eresearchqut / ddb-repository / 27924320454

98%

push

github

fix: switch Repo Assist to token-free Copilot auth and upgrade gh-aw

The Repo Assist workflow authenticated Copilot inference via the
COPILOT_GITHUB_TOKEN secret, a fine-grained PAT. That PAT expired
(~30 days after its Apr 24 update), causing "Authentication failed /
No authentication information found" on every run since May 24 (#60).

Switch to the recommended token-free model so this can't recur:

- repo-assist.md: replace `permissions: read-all` with explicit read
  scopes plus `copilot-requests: write`, so inference uses the per-run
  GitHub Actions token (billed via the org Copilot subscription) instead
  of a PAT. COPILOT_GITHUB_TOKEN is no longer used for inference.
- Upgrade the gh-aw toolchain v0.68.3 -> v0.79.8 (required for the
  `copilot-requests` permission) and recompile, regenerating
  repo-assist.lock.yml and pinning github/gh-aw-actions @ v0.79.8 in
  actions-lock.json. The new engine no longer uses copilot_driver.cjs.
- Add the generated companion workflow agentics-maintenance.yml.
- repo-assist.md: rename deprecated `title-prefix` ->
  `required-title-prefix` under push-to-pull-request-branch.
- dependabot.yml: keep ignoring github/gh-aw-actions* (now also managed
  natively by gh aw compile) so Dependabot can't corrupt the lock file.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

205 of 219 branches covered (93.61%)

Branch coverage included in aggregate %.

344 of 344 relevant lines covered (100.0%)

91.79 hits per line