diff --git a/workshop/images/side-quest-06-03c-token-secret-flow-dark.svg b/workshop/images/side-quest-06-03c-token-secret-flow-dark.svg new file mode 100644 index 00000000..705ce78e --- /dev/null +++ b/workshop/images/side-quest-06-03c-token-secret-flow-dark.svg @@ -0,0 +1,125 @@ + + + + + + + + + + + + From PAT to Workflow Authentication + A fine-grained token becomes a secret your workflow reads automatically at run time. + + + + + + + + + + + Generate PAT + Fine-grained token + Copilot requests: read + + + + 1 + + + + copy + + + + + + + + + Store as Secret + COPILOT_GITHUB_TOKEN + Settings → Secrets → Actions + + + + 2 + + + + run + + + + + + + + Workflow Run + Reads secret automatically + no copilot-requests: write + + + + 3 + + + + authenticate + + + + + + + + Copilot API + Personal billing + AI reasoning steps + + + + 4 + + + + Token Expiry + Default 90 days — set a reminder + to rotate before it expires + + + + + Steps 1–2 happen once in the GitHub UI. Steps 3–4 repeat automatically on every workflow run. + + diff --git a/workshop/images/side-quest-06-03c-token-secret-flow-light.svg b/workshop/images/side-quest-06-03c-token-secret-flow-light.svg new file mode 100644 index 00000000..b94a8f6e --- /dev/null +++ b/workshop/images/side-quest-06-03c-token-secret-flow-light.svg @@ -0,0 +1,125 @@ + + + + + + + + + + + + From PAT to Workflow Authentication + A fine-grained token becomes a secret your workflow reads automatically at run time. + + + + + + + + + + + Generate PAT + Fine-grained token + Copilot requests: read + + + + 1 + + + + copy + + + + + + + + + Store as Secret + COPILOT_GITHUB_TOKEN + Settings → Secrets → Actions + + + + 2 + + + + run + + + + + + + + Workflow Run + Reads secret automatically + no copilot-requests: write + + + + 3 + + + + authenticate + + + + + + + + Copilot API + Personal billing + AI reasoning steps + + + + 4 + + + + Token Expiry + Default 90 days — set a reminder + to rotate before it expires + + + + + Steps 1–2 happen once in the GitHub UI. Steps 3–4 repeat automatically on every workflow run. + + diff --git a/workshop/side-quest-06-03c-copilot-github-token-ui-only.md b/workshop/side-quest-06-03c-copilot-github-token-ui-only.md index 4e246df1..49889154 100644 --- a/workshop/side-quest-06-03c-copilot-github-token-ui-only.md +++ b/workshop/side-quest-06-03c-copilot-github-token-ui-only.md @@ -6,6 +6,14 @@ This method stores a [fine-grained Personal Access Token](https://github.github.com/gh-aw/reference/auth/#copilot-default) (PAT) as a repository secret named `COPILOT_GITHUB_TOKEN`. The [agentic workflow](https://github.github.com/gh-aw/introduction/overview/) [engine](https://github.github.com/gh-aw/reference/engines/) picks it up automatically. +The diagram below shows the full flow: you generate and store the token once, then every workflow run reads it automatically to authenticate to the Copilot API. + + + + + From PAT to workflow authentication: generate a fine-grained token, store it as the COPILOT_GITHUB_TOKEN secret, then every workflow run reads it to authenticate to the Copilot API + + ## :clipboard: Before You Start - You have a GitHub account with an active Copilot subscription.