* Use Actions token for DevFlow Copilot auth
Grant the review job Copilot request permission and remove the user token fallback so organization-billed GitHub Actions authentication is exercised directly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
* Enable DevFlow PR review comparisons
Pass the dedicated DevFlow repository token for A/B artifact branches while keeping the built-in Actions token as the only Copilot credential.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
* Allow team-triggered DevFlow reviews
Accept an exact @devflow /review PR comment only from organization members, verify the commenter against the developer team with the GitHub App, and react after authorization.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
* Use Actions token for issue triage Copilot auth
Grant the triage job Copilot request permission and remove the user PAT so issue reproduction exercises organization-billed GitHub Actions authentication.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
* Use tracked DevFlow CI model configuration
Point PR review and issue triage runs at the dashboard's tracked GPT-5.6 Sol and Claude Opus 5 model configuration.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
* Use Actions tokens for Copilot test workflows
Remove Copilot PAT secrets from integration and sample validation workflows, grant Copilot request permission at the required caller and job boundaries, and preserve the environment variable expected by the tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
---------
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
* CI: resolve PR author in community team check
pull_request_target events expose the author on payload.pull_request, not payload.issue. Read that field first and fall back to pulls.get so limit-community-prs no longer calls issues.get and fails with 401.
* Docs: clarify issueNumber accepts PR numbers
* Harden manual integration test workflow
Require two write-capable approvals for the exact PR head SHA, pin all targets to immutable commits, and narrow secret and OIDC access.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b8c7d85f-7576-4fc7-a7b5-c77833344088
* Require integration workflow credentials
Declare credentials consumed by the reusable integration workflows as required while retaining the explicitly optional Foundry models key.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b8c7d85f-7576-4fc7-a7b5-c77833344088
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Improve PR template and breaking-change label automation
- Add a structured "Related Issue" section using GitHub closing keywords
- Add a Review Guide prompt (major changes, impact, reviewer focus) with a
note that the focus item is for human reviewers only
- Add checklist items for issue linkage / no duplicate PRs and invert the
breaking-change item (checked = not breaking)
- Extend label-title-prefix to prepend [BREAKING] when the "breaking change"
label is added
- Add label-breaking-change workflow to apply the "breaking change" label
when a PR title contains [BREAKING]
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add pull-requests agent skill with dotnet/python links
- Add root .github/skills/pull-requests/SKILL.md covering PR description
authoring (following the PR template) and the review-comment workflow
(review -> plan -> user review -> implement -> reply to all -> resolve)
- Symlink the skill from python/.github/skills and dotnet/.github/skills
- Reference the skill from python/AGENTS.md and dotnet/AGENTS.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fold breaking-change labeling into label-pr workflow
Move the title -> 'breaking change' label logic into the existing label-pr
workflow (which already applies the python/.NET labels) and drop the separate
label-breaking-change workflow.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR title prefix review feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Pin patched MessagePack for .NET restore
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Revert MessagePack central pin
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Move title prefix tests out of tracked GitHub tests
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Exclude skill docs from CI path filters
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Match skill symlinks in CI path exclusions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Exclude AGENTS docs from CI path filters
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Scope title-prefix normalization to a real prefix
The normalization branch in addTitlePrefix matched ^Python (no colon), so
titles like "Python samples improvements" or "Pythonic refactor" were treated
as already-prefixed and only re-cased, never receiving the "Python: " prefix.
Scope the match to ^<prefix>:\s* so only an actual existing prefix is
normalized; otherwise the prefix is prepended. Same fix applies to the .NET
prefix (e.g. ".NETStandard bump").
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Automated issue triage workflow
* Bump dependencies
* Fix issue-triage workflow: security, reliability, and testability
Address six review comments on the issue-triage workflow:
1. Change trigger from issues:opened to issues:labeled so the
secret-backed triage flow is only triggered by a maintainer-
controlled signal.
2. Include inputs.issue_number in the concurrency group so
workflow_dispatch runs for the same issue are properly
de-duplicated.
3. Improve team membership error handling to fail closed: verify
the team exists before checking membership, and only treat a
404 as 'not a member' (all other errors fail the job).
4. Use optional chaining (issue.user?.login) for the API-fetched
issue to handle deleted GitHub accounts without crashing.
5. Extract the inline github-script into a testable module at
.github/scripts/check_team_membership.js with 10 tests in
.github/tests/test_check_team_membership.js covering all
code paths (payload/API author resolution, deleted accounts,
team lookup failure, 404 vs non-404 membership errors).
6. Make the spam gate actually stop the job by exiting non-zero
instead of just logging, so future steps cannot accidentally
run for spam issues.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Make issue-triage workflow manually triggered only for initial testing
Remove the 'issues' event trigger, keeping only 'workflow_dispatch' so the
workflow can be tested manually before enabling automatic triggers.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add script to ping on stale issues/PRs
* Add script to ping on stale issues/PRs
* Fix stale issue/PR ping script review comments
- Rename TEAM_NAME env var to TEAM_SLUG for clarity
- Add actionable error messages for 403/404 team lookup failures
- Add contents:read permission for actions/checkout
- Use github.event.inputs context with fallback for scheduled runs
- Pin PyGithub to 2.6.0 for reproducible builds
- Fetch comments once in should_ping() to reduce API calls
- Make ping() retry loop idempotent (track comment/label state)
- Validate DAYS_THRESHOLD with helpful error for non-numeric input
- Fix timezone bug: use astimezone() instead of replace(tzinfo=)
- Add comprehensive unit tests (29 tests)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Evan Mattson