Fix Copilot CLI --secret-env-vars to expose the real token env vars#1569
Closed
priyanshu92 wants to merge 1 commit intomainfrom
Closed
Fix Copilot CLI --secret-env-vars to expose the real token env vars#1569priyanshu92 wants to merge 1 commit intomainfrom
priyanshu92 wants to merge 1 commit intomainfrom
Conversation
The workflow exports the secret to the step env as COPILOT_GITHUB_TOKEN (line 97) and GH_TOKEN (line 100), but `--secret-env-vars` was set to `COPILOT_CLI_PAT` — which is the *secret* name, not the env var name. As a result, neither token was forwarded to the Copilot CLI sub-shells. Observed effect on PR #1568: - The agent could not call `gh api .../dependabot/alerts` (rule 1 of the prompt), so it fell back to `npm audit` as the source of truth. - The PR body explicitly says: "COPILOT_GITHUB_TOKEN was not available in this environment, so npm audit was used as the vulnerability source of truth". Fix: pass the actual env var names (`COPILOT_GITHUB_TOKEN,GH_TOKEN`) to `--secret-env-vars` so they are exposed to tool invocations and redacted from logs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Closing — on closer reading of the docs, |
priyanshu92
deleted the
users/priyanshuag/dependabot-autofix-secret-env-fix
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
In PR #1568 the agent fell back to
npm auditinstead of the Dependabot REST API, and its PR body explicitly says:Root cause
In
.github/workflows/dependabot-autofix.yml:COPILOT_GITHUB_TOKEN(line 97) andGH_TOKEN(line 100).--secret-env-varswas set toCOPILOT_CLI_PAT, which is the secret name, not the env var name.--secret-env-varscontrols which env vars from the parent process get forwarded to Copilot CLIs tool sub-shells (and redacted from logs). Because neither real env var was listed, none reached the agents shells, so thegh api repos/.../dependabot/alertscall from rule 1 of the prompt failed and the agent fell back tonpm audit.Fix
Pass the actual env var names:
Test plan
After merge, trigger via
workflow_dispatchand confirm:gh api .../dependabot/alertsand writesalerts.json(rule 1 of the prompt).npm auditfallback disclaimer.