fix: add Copilot CLI auth error handling to pipeline - #8
Merged
Conversation
The Copilot CLI exits with code 1 and zero output when the token lacks Copilot API scope. This makes failures cryptic in Actions logs. Changes: - Capture copilot exit code and display actionable error message - Direct users to create a Fine-Grained PAT with Copilot Requests scope - Update auth comments to clarify COPILOT_TOKEN is required (not optional) - Apply to all three stages for consistent error handling Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Improves the Modernize Pipeline GitHub Actions workflow to fail with actionable output when the Copilot CLI cannot authenticate (instead of exiting with code 1 and no helpful logs).
Changes:
- Adds explicit Copilot CLI startup logging, captures exit codes, and prints actionable
::error::guidance on failure. - Updates inline auth guidance to clarify that a Fine-Grained PAT in
COPILOT_TOKENis needed for Copilot API scope. - Applies the same error-handling pattern to stages 1–3 (with some inconsistencies noted in comments).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+211
to
+215
| echo "::error::Copilot CLI failed with exit code $COPILOT_EXIT." | ||
| echo "::error::This is most likely an authentication issue — the default GITHUB_TOKEN does not include Copilot API scope." | ||
| echo "::error::FIX: Create a Fine-Grained PAT with 'Copilot Requests: Read' permission" | ||
| echo "::error:: and add it as a COPILOT_TOKEN repo secret (Settings → Secrets and variables → Actions)." | ||
| exit 1 |
There was a problem hiding this comment.
The new error-handling block is not applied consistently across stages: Stage 1 includes a direct PAT-creation URL, but Stage 2 does not. This undermines the “actionable error message” goal and diverges from the PR description (“applied consistently across all 3 pipeline stages”). Consider adding the same "See: https://github.com/settings/personal-access-tokens/new" line here (and keep the wording in sync across stages).
| echo "" | ||
| echo "::error::Copilot CLI failed with exit code $COPILOT_EXIT." | ||
| echo "::error::This is most likely an authentication issue — the default GITHUB_TOKEN does not include Copilot API scope." | ||
| echo "::error::FIX: Create a Fine-Grained PAT with 'Copilot Requests: Read' permission" |
There was a problem hiding this comment.
Same as Stage 2: Stage 1’s handler includes a direct PAT-creation URL but Stage 3’s does not, so the guidance is inconsistent across stages. To keep the pipeline UX consistent, add the missing link (or otherwise unify the message text across all stages).
Suggested change
| echo "::error::FIX: Create a Fine-Grained PAT with 'Copilot Requests: Read' permission" | |
| echo "::error::FIX: Create a Fine-Grained PAT with 'Copilot Requests: Read' permission at https://github.com/settings/personal-access-tokens/new" |
All 6 review comments addressed: - Removed GITHUB_TOKEN fallback from all 3 stages (comments 1-3) - Added preflight check for empty COPILOT_TOKEN in all 3 stages - Added PAT URL to Stage 2 error messages (comment 4) - Added PAT URL to Stage 3 error messages (comment 5) - Quoted $COPILOT_EXIT in all 3 stages (comment 6) All stages now have identical structure for token validation: 1. env block with COPILOT_GITHUB_TOKEN (no fallback) 2. Preflight check for empty token 3. Copilot CLI invocation with set +e/set -e 4. Post-CLI error handler with quoted $COPILOT_EXIT and complete error messages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The repo secret name now matches the env var the Copilot CLI reads, eliminating the confusing COPILOT_TOKEN → COPILOT_GITHUB_TOKEN mapping. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Remove GITHUB_TOKEN fallback, add preflight token validation to all stages - Add PAT URL reference to all error messages for actionable feedback - Quote COPILOT_EXIT variable for robustness - Rename COPILOT_TOKEN env var references to COPILOT_GITHUB_TOKEN for semantic clarity - All three pipeline stages now have consistent auth error handling Addressed all 6 PR #8 review comments. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The modernize pipeline fails with exit code 1 and zero output when the Copilot CLI cannot authenticate. The default
GITHUB_TOKENdoes not include Copilot API scope, making this the expected failure on first run.Fix
bash -esilently exitCOPILOT_TOKENis required (not optional)Required Action
After merging this PR, create a Fine-Grained PAT with
Copilot Requests: Readpermission and add it as aCOPILOT_TOKENrepo secret.