[gh-aw] disable AI-credit guardrails (max-daily / max-ai)#11659
Merged
jonathanpeppers merged 5 commits intoJun 16, 2026
Merged
Conversation
Adds copilot-requests: write to the permissions block of both agentic workflows so they use the built-in GITHUB_TOKEN for Copilot CLI inference instead of the COPILOT_GITHUB_TOKEN PAT. AI credits now bill directly to the dotnet organization. See: https://github.blog/changelog/2026-06-11-agentic-workflows-no-longer-need-a-personal-access-token/ Also bumps the gh-aw CLI from v0.79.6 -> v0.79.8 (recommended in the changelog), which regenerates agentics-maintenance.yml and the lock files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repo’s gh-aw agentic workflows to use the new authentication model where Copilot CLI inference is performed using the built-in GITHUB_TOKEN (with copilot-requests: write) instead of a stored PAT secret, and regenerates the compiled/locked workflows with the newer gh-aw CLI.
Changes:
- Added
copilot-requests: writeto workflow/job permissions in the source workflow.mdfiles and in the generated lock workflows. - Regenerated lock workflows so
COPILOT_GITHUB_TOKENis sourced from${{ github.token }}(and removed theCOPILOT_GITHUB_TOKENsecret dependency). - Bumped gh-aw action/CLI pins from
v0.79.6tov0.79.8(including the generated maintenance workflow).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/android-reviewer.md | Adds copilot-requests: write permission to support Copilot inference via GITHUB_TOKEN. |
| .github/workflows/android-reviewer.lock.yml | Regenerated lock: uses ${{ github.token }} for COPILOT_GITHUB_TOKEN, updates gh-aw pins, and propagates permissions changes. |
| .github/workflows/nightly-fix-finder.md | Adds copilot-requests: write permission to support Copilot inference via GITHUB_TOKEN. |
| .github/workflows/nightly-fix-finder.lock.yml | Regenerated lock: uses ${{ github.token }} for COPILOT_GITHUB_TOKEN, updates gh-aw pins, and propagates permissions/guardrail output renames. |
| .github/workflows/agentics-maintenance.yml | Regenerated maintenance workflow with updated gh-aw pins/version banner. |
jonathanpeppers
added
the
ready-to-review
simonrozsival
approved these changes
Jun 16, 2026
Adds max-daily-ai-credits: -1 and max-ai-credits: -1 to both agentic workflow markdown files, matching dotnet/java-interop#1471. This disables the daily and per-run AIC guardrails for these workflows. Also picks up .github/aw/actions-lock.json (v0.79.6 -> v0.79.8) which was missed in the previous commit on this branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Matches dotnet/java-interop#1472. Setting max-ai-credits: -1 disables enforcement *and token steering*, which causes the AWF api-proxy to return HTTP 403 when injecting Copilot provider credentials. 100M leaves token steering on while keeping per-run cost effectively uncapped. max-daily-ai-credits: -1 is left as-is — that flag's -1 only toggles the daily guardrail and doesn't touch token steering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Matches dotnet/java-interop#1473. The "GITHUB_TOKEN-billed-to-org" feature requires the "Allow use of Copilot CLI billed to the organization" Copilot policy to be enabled at the org level, and the dotnet org has not enabled it yet — so without that policy the workflows fail with HTTP 403 from api.githubcopilot.com/models. This commit removes copilot-requests: write from both agentic workflow markdown files and regenerates the lock files. COPILOT_GITHUB_TOKEN: secrets.COPILOT_GITHUB_TOKEN is restored, SECRET_COPILOT_GITHUB_TOKEN is re-added to the redaction step, and the gh-aw v0.79.8 + max-ai-credits/max-daily-ai-credits changes from earlier commits on this branch are intentionally retained. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jonathanpeppers
changed the title
Matches the latest force-push on dotnet/java-interop#1473. The 100M cap from dotnet#1472 was only needed when running on the GITHUB_TOKEN-billed-to-org flow, where the AWF api-proxy required token steering to inject Copilot provider credentials. Now that this branch reverts to the PAT-based flow (secrets.COPILOT_GITHUB_TOKEN), token steering is no longer in the path, so -1 is safe and matches dotnet#1471's original intent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jonathanpeppers
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Disables the AI-credit guardrails for both agentic workflows. Two-line frontmatter delta per workflow:
Applied to:
.github/workflows/android-reviewer.md.github/workflows/nightly-fix-finder.mdgh aw compilethen regenerates the*.lock.ymlfiles,.github/aw/actions-lock.json, and.github/workflows/agentics-maintenance.yml(the latter two also pick up a routinegh-awCLI bump fromv0.79.6→v0.79.8).Mirrors dotnet/java-interop#1471 + #1473.
Verification
git diff origin/main...HEAD --stat:The only hand-authored change is the four added lines above. Everything else is mechanical output of
gh aw compile.