💡 Result:

As of August 3, 2026, there is no v3 release for the actions/ai-inference GitHub Action [1]. The latest stable release for this repository is v2.1.1, which was published on May 25, 2026 [2][3]. The project has recently undergone significant architectural changes, specifically moving to a Copilot-only provider model [4]. Recent development efforts, as seen in pull requests such as PR #236, have focused on removing previous dependencies—such as GitHub Models, OpenAI, and Model Context Protocol (MCP) integrations—to streamline the action to interact exclusively with the GitHub Copilot CLI [4]. For users integrating this action, it is recommended to monitor the official repository releases page for future updates and version changes [1]. Major versions in this repository are typically managed via release tags and accompanying branches (e.g., releases/v2) as part of the project's release workflow [3][5].

Citations:

🌐 Web query:

actions/ai-inference v3 actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 commit

💡 Result:

The repository actions/ai-inference is an official GitHub action designed to facilitate calls to AI models from GitHub Models within GitHub Actions workflows [1][2]. As of August 3, 2026, the repository does not have a released "v3" version. The latest release for the action is v2.1.1, published on May 25, 2026 [1][2]. The specific commit hash 2c43c91ae16266ca159d311430343c67a5ffa222 is not associated with an official tag or release version for this repository in the public records [3]. The action is maintained by GitHub and enables users to integrate AI capabilities, such as those from the GitHub Models catalog, directly into their automation pipelines [1][4]. It supports providers including the native GitHub Models REST API and the GitHub Copilot CLI [1][5].

Citations:

Set up Copilot CLI for the v3 actions/ai-inference pins.

The two v3 actions/ai-inference steps do not install or authenticate the GitHub Copilot CLI, so the AI step can fail before the action can produce response. Add @github/copilot installation, the required credentials/permissions, and any copilot-cli-path setting before both ai-triage steps, or keep the GitHub Models-compatible v2/revision if Copilot CLI is not approved for this workflow.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/reusable-issue-triage.yml at line 39, Update both
ai-triage steps using actions/ai-inference v3 to provision and authenticate the
GitHub Copilot CLI, grant the required credentials and permissions, and
configure copilot-cli-path before invoking the action; alternatively, revert
both steps to the approved GitHub Models-compatible v2/revision if Copilot CLI
is not permitted for this workflow.

env:
AVAILABLE_LABELS: ${{ steps.get-labels.outputs.result }}
Comment on lines 37 to 41
ITEM_TITLE: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.title || github.event.issue.title }}
Expand Down Expand Up @@ -266,7 +265,7 @@ jobs:

- name: Analyze with AI
id: ai-triage
uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2
uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3
env:
AVAILABLE_LABELS: ${{ steps.get-labels.outputs.result }}
ITEM_TITLE: ${{ fromJSON(steps.get-item.outputs.result).title }}
Expand Down
Loading