Add preconfigured Copilot authentication to `gh aw add-wizard`

[mnkiefer]

When GitHub Actions copilot-requests authentication is available, gh aw add-wizard should use the organization's Copilot billing. No personal access token or COPILOT_GITHUB_TOKEN secret is needed.

When it is unavailable, the wizard should open a preconfigured GitHub fine-grained PAT creation page. The page must prefill the token name and request only the required Copilot Requests: Read-only permission, so the user only needs to review and consent to create the token. The wizard should also support advance consent, allowing setup to continue without an additional confirmation gate if the users choses to. After token creation, it collects the token through masked input, validates the github_pat_ format, and stores it securely as the COPILOT_GITHUB_TOKEN repository secret.

[pelikhan]

/scout search the bootstrap command implementation for existing functionlities.

[github-actions]

🔭 Recon complete! Scout has charted the territory. Map ready! 🗺️

[github-actions]

🔍 Scout Research Report

Triggered by @github-actions[bot] — /scout search the bootstrap command implementation for existing functionalities

Executive Summary

Most of what issue #45986 describes already exists in the codebase. The bootstrap/add-wizard already probes the org's Copilot billing, offers copilot-requests (org-billing) vs. PAT as a choice, validates the github_pat_ format, masks token input, and stores the COPILOT_GITHUB_TOKEN repo secret. The two genuinely missing pieces are: (1) the fine-grained PAT creation page is not preconfigured/prefilled (plain URL, no token-name or permission query params — a capability GitHub officially supports), and (2) there is no browser auto-open for PAT creation and no advance-consent flag to skip the confirmation gate.

Click to expand detailed findings

Research Findings

Two distinct "bootstrap" surfaces exist

1. gh aw bootstrap (hidden) — full repo bootstrap: auth check → repo create/clone → init markers → add+compile workflows → run bootstrap profile actions. Wiring pkg/cli/bootstrap_command.go:10; flow pkg/cli/bootstrap.go (RunBootstrap:89). Profile actions (repo-variable, repo-secret, github-app, copilot-auth, handoff) defined in pkg/cli/bootstrap_profile_manifest.go and executed in pkg/cli/bootstrap_profile_runner.go.
2. gh aw secrets bootstrap (pkg/cli/tokens_bootstrap.go:44) — analyzes workflows, shows a status table, prompts for missing required secrets via promptForSecret.

The add-wizard flow (pkg/cli/add_interactive_orchestrator.go:71, RunAddInteractive) is the interactive path most relevant to the issue — step 6 (selectAIEngineAndKey) is where Copilot auth is configured.

✅ Already implemented (issue requirements largely met)

• Org Copilot billing detection — pkg/cli/copilot_billing_check.go: probeCopilotBillingForOrg calls GET /orgs/{org}/copilot/billing (3s timeout) and reads the cli field. enabled → pre-selects copilot-requests; disabled → blocks it with a validation guard; inconclusive → info note.
• copilot-requests (org billing) vs PAT choice — selectCopilotAuthMethod (pkg/cli/add_interactive_engine.go:216). When org billing is chosen, UseCopilotRequests=true, secret setup is skipped, and permissions.copilot-requests: write is injected into the workflow (add_command.go:935 → codemod_copilot_requests_feature.go:98). Bootstrap skips the PAT action when workflows already grant copilot-requests: write (bootstrap_profile_runner.go:362, profileSourcesUseActionsTokenCopilotAuth:895). This is exactly the "when copilot-requests auth is available, no PAT needed" requirement.
• github_pat_ format validation — pkg/stringutil/pat_validation.go: ValidateCopilotPAT accepts only fine-grained, rejects classic (ghp_) / oauth (gho_).
• Masked token input — huh.EchoModePassword in promptForCopilotPATUnified (engine_secrets.go:300) and resolveBootstrapSecretValue (bootstrap_profile_runner.go:861).
• Repo secret storage — uploadSecretToRepo (engine_secrets.go:469, gh secret set) for add-wizard; setBootstrapRepoSecret (bootstrap_profile_runner.go:781, REST + libsodium encryption) for bootstrap.
• Rich PAT creation instructions — promptForCopilotPATUnified already prints token name ("Agentic Workflows Copilot"), expiration, resource owner, "Public repositories" access, and "Copilot Requests: Read-only" permission guidance.

❌ Gaps vs. issue #45986

1. PAT page is not "preconfigured/prefilled." KeyURL is the bare https://github.com/settings/personal-access-tokens/new (pkg/constants/engine_constants.go:65,117) with no query params — the instructions are printed as text the user must follow manually. GitHub officially supports pre-filling fine-grained PAT details via URL parameters (token name, description, expiration, target owner, and per-permission read/write). Building a prefilled URL that requests only Copilot Requests: Read-only is a concrete, small change.
2. No browser auto-open for PAT creation. URLs are only printed to stderr. The browser-open helper openBootstrapBrowser (bootstrap_profile_runner.go:1056, uses gh browse/open/xdg-open) already exists but is wired only to the GitHub App manifest flow — it could be reused for the PAT page.
3. No advance-consent flag. Only gates today: --no-secret/--skip-secret, the interactive auth-method select, and the final confirmChanges PR confirmation. The issue's "advance consent, continue without an additional confirmation gate" has no equivalent.
4. Duplicated Copilot PAT logic. add-wizard/secrets bootstrap use the rich promptForCopilotPATUnified (engine_secrets.go), but the bootstrap profile's runBootstrapCopilotAuthAction uses the generic resolveBootstrapSecretValue prompt (no rich instructions/URL). Consolidating would ensure a preconfigured URL benefits both paths.

Recommendations

• Add a helper that builds a prefilled fine-grained PAT URL (name = Agentic Workflows Copilot, target = repo owner, Copilot Requests = read-only) per the GitHub docs' supported query parameters; use it as the Copilot KeyURL and in both prompt paths.
• Reuse openBootstrapBrowser to optionally open that prefilled URL (respect the existing GH_AW_BOOTSTRAP_NO_OPEN_BROWSER env gate and non-TTY environments).
• Introduce an advance-consent flag/env (mirroring the --yes pattern in bootstrap_command.go) so setup can proceed past the confirmation gate when the user opts in.
• Consolidate runBootstrapCopilotAuthAction onto the rich promptForCopilotPATUnified path to avoid divergent Copilot UX.

Key Sources

• GitHub docs — Pre-filling fine-grained PAT details using URL parameters
• Code: pkg/cli/copilot_billing_check.go, pkg/cli/add_interactive_engine.go (selectCopilotAuthMethod:216), pkg/cli/engine_secrets.go (promptForCopilotPATUnified:300), pkg/cli/bootstrap_profile_runner.go (runBootstrapCopilotAuthAction:362, openBootstrapBrowser:1056), pkg/stringutil/pat_validation.go, pkg/constants/engine_constants.go:65,117,202

Suggested Next Steps

1. Verify the exact Copilot Requests permission slug in the GitHub prefill URL params (test against settings/personal-access-tokens/new?...), then add the URL-builder helper.
2. Wire the prefilled URL + optional browser open into promptForCopilotPATUnified.
3. Consolidate the bootstrap-profile Copilot path onto the same prompt, and add the advance-consent option.

🔭 Intelligence gathered by Scout · 318.8 AIC · ⌖ 13.2 AIC · ⊞ 6.4K · ◷
_{Comment /scout to run again}