Skip to content

feat(dependency-review): add optional GH_AW_GITHUB_TOKEN for label-triggered downstream workflows #1012

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fr4nc1sc0-r4m0n merged 2 commits into from
Apr 24, 2026
Merged

feat(dependency-review): add optional GH_AW_GITHUB_TOKEN for label-triggered downstream workflows #1012

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ebaba34
Initial plan
Copilot Apr 24, 2026
f0bc87d
feat: add GH_AW_GITHUB_TOKEN ephemeral token support to dependency-re…
Copilot Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions .github/workflows/gh-aw-dependency-review.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions .github/workflows/gh-aw-dependency-review.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,8 @@ on:
secrets:
COPILOT_GITHUB_TOKEN:
required: true
GH_AW_GITHUB_TOKEN:
required: false
roles: [admin, maintainer, write]
bots:
- "${{ inputs.allowed-bot-users }}"
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/trigger-dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,8 @@ jobs:
# allowed-bot-users: "github-actions[bot]"
secrets:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
# Optional: pass an ephemeral token (e.g. a GitHub App token) so that PR labels
# applied by this workflow can trigger downstream label-based workflows.
# When omitted, the built-in GITHUB_TOKEN is used for labeling, which does
# not re-trigger other workflows.
# GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
7 changes: 7 additions & 0 deletions gh-agent-workflows/dependency-review/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,13 @@ See [example.yml](example.yml) for the full workflow file.
| `allowed-bot-users` | Allowed bot actor usernames (comma-separated). For Updatecli, add your repo's updatecli bot actor here (e.g. `github-actions[bot]` or a custom app bot). | No | `github-actions[bot]` |
| `classification-labels` | Comma-separated list of labels the agent may apply (e.g. `needs-human-review,higher-risk,merge-ready`). If empty, no labels are applied. Define label semantics in `additional-instructions`. | No | `""` |

## Secrets

| Secret | Description | Required |
| --- | --- | --- |
| `COPILOT_GITHUB_TOKEN` | GitHub Copilot PAT for AI engine authentication | Yes |
| `GH_AW_GITHUB_TOKEN` | Ephemeral token (e.g. a GitHub App token) used for PR labeling safe outputs. When provided, labels applied by this workflow will trigger downstream label-based workflows. When omitted, the built-in `GITHUB_TOKEN` is used, which does not re-trigger other workflows. | No |

## Safe Outputs

- `add-comment` — post an analysis comment on the PR (max 1)
Expand Down
5 changes: 5 additions & 0 deletions gh-agent-workflows/dependency-review/example.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,3 +27,8 @@ jobs:
# allowed-bot-users: "github-actions[bot]"
secrets:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
# Optional: pass an ephemeral token (e.g. a GitHub App token) so that PR labels
# applied by this workflow can trigger downstream label-based workflows.
# When omitted, the built-in GITHUB_TOKEN is used for labeling, which does
# not re-trigger other workflows.
# GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
Loading