Use run-scoped authentication for Aider workflows

[Copilot]

Aider workflows failed before execution because the API proxy depended on an expired COPILOT_GITHUB_TOKEN repository secret.

• Authentication
  • Grant copilot-requests: write to all Aider workflows.
  • Use the run-scoped ${{ github.token }} for Copilot inference instead of the repository secret.
• Generated workflows
  • Recompile affected lock files with the updated permissions and token configuration.

• Fixes [workflow-health] Daily Code Debt Cleanup — Aider: OPENAI_API_KEY expired/invalid (401) #53040

[github-actions]

Hey @pelikhan 👋 — thanks for tasking the Copilot agent to fix the OpenAI API key validation failure! This looks like a solid, focused fix addressing the root cause of issue #53040 (OPENAI_API_KEY expired/invalid).

What's Working

• Properly removes expired COPILOT_GITHUB_TOKEN secret dependency
• Switches to github.token which is always available and valid
• Adds required copilot-requests: write permission to all three affected workflows
• Updates manifest, environment variables, and secret redaction consistently across all three workflows
• Minimal, focused diff (72 lines) — exactly the kind of surgical fix needed for a P1 reliability issue

Before Merging

• Complete the WIP checklist — the PR currently shows checks on investigation and compilation steps, but not yet on "Complete review and security checks". Make sure you've validated that the affected workflows pass their next scheduled runs with the new token source.
• Consider a test run — manually trigger one of the daily workflows (e.g. daily-code-debt-aider) after merge to confirm the api-proxy sidecar validates the key and the job completes successfully.

Looks ready to ship once the final validation checks are done! 🚀

Generated by ✅ Contribution Check · auto · 65.6 AIC · ⌖ 3.96 AIC · ⊞ 9.1K · ◷

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the gh-aw/Aider GitHub Actions workflows to use the built-in github.token and request the copilot-requests: write permission, removing the dependency on a dedicated COPILOT_GITHUB_TOKEN secret.

Changes:

• Adds copilot-requests: write to workflow/job permissions.
• Replaces secrets.COPILOT_GITHUB_TOKEN usage with ${{ github.token }} for Copilot/OpenAI-compatible auth.
• Removes COPILOT_GITHUB_TOKEN from secret manifests and token-check/redaction wiring in generated lock workflows.

Show a summary per file

File	Description
.github/workflows/smoke-aider.md	Requests copilot-requests: write at the workflow permissions level.
.github/workflows/smoke-aider.lock.yml	Drops COPILOT secret usage, adds copilot-requests: write, and switches env vars to ${{ github.token }}.
.github/workflows/daily-go-test-stubs-aider.md	Requests copilot-requests: write at the workflow permissions level.
.github/workflows/daily-go-test-stubs-aider.lock.yml	Drops COPILOT secret usage, adds copilot-requests: write, and switches env vars to ${{ github.token }}.
.github/workflows/daily-code-debt-aider.md	Requests copilot-requests: write at the workflow permissions level.
.github/workflows/daily-code-debt-aider.lock.yml	Drops COPILOT secret usage, adds copilot-requests: write, and switches env vars to ${{ github.token }}.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1