Update agentic engine token handling to use user-provided secrets by Copilot · Pull Request #18017 · github/gh-aw

Copilot · 2026-02-24T00:57:22Z

When a user provides engine.env in a workflow frontmatter, the agentic engine token expression is automatically overridden with the user-supplied secret — in both the execution step and the secret validation step.

Changes Made

Gemini engine: Added maps.Copy(env, workflowData.EngineConfig.Env) and agent config env passthrough to gemini_engine.go's GetExecutionSteps, bringing it in line with the Copilot, Claude, and Codex engines (which already had this support).
Secret validation step: Modified GenerateMultiSecretValidationStep to accept engine.env overrides. When a token key (e.g. COPILOT_GITHUB_TOKEN) is overridden via engine.env, the validation step validates the user-supplied secret expression instead of the default ${{ secrets.KEY }}.
Tests — Gemini: Added tests verifying engine.env overrides GEMINI_API_KEY and passes through custom env vars.
Tests — Copilot: Added TestCopilotEngineEnvOverridesTokenExpression verifying COPILOT_GITHUB_TOKEN can be overridden via engine.env.
Tests — Claude: Added TestClaudeEngineEnvOverridesTokenExpression verifying ANTHROPIC_API_KEY can be overridden via engine.env.
Tests — Codex: Added TestCodexEngineEnvOverridesTokenExpression verifying CODEX_API_KEY can be overridden via engine.env.
Tests — Validation step: Added TestGenerateMultiSecretValidationStepWithEnvOverrides and TestValidationStepUsesEngineEnvOverride covering override behavior in the validation step for all 4 engines.

Example

engine:
  id: gemini  # or copilot, claude, codex
  env:
    GEMINI_API_KEY: ${{ secrets.MY_ORG_GEMINI_KEY }}

With this configuration, both the execution step and the secret validation step will use ${{ secrets.MY_ORG_GEMINI_KEY }} instead of the default ${{ secrets.GEMINI_API_KEY }}.

Testing

✅ make fmt passes with no changes
✅ All new and existing engine tests pass

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…rovided in Gemini engine Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-24T01:26:23Z

@copilot add the same support for copilot, claude, codex

pelikhan · 2026-02-24T01:36:05Z

https://gh.io/copilot-coding-agent-docs add the same support for copilot, claude, codex

pelikhan · 2026-02-24T01:36:15Z

@copilot add the same support for copilot, claude, codex

…dex engines Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-24T01:54:47Z

@copilot add the same support for copilot, claude, codex

Added tests verifying engine.env overrides the default token expression for Copilot (COPILOT_GITHUB_TOKEN), Claude (ANTHROPIC_API_KEY), and Codex (CODEX_API_KEY) in commit 65478c4. The code support already existed in all three engines — this commit adds test coverage to confirm and document that behavior.

pelikhan · 2026-02-24T02:09:02Z

@copilot make sure the override applies to the validation step: the overridden value is validated .

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-24T02:17:11Z

@copilot make sure the override applies to the validation step: the overridden value is validated .

Done in commit 133f576. GenerateMultiSecretValidationStep now accepts an envOverrides map[string]string parameter. When a key in the validation step's env: section matches an engine.env override, the user-provided expression (e.g. ${{ secrets.MY_ORG_TOKEN }}) is used instead of the default ${{ secrets.KEY }}. All 4 engine callers (copilot, claude, codex, gemini) pass the engine.env overrides to the validation step.

Copilot

Pull request overview

Updates agentic engine secret/token handling so engine.env can override default token secret expressions consistently across execution steps and the install-time secret validation step.

Changes:

Extend GenerateMultiSecretValidationStep to accept engine.env overrides and validate the overridden secret expression instead of the default ${{ secrets.KEY }}.
Add engine.env passthrough (and agent config env passthrough) to Gemini execution steps for parity with other engines.
Add/expand tests across engines and secret validation to cover token-expression overrides and custom env vars.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/workflow/agentic_engine.go	Adds `envOverrides` support to multi-secret validation env generation.
pkg/workflow/engine_helpers.go	Introduces helper to pass `engine.env` overrides into common install-step generation.
pkg/workflow/gemini_engine.go	Copies `engine.env` (and agent env) into Gemini execution env; passes overrides to validation step.
pkg/workflow/copilot_engine_installation.go	Passes `engine.env` overrides into Copilot’s secret validation step.
pkg/workflow/claude_engine.go	Passes `engine.env` overrides into Claude’s secret validation step.
pkg/workflow/secret_validation_test.go	Updates existing tests for new signature and adds override-focused validation tests.
pkg/workflow/gemini_engine_test.go	Adds tests verifying Gemini token override and custom env passthrough.
pkg/workflow/copilot_engine_test.go	Adds tests verifying Copilot token override and extra env vars.
pkg/workflow/claude_engine_test.go	Adds tests verifying Claude token override and extra env vars.
pkg/workflow/codex_engine_test.go	Adds tests verifying Codex token override and extra env vars.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-24T02:25:47Z

 	// Set the model environment variable only when explicitly configured.
 	// When model is configured, use the native GEMINI_MODEL env var - the Gemini CLI reads it
 	// directly, avoiding the need to embed the value in the shell command (which would fail
 	// template injection validation for GitHub Actions expressions like ${{ inputs.model }}).
 	// When model is not configured, let the Gemini CLI use its built-in default model.
 	if modelConfigured {
 		geminiLog.Printf("Setting %s env var for model: %s", constants.GeminiCLIModelEnvVar, workflowData.EngineConfig.Model)
 		env[constants.GeminiCLIModelEnvVar] = workflowData.EngineConfig.Model
 	}

+	// Add custom environment variables from engine config.
+	// This allows users to override the default engine token expression (e.g.
+	// GEMINI_API_KEY: ${{ secrets.MY_ORG_GEMINI_KEY }}) via engine.env.
+	if workflowData.EngineConfig != nil && len(workflowData.EngineConfig.Env) > 0 {
+		maps.Copy(env, workflowData.EngineConfig.Env)
+	}


The comment above the GEMINI model env var says it’s only set when explicitly configured and otherwise the CLI default is used. With the new engine.env passthrough (maps.Copy(env, workflowData.EngineConfig.Env)), users can now set/override GEMINI_MODEL via engine.env even when EngineConfig.Model is empty, so the comment is no longer accurate. Please update the comment to reflect the new precedence/behavior (e.g., EngineConfig.Model sets it when provided, but engine.env can also set/override it).

When engine.env values are specified as multi-line YAML block scalars (e.g. >- with extra-indented continuation lines), goccy/go-yaml parses them into strings with embedded newlines. Previously the two emission sites (FormatStepWithCommandAndEnv and GenerateMultiSecretValidationStep) would place such values on a single line, producing invalid compiled YAML. This commit adds appendEnvVarLine, a shared helper that: - Trims trailing newlines (present from | block scalars) - Emits single-line values inline using yamlStringValue - Emits multi-line values as YAML literal block scalars (|) New tests illustrate the five-PAT precedence-chain case from the problem statement and verify both the block-scalar emission and the trailing- newline stripping. See PR github#18017 where engine.env support was added but the multi-line scenario was missed. Agent-Logs-Url: https://github.com/jeffhandley/gh-aw/sessions/9ba51e1e-6e5a-4ea3-ae01-671cc2efbf33 Co-authored-by: jeffhandley <1031940+jeffhandley@users.noreply.github.com>

…uilt-in jobs - Add `findNeedsJobRefs` helper to extract `needs.<job>.*` references from content - Add `buildEngineEnvContent` to concatenate engine.env values for scanning - Add `warnAboutExcludedBuiltinJobRefs` to emit compile warnings when built-in jobs excluded from the agent needs list are referenced in any scanning location - Extend `buildMainJob` to scan `engine.env` values and add referenced custom jobs to the agent job's `needs` list (mirrors existing markdown/custom-steps scanning) - `pre_activation` is intentionally excluded from agent needs for security reasons; a specific warning with github#18017 link is emitted when it is referenced - Other excluded built-in jobs (detection, safe_outputs, etc.) also produce warnings - Add comprehensive tests in `engine_env_needs_test.go` - Update `docs/reference/triggers.md` and `docs/reference/engines.md` with clarifying notes about pre_activation output availability and engine.env usage patterns Closes github#18017 Agent-Logs-Url: https://github.com/jeffhandley/gh-aw/sessions/1111c97d-248a-43d6-83e3-bc4863e1562c Co-authored-by: jeffhandley <1031940+jeffhandley@users.noreply.github.com>

Initial plan

cede82c

Copilot AI assigned Copilot and pelikhan Feb 24, 2026

Copilot started work on behalf of pelikhan February 24, 2026 01:09 View session

Copilot started work on behalf of pelikhan February 24, 2026 01:14 View session

github-actions Bot mentioned this pull request Feb 24, 2026

Smoke Test: Copilot - 22332244776 #18023

Closed

fix: automatically override agentic engine token when engine.env is p…

8eebdad

…rovided in Gemini engine Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 24, 2026 01:23

Copilot AI requested a review from pelikhan February 24, 2026 01:23

Copilot finished work on behalf of pelikhan February 24, 2026 01:23

Copilot started work on behalf of pelikhan February 24, 2026 01:24 View session

github-actions Bot mentioned this pull request Feb 24, 2026

[Contribution Check Report] Contribution Check — 2026-02-24 #18027

Closed

Copilot finished work on behalf of pelikhan February 24, 2026 01:32

Copilot started work on behalf of pelikhan February 24, 2026 01:40 View session

Copilot finished work on behalf of pelikhan February 24, 2026 01:48

Copilot started work on behalf of pelikhan February 24, 2026 01:48 View session

test: add engine.env token override tests for Copilot, Claude, and Co…

65478c4

…dex engines Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update agentic engine token handling to use user-provided secrets~~ Update agentic engine token handling to use user-provided secrets Feb 24, 2026

Copilot finished work on behalf of pelikhan February 24, 2026 01:55

Copilot started work on behalf of pelikhan February 24, 2026 02:09 View session

fix: propagate engine.env overrides to secret validation step

133f576

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 24, 2026 02:18

pelikhan marked this pull request as ready for review February 24, 2026 02:21

Copilot AI review requested due to automatic review settings February 24, 2026 02:21

Copilot started reviewing on behalf of pelikhan February 24, 2026 02:21 View session

Copilot AI reviewed Feb 24, 2026

View reviewed changes

pelikhan merged commit 7d5cc39 into main Feb 24, 2026
120 checks passed

pelikhan deleted the copilot/update-agentic-engine-token branch February 24, 2026 02:29

pelikhan mentioned this pull request Feb 24, 2026

Fix support for custom named COPILOT_GITHUB_TOKEN secret #17982

Closed

github-actions Bot mentioned this pull request Feb 24, 2026

Smoke Test: Claude - 22334678781 #18034

Closed

This was referenced May 4, 2026

Fix multi-line engine.env values producing invalid compiled YAML jeffhandley/gh-aw#1

Closed

feat: scan engine.env expressions for agent needs; warn on excluded built-in job refs jeffhandley/gh-aw#2

Closed

jeffhandley mentioned this pull request May 4, 2026

Multi-line expressions unsupported in engine.env values #30204

Closed

Copilot AI mentioned this pull request May 5, 2026

fix: handle multi-line engine.env values as YAML literal block scalars #30240

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update agentic engine token handling to use user-provided secrets - #18017

Update agentic engine token handling to use user-provided secrets#18017
pelikhan merged 4 commits into
mainfrom
copilot/update-agentic-engine-token

Copilot AI commented Feb 24, 2026 •

edited

Loading

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

Copilot AI commented Feb 24, 2026

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

Copilot AI commented Feb 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes Made

Example

Testing

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

Copilot AI commented Feb 24, 2026

Uh oh!

pelikhan commented Feb 24, 2026

Uh oh!

Copilot AI commented Feb 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 24, 2026 •

edited

Loading