Python: Fix Actions token environment

[moonbox3]

Motivation & Context

Copilot integration and sample-validation jobs grant copilot-requests: write, but exposed the built-in Actions token through a user-token environment variable. Copilot CLI interpreted that value as a PAT-style credential and attempted a user lookup, which could fail with 401: Bad credentials instead of using organization-billed Actions authentication.

This change removes the user-token environment dependency from these workflows and integration-test guards.

Description & Review Guide

• What are the major changes? Pass the built-in workflow token through the native GITHUB_TOKEN variable in the Python, .NET, merge, and sample-validation Copilot jobs. In GitHub Actions, integration tests run only when GITHUB_ACTIONS=true and GITHUB_TOKEN is available. Local integration tests require RUN_COPILOT_INTEGRATION_TESTS=true and use the developer’s stored Copilot device login.
• What is the impact of these changes? Copilot tests use the supported organization-billed Actions authentication path. Local tests remain explicitly opt-in without requiring a separate user-token environment variable.
• What do you want reviewers to focus on? Confirm the Actions authentication-variable semantics and that the explicit local opt-in correctly avoids accidental costly integration-test runs.

Related Issue

Fixes #7425

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 50% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by moonbox3's agents

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	46032	4478	90%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9523	34 💤	0 ❌	0 🔥	2m 28s ⏱️

[Copilot]

Pull request overview

This PR updates Copilot integration and sample-validation workflows to use the GitHub Actions token via the standard GITHUB_TOKEN environment variable (instead of COPILOT_GITHUB_TOKEN), and adjusts Python/.NET integration-test gating to allow Actions auth while preserving local user-token runs.

Changes:

• Switched Copilot workflows to pass the built-in Actions token via GITHUB_TOKEN.
• Updated Python and .NET integration-test guards to recognize either COPILOT_GITHUB_TOKEN (local) or GITHUB_TOKEN (Actions).
• Added a small Python unit test validating the integration-test enablement guard.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/packages/github_copilot/tests/test_github_copilot_agent.py	Updates integration-test enablement guard and adds a small test for it.
dotnet/tests/Microsoft.Agents.AI.GitHub.Copilot.IntegrationTests/GitHubCopilotAgentTests.cs	Expands skip guard to allow Actions auth as well as local user-token.
.github/workflows/python-sample-validation.yml	Uses GITHUB_TOKEN for Copilot sample validation job auth.
.github/workflows/python-merge-tests.yml	Uses GITHUB_TOKEN for Copilot integration job auth.
.github/workflows/python-integration-tests.yml	Uses GITHUB_TOKEN for Copilot integration job auth.
.github/workflows/dotnet-integration-tests.yml	Uses GITHUB_TOKEN for .NET Copilot integration test auth.

Comments suppressed due to low confidence (1)

python/packages/github_copilot/tests/test_github_copilot_agent.py:3509

• If GITHUB_TOKEN is only considered valid in GitHub Actions (recommended to avoid accidental local runs), the skip reason should reflect that GITHUB_TOKEN only enables tests when running under Actions.

skip_if_copilot_integration_tests_disabled = pytest.mark.skipif(
    not _copilot_integration_configured(),
    reason="No COPILOT_GITHUB_TOKEN or GITHUB_TOKEN provided; skipping integration tests.",
)

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 52%

✓ Correctness

The Actions-token change is correct, but both integration-test guards regress local runs: COPILOT_GITHUB_TOKEN is no longer recognized despite the PR’s stated compatibility goal.

✓ Security Reliability

I was unable to complete this review: every tool invocation in this session (bash, grep, glob, view) failed with a permission error, so I could not perform the required read-only context pass over the repo (e.g., verifying how the Python/.NET GitHub Copilot packages resolve their auth token, whether COPILOT_GITHUB_TOKEN is still referenced elsewhere such as docs/README/other workflows, or how the workflow steps consume the job-level GITHUB_TOKEN). Per the evidence rules, I am not emitting any findings that I could not verify against source. From the diff alone the change is internally consistent: the four workflows swap COPILOT_GITHUB_TOKEN for GITHUB_TOKEN with ${{ github.token }} (no new secret exposure, no new permissions), and the Python/.NET guards gate on GITHUB_ACTIONS=true plus a non-empty GITHUB_TOKEN, or an explicit RUN_COPILOT_INTEGRATION_TESTS=true opt-in, which matches the assertions in test_copilot_integration_configured. The previously raised concern about a bare GITHUB_TOKEN enabling integration tests outside Actions appears addressed by the GITHUB_ACTIONS=true conjunct. A maintainer should independently confirm that no remaining code, docs, or workflow still depends on COPILOT_GITHUB_TOKEN, since I could not grep for it.

✓ Test Coverage

No actionable test-coverage issues found. The Python tests meaningfully cover the authentication decision matrix, including incomplete Actions configuration and explicit local opt-in.

✓ Failure Modes

I was unable to complete this review: every tool invocation in this session (bash, grep, glob, view) failed with an environment permission error, so I could not open the repository to verify how the Copilot CLI/agent actually consumes the token env var (e.g. whether the Python github_copilot package or the .NET GitHubCopilotAgent reads COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN), nor confirm the workflow context around the changed env blocks. Per the evidence rules, I am omitting all findings rather than reporting unverified suspicions. The diff on its face is a small, internally consistent change: workflows now export the built-in token as GITHUB_TOKEN, and both the Python and .NET guards gate integration tests on (GITHUB_ACTIONS=true AND GITHUB_TOKEN) or an explicit RUN_COPILOT_INTEGRATION_TESTS=true opt-in, which matches the assertions in the parametrized test added at python/packages/github_copilot/tests/test_github_copilot_agent.py. No blocking issues are raised; a reviewer with working repo access should confirm that the Copilot SDK/CLI path invoked by these integration tests actually authenticates from GITHUB_TOKEN, since if it still requires COPILOT_GITHUB_TOKEN the guards would now enable tests in CI that cannot authenticate.

✓ Design Approach

All read-only investigation tools (bash, grep, glob, view) were denied in this session, so I could not perform the required context pass over the github_copilot package, the Copilot CLI invocation path, or the workflow files beyond the diff text itself. Per the evidence discipline rules, I am not emitting design findings that I could not verify against actual source (e.g., whether any production code still reads COPILOT_GITHUB_TOKEN, or whether the CLI resolves GITHUB_TOKEN for Actions-billed auth). The diff as presented is internally consistent: the workflow env-var rename lines up with the new guards, and the parametrized test in the diff authoritatively specifies the GITHUB_ACTIONS+GITHUB_TOKEN / RUN_COPILOT_INTEGRATION_TESTS semantics, which the .NET guard mirrors. No blocking issues reported.

---

Automated review by moonbox3's agents