@vypdev/copilot 3.2.0 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vypdev/copilot",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "packageManager": "pnpm@10.12.4",
   "description": "Automates branch management, GitHub project linking, and issue/PR tracking with Git-Flow methodology.",
   "homepage": "https://github.com/vypdev/copilot",
@@ -12,6 +12,13 @@
     "url": "https://github.com/vypdev/copilot/issues"
   },
   "main": "build/github_action/index.js",
+  "exports": {
+    ".": "./build/github_action/index.js",
+    "./bugbot": {
+      "types": "./build/api/src/api.d.ts",
+      "default": "./build/api/index.js"
+    }
+  },
   "bin": {
     "copilot": "./build/cli/index.js"
   },
@@ -19,6 +26,8 @@
     "action.yml",
     "build/cli/index.js",
     "build/github_action/index.js",
+    "build/api/index.js",
+    "build/api/src/",
     "setup/ISSUE_TEMPLATE/",
     "setup/workflows/",
     "setup/pull_request_template.md",
@@ -33,18 +42,20 @@
     "node": ">=24"
   },
   "scripts": {
-    "build": "ncc build src/actions/github_action.ts -o build/github_action && ncc build src/cli.ts -o build/cli && chmod +x build/cli/index.js",
+    "build": "node scripts/clean-generated-bundles.cjs && ncc build src/actions/github_action.ts -o build/github_action && ncc build src/cli.ts -o build/cli && ncc build src/api.ts -o build/api && node scripts/prepare-generated-bundles.cjs && chmod +x build/cli/index.js",
     "validate:build": "node scripts/validate-build.cjs",
     "validate:npm-package": "node scripts/validate-npm-package.cjs",
     "smoke:npm-package": "node scripts/smoke-test-npm-package.cjs",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
+    "eval:bugbot": "jest src/tooling/__tests__/bugbot_quality_eval.test.ts src/tooling/__tests__/bugbot_benchmark.test.ts --runInBand",
     "typecheck": "tsc --noEmit",
     "metrics:architecture": "node scripts/collect-architecture-metrics.cjs",
     "lint": "eslint src",
     "validate:agent-docs": "node scripts/validate-agent-documentation.cjs",
     "validate:docs-page": "node scripts/validate-docs-page-assets.cjs",
+    "validate:documentation": "node scripts/validate-documentation-contract.cjs",
     "validate:workflows": "node scripts/validate-workflow-contract.cjs",
     "lint:fix": "eslint src --fix",
     "postinstall": "node scripts/install-git-hooks.cjs"
@@ -59,7 +70,6 @@
     "@actions/github": "^6.0.1",
     "@types/axios": "^0.14.4",
     "@types/chance": "^1.1.6",
-    "@types/dotenv": "^8.2.3",
     "@types/js-yaml": "^4.0.9",
     "axios": "^1.8.4",
     "boxen": "^8.0.1",
@@ -67,9 +77,9 @@
     "chance": "^1.1.12",
     "commander": "^12.0.0",
     "dockerode": "^4.0.5",
-    "dotenv": "^16.5.0",
     "js-yaml": "^4.1.0",
-    "shell-quote": "^1.8.3"
+    "shell-quote": "^1.8.3",
+    "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
     "@eslint/js": "^9.15.0",
@@ -83,4 +93,4 @@
     "typescript": "^5.2.2",
     "typescript-eslint": "^8.15.0"
   }
-}
+}

package/setup/ISSUE_TEMPLATE/help_request.yml

@@ -17,6 +17,11 @@ body:
       value: |
         ---
 
+  - type: markdown
+    attributes:
+      value: |
+        **Copilot assistance:** After opening this issue, mention `@vypbot` in a comment to ask for an explanation, diagnosis, or read-only code/security analysis. Use `/copilot help` to see all available commands.
+
   - type: dropdown
     id: help_area
     attributes:

package/setup/workflows/agent-cli-provisioning.yml

@@ -14,41 +14,40 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Verify selected CLI binary and headless contract
         shell: bash
         env:
           AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
+          FINDINGS_PROVIDER: ${{ vars.FINDINGS_PROVIDER }}
+          FIXER_PROVIDER: ${{ vars.FIXER_PROVIDER }}
+          PLANNER_PROVIDER: ${{ vars.PLANNER_PROVIDER }}
+          REVIEWER_PROVIDER: ${{ vars.REVIEWER_PROVIDER }}
+          TESTER_PROVIDER: ${{ vars.TESTER_PROVIDER }}
           AGENT_COMMAND: ${{ vars.AGENT_COMMAND }}
         run: |
           set -euo pipefail
 
-          if [[ -n "${AGENT_COMMAND// }" ]]; then
-            read -r executable _ <<< "$AGENT_COMMAND"
-            command -v "$executable"
-            echo "Configured agent command: $executable"
-          else
-            case "$AGENT_PROVIDER" in
-              opencode)
-                command -v opencode
-                opencode --version >/dev/null
-                opencode run --help >/dev/null
-                ;;
-              codex)
-                command -v codex
-                codex --version >/dev/null
-                codex exec --help >/dev/null
-                ;;
-              cursor)
-                command -v agent
-                agent --version >/dev/null
-                agent --help >/dev/null
-                ;;
-              *)
-                echo "Unsupported AGENT_PROVIDER: $AGENT_PROVIDER" >&2
-                exit 1
-                ;;
+          providers=("$AGENT_PROVIDER" "$FINDINGS_PROVIDER" "$FIXER_PROVIDER" "$PLANNER_PROVIDER" "$REVIEWER_PROVIDER" "$TESTER_PROVIDER")
+          checked=""
+          for provider in "${providers[@]}"; do
+            [[ -z "${provider// }" ]] && continue
+            [[ " $checked " == *" $provider "* ]] && continue
+            checked="$checked $provider"
+            if [[ -n "${AGENT_COMMAND// }" && "$provider" == "$AGENT_PROVIDER" ]]; then
+              read -r executable _ <<< "$AGENT_COMMAND"
+              command -v "$executable"
+              echo "Configured agent command: $executable"
+              continue
+            fi
+            case "$provider" in
+              opencode) command -v opencode; opencode --version >/dev/null; opencode run --help >/dev/null ;;
+              codex) command -v codex; codex --version >/dev/null; codex exec --help >/dev/null ;;
+              cursor) command -v agent; agent --version >/dev/null; agent --help >/dev/null ;;
+              *) echo "Unsupported agent provider: $provider" >&2; exit 1 ;;
             esac
-          fi
+          done
 
-          echo "Agent CLI contract passed for $AGENT_PROVIDER."
+          echo "Agent CLI contract passed for: $checked."

package/setup/workflows/copilot_branch_sync.yml

@@ -0,0 +1,19 @@
+name: Copilot - Branch Sync
+
+on:
+  push:
+    branches:
+      - '**'
+
+jobs:
+  branch-sync:
+    name: Copilot - Branch Sync
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    steps:
+      - uses: vypdev/copilot@v3
+        with:
+          single-action: check_branch_sync_action
+          token: ${{ secrets.PAT }}

package/setup/workflows/copilot_close_inactive_issues.yml

@@ -0,0 +1,49 @@
+name: Copilot - Close Inactive Issues
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+    inputs:
+      inactivity_threshold_hours:
+        description: Hours without activity before closing a waiting issue
+        required: false
+        default: '168'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  copilot-inactive-issues:
+    name: Copilot - Close Inactive Issues
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: vypdev/copilot@v3
+        with:
+          single-action: close_inactive_issues_action
+          inactivity-threshold-hours: ${{ inputs.inactivity_threshold_hours || vars.INACTIVITY_THRESHOLD_HOURS || '168' }}
+          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
+          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
+          agent-effort: ${{ vars.AGENT_EFFORT }}
+          agent-command: ${{ vars.AGENT_COMMAND }}
+          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
+          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
+          findings-model: ${{ vars.FINDINGS_MODEL }}
+          findings-effort: ${{ vars.FINDINGS_EFFORT }}
+          findings-command: ${{ vars.FINDINGS_COMMAND }}
+          fixer-provider: ${{ vars.FIXER_PROVIDER }}
+          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
+          fixer-model: ${{ vars.FIXER_MODEL }}
+          fixer-effort: ${{ vars.FIXER_EFFORT }}
+          fixer-command: ${{ vars.FIXER_COMMAND }}
+          token: ${{ secrets.PAT }}

package/setup/workflows/copilot_commit.yml

@@ -9,16 +9,70 @@ on:
 
 jobs:
   copilot-commits:
+    if: ${{ vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN }}
     name: Copilot - Commit
     runs-on: ubuntu-latest
     timeout-minutes: 120
+    permissions:
+      contents: read
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Fetch push review range
+        if: github.event.after != '0000000000000000000000000000000000000000'
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          AFTER_SHA: ${{ github.event.after }}
+          BRANCH_CREATED: ${{ github.event.created }}
+        run: |
+          git cat-file -e "${AFTER_SHA}^{commit}"
+          if [ "$BRANCH_CREATED" != "true" ] && ! git cat-file -e "${BEFORE_SHA}^{commit}"; then
+            echo "::notice::The previous push commit is unavailable; Bugbot will use its documented fallback scope."
+          fi
 
       - uses: vypdev/copilot@v3
         with:
+          ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
+          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
+          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
+          feature-tree: ${{ vars.FEATURE_TREE || 'feature' }}
+          bugfix-tree: ${{ vars.BUGFIX_TREE || 'bugfix' }}
+          hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
+          release-tree: ${{ vars.RELEASE_TREE || 'release' }}
+          docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
+          chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
+          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
+          desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
+          desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
+          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
+          commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
+          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
+          ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
+          ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
+          ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
+          bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
+          bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}
+          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
+          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
+          bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}
+          bugbot-review-drafts: ${{ vars.BUGBOT_REVIEW_DRAFTS || 'false' }}
+          bugbot-trace-rules: ${{ vars.BUGBOT_TRACE_RULES || 'false' }}
+          bugbot-suggested-changes: ${{ vars.BUGBOT_SUGGESTED_CHANGES || 'true' }}
+          bugbot-telemetry: ${{ vars.BUGBOT_TELEMETRY || 'true' }}
+          bugbot-fail-on-unresolved: ${{ vars.BUGBOT_FAIL_ON_UNRESOLVED || 'false' }}
+          bugbot-organization-rules: ${{ vars.BUGBOT_ORGANIZATION_RULES }}
+          project-column-issue-created: ${{ vars.PROJECT_COLUMN_ISSUE_CREATED || 'Todo' }}
+          project-column-pull-request-created: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_CREATED || 'In Progress' }}
+          project-column-issue-in-progress: ${{ vars.PROJECT_COLUMN_ISSUE_IN_PROGRESS || 'In Progress' }}
+          project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           project-ids: ${{ vars.PROJECT_IDS }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
@@ -53,5 +107,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor' || vars.RELEASE_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
           CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}

package/setup/workflows/copilot_credential_health.yml

@@ -0,0 +1,190 @@
+name: Copilot - Credential Health
+
+on:
+  workflow_dispatch:
+    inputs:
+      check_pat:
+        description: Check the workflow PAT against GitHub
+        required: false
+        default: false
+        type: boolean
+      check_openai:
+        description: Check OPENAI_API_KEY
+        required: false
+        default: false
+        type: boolean
+      check_anthropic:
+        description: Check ANTHROPIC_API_KEY
+        required: false
+        default: false
+        type: boolean
+      check_google:
+        description: Check GOOGLE_API_KEY
+        required: false
+        default: false
+        type: boolean
+      check_openrouter:
+        description: Check OPENROUTER_API_KEY
+        required: false
+        default: false
+        type: boolean
+      check_cursor:
+        description: Check CURSOR_API_KEY
+        required: false
+        default: false
+        type: boolean
+      check_opencode:
+        description: Check OPENCODE_API_KEY
+        required: false
+        default: false
+        type: boolean
+      check_codex:
+        description: Check CODEX_ACCESS_TOKEN
+        required: false
+        default: false
+        type: boolean
+      check_codex_api_key:
+        description: Check CODEX_API_KEY
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pat:
+    if: ${{ inputs.check_pat }}
+    name: Verify PAT
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate PAT without exposing its value
+        shell: bash
+        env:
+          PAT: ${{ secrets.PAT }}
+        run: |
+          set -euo pipefail
+          [[ -n "${PAT:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $PAT" -H 'Accept: application/vnd.github+json' https://api.github.com/user >/dev/null
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $PAT" -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/${GITHUB_REPOSITORY}" >/dev/null
+
+  verify-openai:
+    if: ${{ inputs.check_openai }}
+    name: Verify OPENAI_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate OpenAI key without exposing its value
+        shell: bash
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${OPENAI_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $OPENAI_API_KEY" https://api.openai.com/v1/models >/dev/null
+
+  verify-anthropic:
+    if: ${{ inputs.check_anthropic }}
+    name: Verify ANTHROPIC_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate Anthropic key without exposing its value
+        shell: bash
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${ANTHROPIC_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "x-api-key: $ANTHROPIC_API_KEY" -H 'anthropic-version: 2023-06-01' https://api.anthropic.com/v1/models >/dev/null
+
+  verify-google:
+    if: ${{ inputs.check_google }}
+    name: Verify GOOGLE_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate Google key without exposing its value
+        shell: bash
+        env:
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${GOOGLE_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 "https://generativelanguage.googleapis.com/v1beta/models?key=$GOOGLE_API_KEY" >/dev/null
+
+  verify-openrouter:
+    if: ${{ inputs.check_openrouter }}
+    name: Verify OPENROUTER_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate OpenRouter key without exposing its value
+        shell: bash
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${OPENROUTER_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $OPENROUTER_API_KEY" https://openrouter.ai/api/v1/models >/dev/null
+
+  verify-cursor:
+    if: ${{ inputs.check_cursor }}
+    name: Verify CURSOR_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate Cursor key without exposing its value
+        shell: bash
+        env:
+          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${CURSOR_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -u "$CURSOR_API_KEY:" 'https://api.cursor.com/analytics/ai-code/changes?startDate=30d&page=1&pageSize=1' >/dev/null
+
+  verify-opencode:
+    if: ${{ inputs.check_opencode }}
+    name: Verify OPENCODE_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate OpenCode key without exposing its value
+        shell: bash
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${OPENCODE_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $OPENCODE_API_KEY" https://opencode.ai/zen/v1/models >/dev/null
+
+  verify-codex:
+    if: ${{ inputs.check_codex }}
+    name: Verify CODEX_ACCESS_TOKEN
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate Codex token without exposing its value
+        shell: bash
+        env:
+          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}
+        run: |
+          set -euo pipefail
+          [[ -n "${CODEX_ACCESS_TOKEN:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $CODEX_ACCESS_TOKEN" https://api.openai.com/v1/models >/dev/null
+
+  verify-codex-api-key:
+    if: ${{ inputs.check_codex_api_key }}
+    name: Verify CODEX_API_KEY
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate Codex API key without exposing its value
+        shell: bash
+        env:
+          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+        run: |
+          set -euo pipefail
+          [[ -n "${CODEX_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
+          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $CODEX_API_KEY" https://api.openai.com/v1/models >/dev/null

package/setup/workflows/copilot_issue.yml

@@ -6,6 +6,7 @@ on:
 
 jobs:
   copilot-issues:
+    if: ${{ vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN }}
     name: Copilot - Issue
     runs-on: ubuntu-latest
     timeout-minutes: 120
@@ -14,11 +15,49 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: vypdev/copilot@v3
         with:
-          ai-ignore-files: build/*
+          ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
+          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
+          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
+          feature-tree: ${{ vars.FEATURE_TREE || 'feature' }}
+          bugfix-tree: ${{ vars.BUGFIX_TREE || 'bugfix' }}
+          hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
+          release-tree: ${{ vars.RELEASE_TREE || 'release' }}
+          docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
+          chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
+          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
+          desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
+          desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
+          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
+          commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
+          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
+          ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
+          ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
+          ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
+          bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
+          bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}
+          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
+          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
+          bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}
+          bugbot-review-drafts: ${{ vars.BUGBOT_REVIEW_DRAFTS || 'false' }}
+          bugbot-trace-rules: ${{ vars.BUGBOT_TRACE_RULES || 'false' }}
+          bugbot-suggested-changes: ${{ vars.BUGBOT_SUGGESTED_CHANGES || 'true' }}
+          bugbot-telemetry: ${{ vars.BUGBOT_TELEMETRY || 'true' }}
+          bugbot-fail-on-unresolved: ${{ vars.BUGBOT_FAIL_ON_UNRESOLVED || 'false' }}
+          bugbot-organization-rules: ${{ vars.BUGBOT_ORGANIZATION_RULES }}
+          project-ids: ${{ vars.PROJECT_IDS }}
+          project-column-issue-created: ${{ vars.PROJECT_COLUMN_ISSUE_CREATED || 'Todo' }}
+          project-column-pull-request-created: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_CREATED || 'In Progress' }}
+          project-column-issue-in-progress: ${{ vars.PROJECT_COLUMN_ISSUE_IN_PROGRESS || 'In Progress' }}
+          project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
@@ -57,5 +96,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor' || vars.RELEASE_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
           CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}

package/setup/workflows/copilot_issue_comment.yml

@@ -6,19 +6,58 @@ on:
 
 jobs:
   copilot-issues:
+    if: ${{ vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN }}
     name: Copilot - Issue Comment
     runs-on: ubuntu-latest
     timeout-minutes: 120
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          fetch-depth: 0
 
       - uses: vypdev/copilot@v3
         with:
-          ai-ignore-files: build/*
+          ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
+          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
+          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
+          feature-tree: ${{ vars.FEATURE_TREE || 'feature' }}
+          bugfix-tree: ${{ vars.BUGFIX_TREE || 'bugfix' }}
+          hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
+          release-tree: ${{ vars.RELEASE_TREE || 'release' }}
+          docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
+          chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
+          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
+          desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
+          desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
+          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
+          commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
+          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
+          ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
+          ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
+          ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
+          bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
+          bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}
+          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
+          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
+          bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}
+          bugbot-review-drafts: ${{ vars.BUGBOT_REVIEW_DRAFTS || 'false' }}
+          bugbot-trace-rules: ${{ vars.BUGBOT_TRACE_RULES || 'false' }}
+          bugbot-suggested-changes: ${{ vars.BUGBOT_SUGGESTED_CHANGES || 'true' }}
+          bugbot-telemetry: ${{ vars.BUGBOT_TELEMETRY || 'true' }}
+          bugbot-fail-on-unresolved: ${{ vars.BUGBOT_FAIL_ON_UNRESOLVED || 'false' }}
+          bugbot-organization-rules: ${{ vars.BUGBOT_ORGANIZATION_RULES }}
+          project-column-issue-created: ${{ vars.PROJECT_COLUMN_ISSUE_CREATED || 'Todo' }}
+          project-column-pull-request-created: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_CREATED || 'In Progress' }}
+          project-column-issue-in-progress: ${{ vars.PROJECT_COLUMN_ISSUE_IN_PROGRESS || 'In Progress' }}
+          project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
@@ -39,8 +78,17 @@ jobs:
           planner-model: ${{ vars.PLANNER_MODEL }}
           planner-effort: ${{ vars.PLANNER_EFFORT }}
           planner-command: ${{ vars.PLANNER_COMMAND }}
+          reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
+          reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
+          reviewer-model: ${{ vars.REVIEWER_MODEL }}
+          reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
+          reviewer-command: ${{ vars.REVIEWER_COMMAND }}
+          tester-provider: ${{ vars.TESTER_PROVIDER }}
+          tester-model-provider: ${{ vars.TESTER_MODEL_PROVIDER }}
+          tester-model: ${{ vars.TESTER_MODEL }}
+          tester-effort: ${{ vars.TESTER_EFFORT }}
+          tester-command: ${{ vars.TESTER_COMMAND }}
           project-ids: ${{ vars.PROJECT_IDS }}
-          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
           token: ${{ secrets.PAT }}
         env:
           AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
@@ -59,5 +107,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor' || vars.RELEASE_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
           CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}