@vypdev/copilot 3.3.0 → 3.5.0

package/setup/workflows/copilot_commit.yml

@@ -13,6 +13,9 @@ jobs:
     name: Copilot - Commit
     runs-on: ubuntu-latest
     timeout-minutes: 120
+    concurrency:
+      group: copilot-push-${{ github.repository }}-${{ github.ref_name }}
+      cancel-in-progress: true
     permissions:
       contents: read
     steps:
@@ -23,6 +26,7 @@ jobs:
           fetch-depth: 0
 
       - name: Fetch push review range
+        shell: bash
         if: github.event.after != '0000000000000000000000000000000000000000'
         env:
           BEFORE_SHA: ${{ github.event.before }}
@@ -36,6 +40,10 @@ jobs:
 
       - uses: vypdev/copilot@v3
         with:
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
           main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
@@ -46,15 +54,12 @@ jobs:
           release-tree: ${{ vars.RELEASE_TREE || 'release' }}
           docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
           chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
-          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          issue-managed-branches: ${{ vars.ISSUE_MANAGED_BRANCHES || 'true' }}
+          pre-branch-sdd: ${{ vars.PRE_BRANCH_SDD || 'false' }}
           reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
           desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
           desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
-          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
           commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
-          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
           ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
           ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
           ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
@@ -76,32 +81,28 @@ jobs:
           project-ids: ${{ vars.PROJECT_IDS }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
           agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
+          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
           findings-provider: ${{ vars.FINDINGS_PROVIDER }}
           findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
           findings-model: ${{ vars.FINDINGS_MODEL }}
           findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
+          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
           fixer-provider: ${{ vars.FIXER_PROVIDER }}
           fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
           fixer-model: ${{ vars.FIXER_MODEL }}
           fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
           token: ${{ secrets.PAT }}
         env:
           AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
           AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           AGENT_MODEL: ${{ vars.AGENT_MODEL }}
           AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
           AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
-          AGENT_COMMAND: ${{ vars.AGENT_COMMAND }}
-          CODEX_VERSION: ${{ vars.CODEX_VERSION }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION }}
-          CURSOR_INSTALLER_SHA256: ${{ vars.CURSOR_INSTALLER_SHA256 }}
+          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
+          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -109,4 +110,3 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
           CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}

package/setup/workflows/copilot_credential_health.yml

@@ -38,11 +38,6 @@ on:
         required: false
         default: false
         type: boolean
-      check_codex:
-        description: Check CODEX_ACCESS_TOKEN
-        required: false
-        default: false
-        type: boolean
       check_codex_api_key:
         description: Check CODEX_API_KEY
         required: false
@@ -159,21 +154,6 @@ jobs:
           [[ -n "${OPENCODE_API_KEY:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
           curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $OPENCODE_API_KEY" https://opencode.ai/zen/v1/models >/dev/null
 
-  verify-codex:
-    if: ${{ inputs.check_codex }}
-    name: Verify CODEX_ACCESS_TOKEN
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Validate Codex token without exposing its value
-        shell: bash
-        env:
-          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}
-        run: |
-          set -euo pipefail
-          [[ -n "${CODEX_ACCESS_TOKEN:-}" ]] || { echo 'Required credential is missing.' >&2; exit 1; }
-          curl --fail --silent --show-error --location --max-time 20 -H "Authorization: Bearer $CODEX_ACCESS_TOKEN" https://api.openai.com/v1/models >/dev/null
-
   verify-codex-api-key:
     if: ${{ inputs.check_codex_api_key }}
     name: Verify CODEX_API_KEY

package/setup/workflows/copilot_deployment_orchestration.yml

@@ -0,0 +1,91 @@
+name: Copilot - Deployment Orchestration
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  resolve-operation:
+    name: Resolve managed deployment ownership
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && contains(github.event.pull_request.body || '', '<!-- copilot-deployment ') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    outputs:
+      operation-id: ${{ steps.identity.outputs.operation-id }}
+      issue: ${{ steps.identity.outputs.issue }}
+    steps:
+      - name: Prove managed operation identity
+        id: identity
+        uses: actions/github-script@v9
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        with:
+          script: |
+            const body = process.env.PR_BODY || '';
+            if (body.length > 70000) return core.setFailed('The managed deployment marker input is too large.');
+            const matches = [...body.matchAll(/<!-- copilot-deployment operation-id="([A-Za-z0-9][A-Za-z0-9._-]{7,127})" phase="(promotion|reconciliation)" issue="([1-9][0-9]*)" -->/g)];
+            if (matches.length !== 1) return core.setFailed('Exactly one valid managed deployment marker is required.');
+            const [, operationId, phase, issueText] = matches[0];
+            const issue = Number(issueText);
+            if (!Number.isSafeInteger(issue) || issue < 1) return core.setFailed('The launcher issue is invalid.');
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: issue });
+            if (response.data.pull_request) return core.setFailed('The deployment launcher must be an issue.');
+            const description = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const startIndex = description.indexOf(start);
+            const endIndex = description.indexOf(end, startIndex + start.length);
+            if (startIndex < 0 || endIndex < 0 || description.indexOf(start, startIndex + start.length) >= 0) {
+              return core.setFailed('The launcher issue has no unique durable configuration.');
+            }
+            let payload;
+            try { payload = JSON.parse(description.slice(startIndex + start.length, endIndex)); }
+            catch { return core.setFailed('The launcher issue configuration is invalid.'); }
+            const state = payload?.deploymentOrchestration;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1 || !Number.isSafeInteger(state?.revision) || state.revision < 1) {
+              return core.setFailed('The launcher issue has no supported deployment state.');
+            }
+            if (state.operationId !== operationId) return core.setFailed('The pull request does not own the durable deployment operation.');
+            const number = context.payload.pull_request.number;
+            const ownsPullRequest = phase === 'promotion'
+              ? state.promotionPullRequest === number
+              : Array.isArray(state.reconciliationTargets) && state.reconciliationTargets.some(target => target?.pullRequest === number);
+            if (!ownsPullRequest) return core.setFailed('The pull request is not recorded by the durable deployment state.');
+            core.setOutput('operation-id', operationId);
+            core.setOutput('issue', issueText);
+
+  mutate:
+    name: Advance durable deployment operation
+    needs: resolve-operation
+    if: ${{ needs.resolve-operation.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: copilot-deployment-${{ github.repository_id }}-${{ needs.resolve-operation.outputs.issue }}
+      cancel-in-progress: false
+      queue: max
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+      actions: write
+    steps:
+      - name: Checkout trusted base branch
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.base.ref }}
+          fetch-depth: 1
+      - name: Continue from current durable state
+        uses: vypdev/copilot@v3
+        with:
+          single-action: continue_deployment_action
+          single-action-issue: ${{ needs.resolve-operation.outputs.issue }}
+          single-action-operation-id: ${{ needs.resolve-operation.outputs.operation-id }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}

package/setup/workflows/copilot_issue.yml

@@ -2,11 +2,11 @@ name: Copilot - Issue
 
 on:
   issues:
-    types: [opened, reopened, edited, labeled, unlabeled, assigned, unassigned]
+    types: [opened, reopened, closed, edited, labeled, unlabeled, assigned, unassigned]
 
 jobs:
   copilot-issues:
-    if: ${{ vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN }}
+    if: ${{ (github.event.action == 'closed' && github.event.issue.state == 'closed') || vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN }}
     name: Copilot - Issue
     runs-on: ubuntu-latest
     timeout-minutes: 120
@@ -20,6 +20,9 @@ jobs:
 
       - uses: vypdev/copilot@v3
         with:
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
           ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
           main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
@@ -30,15 +33,13 @@ jobs:
           release-tree: ${{ vars.RELEASE_TREE || 'release' }}
           docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
           chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
-          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          issue-managed-branches: ${{ vars.ISSUE_MANAGED_BRANCHES || 'true' }}
+          pre-branch-sdd: ${{ vars.PRE_BRANCH_SDD || 'false' }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
           desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
           desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
-          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
           commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
-          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
           ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
           ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
           ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
@@ -60,37 +61,33 @@ jobs:
           project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
           agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
+          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
           findings-provider: ${{ vars.FINDINGS_PROVIDER }}
           findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
           findings-model: ${{ vars.FINDINGS_MODEL }}
           findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
+          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
           fixer-provider: ${{ vars.FIXER_PROVIDER }}
           fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
           fixer-model: ${{ vars.FIXER_MODEL }}
           fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
           planner-provider: ${{ vars.PLANNER_PROVIDER }}
           planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
           planner-model: ${{ vars.PLANNER_MODEL }}
           planner-effort: ${{ vars.PLANNER_EFFORT }}
-          planner-command: ${{ vars.PLANNER_COMMAND }}
+          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
           token: ${{ secrets.PAT }}
         env:
           AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
           AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           AGENT_MODEL: ${{ vars.AGENT_MODEL }}
           AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
           AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
-          AGENT_COMMAND: ${{ vars.AGENT_COMMAND }}
-          CODEX_VERSION: ${{ vars.CODEX_VERSION }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION }}
-          CURSOR_INSTALLER_SHA256: ${{ vars.CURSOR_INSTALLER_SHA256 }}
+          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
+          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -98,4 +95,3 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
           CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}

package/setup/workflows/copilot_issue_comment.yml

@@ -11,6 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     permissions:
+      checks: write
       contents: read
     steps:
       - name: Checkout Repository
@@ -21,6 +22,9 @@ jobs:
 
       - uses: vypdev/copilot@v3
         with:
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
           ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
           main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
@@ -31,15 +35,13 @@ jobs:
           release-tree: ${{ vars.RELEASE_TREE || 'release' }}
           docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
           chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
-          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          issue-managed-branches: ${{ vars.ISSUE_MANAGED_BRANCHES || 'true' }}
+          pre-branch-sdd: ${{ vars.PRE_BRANCH_SDD || 'false' }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
           desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
           desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
-          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
           commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
-          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
           ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
           ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
           ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
@@ -60,34 +62,34 @@ jobs:
           project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
           agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
+          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
           findings-provider: ${{ vars.FINDINGS_PROVIDER }}
           findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
           findings-model: ${{ vars.FINDINGS_MODEL }}
           findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
+          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
           fixer-provider: ${{ vars.FIXER_PROVIDER }}
           fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
           fixer-model: ${{ vars.FIXER_MODEL }}
           fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
           planner-provider: ${{ vars.PLANNER_PROVIDER }}
           planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
           planner-model: ${{ vars.PLANNER_MODEL }}
           planner-effort: ${{ vars.PLANNER_EFFORT }}
-          planner-command: ${{ vars.PLANNER_COMMAND }}
+          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
           reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
           reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
           reviewer-model: ${{ vars.REVIEWER_MODEL }}
           reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
-          reviewer-command: ${{ vars.REVIEWER_COMMAND }}
+          reviewer-executable: ${{ vars.REVIEWER_EXECUTABLE }}
           tester-provider: ${{ vars.TESTER_PROVIDER }}
           tester-model-provider: ${{ vars.TESTER_MODEL_PROVIDER }}
           tester-model: ${{ vars.TESTER_MODEL }}
           tester-effort: ${{ vars.TESTER_EFFORT }}
-          tester-command: ${{ vars.TESTER_COMMAND }}
+          tester-executable: ${{ vars.TESTER_EXECUTABLE }}
           project-ids: ${{ vars.PROJECT_IDS }}
           token: ${{ secrets.PAT }}
         env:
@@ -95,13 +97,9 @@ jobs:
           AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           AGENT_MODEL: ${{ vars.AGENT_MODEL }}
           AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
           AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
-          AGENT_COMMAND: ${{ vars.AGENT_COMMAND }}
-          CODEX_VERSION: ${{ vars.CODEX_VERSION }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION }}
-          CURSOR_INSTALLER_SHA256: ${{ vars.CURSOR_INSTALLER_SHA256 }}
+          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
+          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -109,4 +107,4 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
           CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}
+          COPILOT_EVIDENCE_TOKEN: ${{ github.token }}

package/setup/workflows/copilot_pull_request.yml

@@ -1,17 +1,19 @@
 name: Copilot - Pull Request
+run-name: Copilot PR · ${{ github.event_name }}:${{ github.event.action }}
 
 on:
   pull_request:
-    types: [opened, reopened, edited, closed, synchronize]
-  pull_request_review:
-    types: [submitted, edited, dismissed]
+    types: [opened, reopened, closed, synchronize, ready_for_review]
 
 jobs:
   copilot-pull-requests:
-    if: ${{ (vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN) && github.event.pull_request.head.repo.full_name == github.repository }}
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && (vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN || ((github.event.action == 'opened' || github.event.action == 'reopened' || github.event.action == 'synchronize') && github.event.pull_request.user.login == github.actor)) }}
     name: Copilot - Pull Request
     runs-on: ubuntu-latest
     timeout-minutes: 120
+    concurrency:
+      group: copilot-pr-${{ github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}-analysis
+      cancel-in-progress: true
     permissions:
       checks: write
       contents: read
@@ -23,6 +25,7 @@ jobs:
           fetch-depth: 0
 
       - name: Fetch incremental review range
+        shell: bash
         if: github.event.action == 'synchronize'
         env:
           BEFORE_SHA: ${{ github.event.before }}
@@ -35,6 +38,10 @@ jobs:
 
       - uses: vypdev/copilot@v3
         with:
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
           main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
@@ -45,15 +52,12 @@ jobs:
           release-tree: ${{ vars.RELEASE_TREE || 'release' }}
           docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
           chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
-          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          issue-managed-branches: ${{ vars.ISSUE_MANAGED_BRANCHES || 'true' }}
+          pre-branch-sdd: ${{ vars.PRE_BRANCH_SDD || 'false' }}
           reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
           desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
           desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
-          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
           commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
-          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
           ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
           ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
           ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
@@ -74,29 +78,29 @@ jobs:
           project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
           agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
+          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
           findings-provider: ${{ vars.FINDINGS_PROVIDER }}
           findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
           findings-model: ${{ vars.FINDINGS_MODEL }}
           findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
+          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
           fixer-provider: ${{ vars.FIXER_PROVIDER }}
           fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
           fixer-model: ${{ vars.FIXER_MODEL }}
           fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
           planner-provider: ${{ vars.PLANNER_PROVIDER }}
           planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
           planner-model: ${{ vars.PLANNER_MODEL }}
           planner-effort: ${{ vars.PLANNER_EFFORT }}
-          planner-command: ${{ vars.PLANNER_COMMAND }}
+          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
           reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
           reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
           reviewer-model: ${{ vars.REVIEWER_MODEL }}
           reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
-          reviewer-command: ${{ vars.REVIEWER_COMMAND }}
+          reviewer-executable: ${{ vars.REVIEWER_EXECUTABLE }}
           project-ids: ${{ vars.PROJECT_IDS }}
           token: ${{ secrets.PAT }}
         env:
@@ -104,13 +108,9 @@ jobs:
           AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           AGENT_MODEL: ${{ vars.AGENT_MODEL }}
           AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
           AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
-          AGENT_COMMAND: ${{ vars.AGENT_COMMAND }}
-          CODEX_VERSION: ${{ vars.CODEX_VERSION }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION }}
-          CURSOR_INSTALLER_SHA256: ${{ vars.CURSOR_INSTALLER_SHA256 }}
+          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
+          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -118,5 +118,4 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
           CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}
           COPILOT_EVIDENCE_TOKEN: ${{ github.token }}

package/setup/workflows/copilot_pull_request_approval.yml

@@ -0,0 +1,51 @@
+name: Copilot - Pull Request Approval
+run-name: Copilot approval · ${{ github.event_name }}
+
+on:
+  workflow_run:
+    workflows: __PR_APPROVAL_WORKFLOW_NAMES__
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: Positive pull-request number to recheck
+        required: true
+        type: number
+
+jobs:
+  observe-approval:
+    name: Copilot - Pull Request Approval
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      # Some workflow_run payloads omit the PR association. A repository-wide
+      # lane keeps every wakeup for the same PR serialized even when one run is
+      # associated by PR number and another is resolved from its head SHA.
+      group: copilot-approval-${{ github.repository }}
+      cancel-in-progress: false
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Observe current PR evidence without checking out PR code
+        uses: vypdev/copilot@v3
+        with:
+          pr-approval-observer: 'true'
+          pr-approval-pr-number: ${{ github.event.inputs.pr || '' }}
+          pr-approval-policy: ${{ vars.PR_APPROVAL_POLICY || '' }}
+          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
+          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
+          feature-tree: ${{ vars.FEATURE_TREE || 'feature' }}
+          bugfix-tree: ${{ vars.BUGFIX_TREE || 'bugfix' }}
+          docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
+          chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
+          bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
+          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
+          ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
+          token: ${{ secrets.PAT }}
+        env:
+          COPILOT_APPROVAL_CHECK_TOKEN: ${{ github.token }}