diff --git a/workshop/images/06-03b-token-precedence-dark.svg b/workshop/images/06-03b-token-precedence-dark.svg new file mode 100644 index 00000000..b10185ae --- /dev/null +++ b/workshop/images/06-03b-token-precedence-dark.svg @@ -0,0 +1,62 @@ + + + + + Which Credential Does the Engine Use? + A workflow permission decides the answer before the secret is ever checked + + + + + + + + + + + + + Workflow run starts + Engine needs Copilot access + + 1 + + + + + + + copilot-requests: write + present in frontmatter? + + 2 + + + + YES + + + Built-in inference used + Engine authenticates with the + workflow's own permission + COPILOT_GITHUB_TOKEN + ignored, even if set + + + + NO + + + Secret is read + Engine looks for the repository + secret + COPILOT_GITHUB_TOKEN + provides personal billing + + Remove copilot-requests: write before storing COPILOT_GITHUB_TOKEN, or the secret is silently ignored. + + diff --git a/workshop/images/06-03b-token-precedence-light.svg b/workshop/images/06-03b-token-precedence-light.svg new file mode 100644 index 00000000..52ac980a --- /dev/null +++ b/workshop/images/06-03b-token-precedence-light.svg @@ -0,0 +1,62 @@ + + + + + Which Credential Does the Engine Use? + A workflow permission decides the answer before the secret is ever checked + + + + + + + + + + + + + Workflow run starts + Engine needs Copilot access + + 1 + + + + + + + copilot-requests: write + present in frontmatter? + + 2 + + + + YES + + + Built-in inference used + Engine authenticates with the + workflow's own permission + COPILOT_GITHUB_TOKEN + ignored, even if set + + + + NO + + + Secret is read + Engine looks for the repository + secret + COPILOT_GITHUB_TOKEN + provides personal billing + + Remove copilot-requests: write before storing COPILOT_GITHUB_TOKEN, or the secret is silently ignored. + + diff --git a/workshop/side-quest-06-03b-copilot-github-token.md b/workshop/side-quest-06-03b-copilot-github-token.md index e63c9433..fda4b1c6 100644 --- a/workshop/side-quest-06-03b-copilot-github-token.md +++ b/workshop/side-quest-06-03b-copilot-github-token.md @@ -8,6 +8,14 @@ This method stores a [Personal Access Token](https://github.github.com/gh-aw/ref If you want an all-UI path with no terminal commands, use [Method 2 (UI-only)](side-quest-06-03c-copilot-github-token-ui-only.md). +The engine checks one workflow permission before it ever looks at the secret: + + + + + Token precedence decision: when a workflow's copilot-requests write permission is present, the engine uses built-in inference and ignores the COPILOT_GITHUB_TOKEN secret; when that permission is absent, the engine reads the secret instead + + ## :clipboard: Before You Start - You have a GitHub account with an active Copilot subscription.