Add a PAT fallback for create_issue on copilot/* branches — GITHUB_TOKEN is silently restricted there even though issues: write is already declared.
Affected workflow: .github/workflows/design-decision-gate.md / .lock.yml
Run IDs (6 near-simultaneous failures, same PR batch, ~16:53-17:04 UTC 2026-08-22): 32586078480, 32586078532, 32586078507, 32586078476, 32586078522, 32586078568 — branch copilot/fix-9919-1036865607-4914139b-66e6-49a3-8bbd-8d8c72693945.
Evidence: agenticworkflows audit on run 32586078480 surfaces ##[error]create_issue handler failed: Resource not accessible by integration. audit-diff against baseline success run 32581772665 shows the failed run made 0 GitHub API calls (vs 11 in baseline, -100% core-rate-limit consumption) — the job dies before ever reaching the API. The lock.yml already declares issues: write at line 2289, so this is not a static permissions misconfiguration — it points at GitHub silently downgrading GITHUB_TOKEN scope for pull_request runs on Copilot coding-agent branches, regardless of the declared workflow permissions.
Probable root cause: GITHUB_TOKEN permission restriction specific to pull_request events on copilot/* branches, not a bug in this repo's YAML.
Proposed remediation: Fall back to secrets.GH_AW_GITHUB_TOKEN for the create_issue safe-output step, mirroring the fallback pattern already used elsewhere in the same lock.yml (e.g. secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN at lines 1503/1520/1592). This is the same non-retryable-error category described in #53263 (safe_outputs hard-fails the whole batch on one error) — fixing the token fallback here should close that gap for this workflow too.
Success criteria: A subsequent Design Decision Gate run on a copilot/* branch completes with create_issue succeeding (not hard-failing), and audit-diff shows GitHub API call count > 0 matching baseline behavior.
Related: #53263 (safe_outputs hard-fail category), #53619 (separate open P1 for Design Decision Gate hangs — different failure mode, keep distinct).
References:
Generated by 🔍 [aw] Failure Investigator (6h) · agent · 79.3 AIC · ⌖ 11.2 AIC · ⊞ 6.4K · ◷
Same 403 just reproduced on a git-ref push, not only create_issue — widen the fix scope
Action: fix the GITHUB_TOKEN permissions/branch-protection gap for Design Decision Gate's write path — it now hits "Resource not accessible by integration" on push_to_pull_request_branch too, not just create_issue.
New occurrence: §32687694593, Design Decision Gate, 2026-08-24T03:47:47Z.
gh: Invalid request. For 'properties/force', "false" is not a boolean. (HTTP 422)
gh: Resource not accessible by integration (HTTP 403)
This run failed on git refs#update-a-reference (branch push for the ADR), preceded by an unrelated 422 from a malformed force param on the same ref-update call — worth fixing both: (1) the force field being serialized as a string "false" instead of a boolean in the ref-update request, and (2) the permission gap causing the follow-up 403.
Success criteria: Design Decision Gate can push to copilot/* PR branches and open/update issues without 403, across 3 consecutive runs.
References:
Add a PAT fallback for create_issue on copilot/* branches — GITHUB_TOKEN is silently restricted there even though
issues: writeis already declared.Affected workflow:
.github/workflows/design-decision-gate.md/.lock.ymlRun IDs (6 near-simultaneous failures, same PR batch, ~16:53-17:04 UTC 2026-08-22): 32586078480, 32586078532, 32586078507, 32586078476, 32586078522, 32586078568 — branch
copilot/fix-9919-1036865607-4914139b-66e6-49a3-8bbd-8d8c72693945.Evidence:
agenticworkflows auditon run 32586078480 surfaces##[error]create_issue handler failed: Resource not accessible by integration.audit-diffagainst baseline success run 32581772665 shows the failed run made 0 GitHub API calls (vs 11 in baseline, -100% core-rate-limit consumption) — the job dies before ever reaching the API. The lock.yml already declaresissues: writeat line 2289, so this is not a static permissions misconfiguration — it points at GitHub silently downgrading GITHUB_TOKEN scope for pull_request runs on Copilot coding-agent branches, regardless of the declared workflow permissions.Probable root cause: GITHUB_TOKEN permission restriction specific to
pull_requestevents oncopilot/*branches, not a bug in this repo's YAML.Proposed remediation: Fall back to
secrets.GH_AW_GITHUB_TOKENfor the create_issue safe-output step, mirroring the fallback pattern already used elsewhere in the same lock.yml (e.g.secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKENat lines 1503/1520/1592). This is the same non-retryable-error category described in #53263 (safe_outputs hard-fails the whole batch on one error) — fixing the token fallback here should close that gap for this workflow too.Success criteria: A subsequent Design Decision Gate run on a
copilot/*branch completes with create_issue succeeding (not hard-failing), andaudit-diffshows GitHub API call count > 0 matching baseline behavior.Related: #53263 (safe_outputs hard-fail category), #53619 (separate open P1 for Design Decision Gate hangs — different failure mode, keep distinct).
References:
Related to [aw-failures] [aw] Failure Investigator Report — 2026-08-20 18:41 UTC (6h) #54326
Same 403 just reproduced on a git-ref push, not only create_issue — widen the fix scope
Action: fix the GITHUB_TOKEN permissions/branch-protection gap for Design Decision Gate's write path — it now hits "Resource not accessible by integration" on
push_to_pull_request_branchtoo, not justcreate_issue.New occurrence: §32687694593, Design Decision Gate, 2026-08-24T03:47:47Z.
This run failed on
git refs#update-a-reference(branch push for the ADR), preceded by an unrelated422from a malformedforceparam on the same ref-update call — worth fixing both: (1) theforcefield being serialized as a string"false"instead of a boolean in the ref-update request, and (2) the permission gap causing the follow-up 403.Success criteria: Design Decision Gate can push to
copilot/*PR branches and open/update issues without 403, across 3 consecutive runs.References: