Skip to content

Add PATs rotation to agentic workflow(s)#13496

Merged
JanKrivanek merged 4 commits into
mainfrom
dev/jankrivanek/add-pats-rotation
Apr 8, 2026
Merged

Add PATs rotation to agentic workflow(s)#13496
JanKrivanek merged 4 commits into
mainfrom
dev/jankrivanek/add-pats-rotation

Conversation

@JanKrivanek

@JanKrivanek JanKrivanek commented Apr 7, 2026

Copy link
Copy Markdown
Member

Context

Using a single PAT shared across all agentic workflows can lead to rate-limiting. This PR introduces a PAT-rotation mechanism to randomly select from a pool of Copilot PAT secrets.

Changes Made

Testing

  • Verified that the compiled workflow correctly references COPILOT_GITHUB_TOKEN and COPILOT_GITHUB_TOKEN_1 through COPILOT_GITHUB_TOKEN_9 in both the select-copilot-pat step env bindings and the case(...) expression

Notes

The PAT pool uses COPILOT_GITHUB_TOKEN as the base secret (index 0) and COPILOT_GITHUB_TOKEN_1 through COPILOT_GITHUB_TOKEN_9 for additional pool entries. This is a stop-gap workaround until organization/enterprise billing is offered for agentic workflows.

Regenerate lock files with the new compiler version.
No functional changes.
Copy the select-copilot-pat composite action from dotnet/skills.
This selects a random Copilot PAT from a numbered pool of secrets
to distribute API load across multiple PATs.

This is a stop-gap until organization-level billing is available
for Agentic Workflows. See .github/actions/select-copilot-pat/README.md.
Use the select-copilot-pat action to randomly select from a pool of
COPILOT_GITHUB_TOKEN / COPILOT_GITHUB_TOKEN_1..9 secrets, distributing
Copilot API load across multiple PATs.

Currently only COPILOT_GITHUB_TOKEN is configured; additional secrets
can be added as COPILOT_GITHUB_TOKEN_1 through COPILOT_GITHUB_TOKEN_9.
@JanKrivanek JanKrivanek requested a review from a team as a code owner April 7, 2026 10:38
Copilot AI review requested due to automatic review settings April 7, 2026 10:38
@JanKrivanek JanKrivanek enabled auto-merge April 7, 2026 10:38

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s agentic “Close Stale Pull Requests” workflow by recompiling it with gh-aw v0.67.1 and introducing a PAT-rotation mechanism (randomly selecting from a pool of Copilot PAT secrets) via a new reusable composite action.

Changes:

  • Add a reusable composite action (.github/actions/select-copilot-pat) to randomly select a Copilot PAT from a secret pool.
  • Wire the selected PAT into the agentic workflow via pre_activation outputs + an engine.env case(...) override of COPILOT_GITHUB_TOKEN.
  • Recompile the generated workflow lock file with gh-aw v0.67.1 (large regenerated diff).
Show a summary per file
File Description
.github/workflows/close-stale-prs.agent.md Adds pre-activation steps and engine env override to rotate Copilot PAT usage.
.github/workflows/close-stale-prs.agent.lock.yml Regenerated compiled workflow output (includes PAT selection wiring and other compiler-output changes).
.github/aw/actions-lock.json Adds github/gh-aw-actions/[email protected] pin for the new compiler version.
.github/actions/select-copilot-pat/README.md Documents how to onboard and configure the PAT pool + workflow wiring.
.github/actions/select-copilot-pat/action.yml Implements the composite action that selects a non-empty secret index (0–9) and outputs it.

Copilot's findings

  • Files reviewed: 5/5 changed files
  • Comments generated: 4

Comment thread .github/actions/select-copilot-pat/README.md
Comment thread .github/workflows/close-stale-prs.agent.lock.yml
Comment thread .github/workflows/close-stale-prs.agent.lock.yml
Comment thread .github/actions/select-copilot-pat/action.yml
auto-merge was automatically disabled April 7, 2026 10:47

Head branch was pushed to by a user without write access

@JanKrivanek JanKrivanek enabled auto-merge April 7, 2026 11:00
@JanKrivanek

Copy link
Copy Markdown
Member Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

github-actions Bot pushed a commit to IntelliTect/Multitool that referenced this pull request Jun 29, 2026
Updated [Microsoft.Build](https://github.com/dotnet/msbuild) from 18.6.3
to 18.7.1.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Build's
releases](https://github.com/dotnet/msbuild/releases)._

## 18.7.1

## What's Changed
* Fix TraceEngine file contention deadlock in multithreaded mode by
@​JanProvaznik in dotnet/msbuild#13446
* Remove duplicate test cases in MultithreadableTaskAnalyzer by
@​Youssef1313 in dotnet/msbuild#13483
* Ensure ThreadSafeTaskAnalyzer.Tests is considered as a unit test
project by @​Youssef1313 in dotnet/msbuild#13481
* Fix MSBuildTask0002 analyzer warnings in already-migrated tasks by
@​JanProvaznik in dotnet/msbuild#13466
* Fix race conditions in task host path resolution by @​AR-May in
dotnet/msbuild#13485
* Migrate ToolTask and Al task to TaskEnvironment API by @​OvesN in
dotnet/msbuild#13423
* Bump main to 18.7, add vs18.6 to merge flow by @​MichalPavlik in
dotnet/msbuild#13472
* Avoid allocations in GetHashCode implementations by @​DustinCampbell
in dotnet/msbuild#13475
* Add PATs rotation to agentic workflow(s) by @​JanKrivanek in
dotnet/msbuild#13496
* Fix ASP.NET WebSite projects to copy netstandard.dll facade when
required by @​JanProvaznik in
dotnet/msbuild#13058
* Migrate AspNetCompiler to TaskEnvironment API by @​OvesN in
dotnet/msbuild#13424
* Add review workflow by @​JanKrivanek in
dotnet/msbuild#13503
* Strengthen reviewer skill: add step-back analysis dimensions by
@​JanProvaznik in dotnet/msbuild#13504
* Add 'Request Speedometer Perf Run' to VS experimental insertion build
policies by @​Copilot in dotnet/msbuild#13505
* Remove duplicate @ prefix from issueAuthor in GitOps by @​akoeplinger
in dotnet/msbuild#13492
* Improve review aw by @​JanKrivanek in
dotnet/msbuild#13510
* Migrates unit tests to use RoslynCodeTaskFactory to enable running
tests under .NET Core by @​jankratochvilcz in
dotnet/msbuild#13500
* Fix cross-AppDomain TaskItem modifier cache regression by
@​DustinCampbell in dotnet/msbuild#13493
* Discourage review agent from approving PRs by @​JanKrivanek in
dotnet/msbuild#13512
* Stop trying to deploy ValueTuple by @​rainersigwald in
dotnet/msbuild#13507
* Ad-hoc re-sign bootstrap dotnet on macOS to prevent SIGKILL by
@​jankratochvilcz in dotnet/msbuild#13513
* RoslynCodeTaskFactory: Log MSB3753 when task class does not implement
ITask by @​jankratochvilcz in
dotnet/msbuild#13517
* Update gh-aw (upon mcp policy changes) by @​JanKrivanek in
dotnet/msbuild#13526
* Eliminate XmlChildNodes allocations in GetXmlNodeInnerContents by
@​nareshjo in dotnet/msbuild#13509
* Fix telemetry allocation regression: per-engine collector ownership by
@​JanProvaznik in dotnet/msbuild#13516
* Migrate to xunit.v3 by @​Youssef1313 in
dotnet/msbuild#13482
* Fix stray brace in HandleBuildCancel trace string causing MSB1025 by
@​Copilot in dotnet/msbuild#13535
* Bumping to 10.0.4 runtime packages by @​MichalPavlik in
dotnet/msbuild#13533
* Remove early return in GetCanonicalForm, always call System.IO.Path by
@​OvesN in dotnet/msbuild#13532
* Do not overwrite GetCopyToOutputDirectoryItemsDependsOn, just add new…
by @​snechaev in dotnet/msbuild#13474
* Migrate GetReferenceAssemblyPaths task to TaskEnvironment API by
@​OvesN in dotnet/msbuild#13495
* Stabilize ToolTaskThatTimeoutAndRetry test by @​rainersigwald in
dotnet/msbuild#13489
* [automated] Merge branch 'vs18.6' => 'main' by @​github-actions[bot]
in dotnet/msbuild#13506
* Add extra test assertions around tests by @​Youssef1313 in
dotnet/msbuild#13536
* Add static eval for repo skills/agents via skill-validator by
@​JanKrivanek in dotnet/msbuild#13537
* Migrate SGen task to Task environment API by @​OvesN in
dotnet/msbuild#13457
* Fix TerminalLogger assert failure for metaproj files and cached
project eval ID by @​OvesN in
dotnet/msbuild#13480
* Filter out approving review from pr-reviewer agent by @​JanKrivanek in
dotnet/msbuild#13553
* Use a unique task name per invocation to tabilize
RoslynCodeTaskFactory_ReuseCompilation test by @​huulinhnguyen-dev in
dotnet/msbuild#13551
* Brief doc on feedback/logging/data systems by @​rainersigwald in
dotnet/msbuild#13554
* Localized file check-in by OneLocBuild Task: Build definition ID 9434:
Build ID 13881982 by @​dotnet-bot in
dotnet/msbuild#13437
* Stage 3: Forward BuildProjectFile* callbacks from OOP TaskHost to
worker node by @​JanProvaznik in
dotnet/msbuild#13350
* Enable TaskHost Callbacks by default by @​JanProvaznik in
dotnet/msbuild#13579
* Remove unactionable info from reviewer agent by @​JanKrivanek in
dotnet/msbuild#13578
* Enlighten RequiresFramework35SP1Assembly task for multithreaded mode
by @​jankratochvilcz in dotnet/msbuild#13575
* Make SdkResolver-provided environment variables take precedence over
ambient environment by @​Copilot in
dotnet/msbuild#12655
* Add dotnet/skills marketplace and enable plugins by @​Evangelink in
dotnet/msbuild#13582
* The skills/agents check filters-in only touched files by @​JanKrivanek
in dotnet/msbuild#13586
* Fix skill-validation workflow failing when agents directory is deleted
by @​JeremyKuhne in dotnet/msbuild#13592
 ... (truncated)

Commits viewable in [compare
view](dotnet/msbuild@v18.6.3...v18.7.1).
</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Jun 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants