[bug-hunter] quick-setup piped install fails to set token when stdin is non-interactive

[github-actions]

Impact

The documented quick-start command uses a pipe (curl ... | bash -s --) and says it sets COPILOT_GITHUB_TOKEN by default. In that execution mode, scripts/quick-setup.sh exits with an error before setting the secret unless users already know to pre-set the env var or pass --skip-secret. This breaks first-run onboarding in the default path.

Reproduction Steps

1. Create and run this new minimal harness script:

#!/usr/bin/env bash
set -euo pipefail

ROOT="/home/runner/work/ai-github-actions/ai-github-actions"
TMPBASE="/tmp/gh-aw/agent/repro-quick-setup"
rm -rf "$TMPBASE"
mkdir -p "$TMPBASE/fakebin" "$TMPBASE/remote.git" "$TMPBASE/work"

cat > "$TMPBASE/fakebin/gh" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
if [[ "$*" == auth\ status* ]]; then exit 0; fi
if [[ "$*" == repo\ view* && "$*" == *"--json nameWithOwner"* ]]; then echo "example-org/example-repo"; exit 0; fi
if [[ "$*" == repo\ view* && "$*" == *"--json defaultBranchRef"* ]]; then echo "main"; exit 0; fi
if [[ "$*" == secret\ set* ]]; then exit 0; fi
if [[ "$*" == pr\ create* ]]; then exit 0; fi
echo "unexpected gh invocation: $*" >&2
exit 2
EOF
chmod +x "$TMPBASE/fakebin/gh"

cat > "$TMPBASE/fakebin/curl" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
out=""
while [ $# -gt 0 ]; do
  case "$1" in
    -o) out="$2"; shift 2 ;;
    *) shift ;;
  esac
done
if [ -n "$out" ]; then
  mkdir -p "$(dirname "$out")"
  printf 'name: stub\n' > "$out"
fi
EOF
chmod +x "$TMPBASE/fakebin/curl"

git init --bare "$TMPBASE/remote.git" >/dev/null
cd "$TMPBASE/work"
git init -b main >/dev/null
git config user.email "repro@example.com"
git config user.name "Repro"
printf "seed\n" > README.md
git add README.md
git commit -m "seed" >/dev/null
git remote add origin "$TMPBASE/remote.git"
git push -u origin main >/dev/null

set +e
OUT=$(printf '' | PATH="$TMPBASE/fakebin:$PATH" COPILOT_GITHUB_TOKEN='' bash "$ROOT/scripts/quick-setup.sh" --repo example-org/example-repo 2>&1)
STATUS=$?
set -e

printf 'exit_status=%s\n' "$STATUS"
printf '%s\n' "$OUT"

2. Execute it: bash /path/to/repro.sh

Expected vs Actual

Expected: In the documented piped setup flow, quick setup should still allow token entry (or otherwise complete the default setup path without hard-failing at token acquisition).

Actual: The script exits non-zero before secret setup:

exit_status=1
Switched to a new branch 'ai-gh-aw-setup'
branch 'ai-gh-aw-setup' set up to track 'origin/main'.
COPILOT_GITHUB_TOKEN is not set, and stdin is not a terminal.
Set COPILOT_GITHUB_TOKEN in your environment, or use --skip-secret.

Failing Test

Use the harness script above as a minimal failing test. It deterministically reproduces the bug by executing quick-setup with piped stdin (printf '' | ...) and no token env var.

Evidence

• README.md lines 32-39 document piped quick setup and state default behavior includes setting COPILOT_GITHUB_TOKEN.
• scripts/quick-setup.sh lines 216-243 gate token prompting behind elif [ -t 0 ]; in piped execution, this condition is false, and the script exits with error.
• Local reproduction output above shows deterministic exit 1 on this code path.
• I also checked for overlap: no open issue matched this bug; merged PR search did not show a merged fix for this code path.

Note

🔒 Integrity filter blocked 4 items

The following items were blocked because they don't meet the GitHub integrity level.

• #659 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #687 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #312 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #703 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Trigger Bug Hunter

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Jun 5, 2026, 12:29 PM UTC

[github-actions]

This issue was automatically closed because it expired on 2026-06-05T12:29:48.846Z.

Closed by Workflow