Fix GitHub App token not overriding custom token in Copilot engine execution

[Copilot]

When a workflow configures both github-token and an app block under tools.github, the Copilot engine execution step was using the custom token for GITHUB_MCP_SERVER_TOKEN instead of the minted GitHub App token.

Root cause

copilot_engine_execution.go had its own GITHUB_MCP_SERVER_TOKEN assignment that didn't check for a GitHub App configuration — unlike mcp_environment.go, which already enforced the correct precedence (app token → custom token → default token).

Fix

• copilot_engine_execution.go: Mirror the precedence logic from mcp_environment.go — use ${{ steps.github-mcp-app-token.outputs.token }} when ParsedTools.GitHub.App != nil, otherwise fall back to the custom/default token.

if hasGitHubTool(workflowData.ParsedTools) {
    // If GitHub App is configured, use the app token (overrides custom and default tokens)
    if workflowData.ParsedTools.GitHub.App != nil {
        env["GITHUB_MCP_SERVER_TOKEN"] = "${{ steps.github-mcp-app-token.outputs.token }}"
    } else {
        customGitHubToken := getGitHubToken(workflowData.Tools["github"])
        effectiveToken := getEffectiveGitHubToken(customGitHubToken)
        env["GITHUB_MCP_SERVER_TOKEN"] = effectiveToken
    }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw /opt/hostedtoolcshow-ref /opt/hostedtoolc--verify node js/f�� celain --ignore-submodules | head -n 10 node cal/bin/bash on_test.go git /home/REDACTED/.lo--show-toplevel node (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --count 7c30248f73ab84578043eb011273bee820690725..HEAD 0/x64/bin/node --get-regexp --global ndor/bin/bash git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet 0/x64/bin/node se 5439078/b050/vetrev-parse .cfg git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.0/xrev-parse ache/node/24.13.--show-toplevel git rev-�� --show-toplevel git 64/pkg/tool/linux_amd64/vet --show-toplevel /opt/hostedtoolcrev-parse ache/node/24.13.--show-toplevel 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel x_amd64/vet /usr/bin/git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/grep git rev-�� --show-toplevel grep /usr/lib/git-core/git /tmp/gh-aw/aw.pagit 64/pkg/tool/linurev-parse 0/x64/bin/node /usr/lib/git-core/git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha 7504584/b001/_pkg_.a /tmp/go-build1135439078/b079/vet.cfg 7504584/b001=> (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha unset GOROOT; export PATH="$(find /opt/hostedtoolcache -maxdepth 4 -type d -name bin 2>/dev/nullgit 64/pkg/tool/linux_amd64/vet /usr/bin/git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha se 5439078/b017/vet.cfg .cfg credential.userngit (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -unreachable=false /tmp/go-build1135439078/b199/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -unreachable=false /tmp/go-build1135439078/b035/vet.cfg 5439078/b353/vet.cfg (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git 0/x64/bin/node --show-toplevel ache/go/1.25.0/xrev-parse /usr/bin/git git cjs --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.0/xrev-parse ache/node/24.13.--show-toplevel git (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha : 64/pkg/tool/linux_amd64/vet /usr/bin/git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git 0/x64/bin/node --show-toplevel ache/go/1.25.0/xrev-parse /usr/bin/git git js --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.0/xrev-parse ache/node/24.13.--show-toplevel git (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel x_amd64/vet /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git 40\} tch /home/REDACTED/wor-m git (http block)
• https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel (http block)
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha xterm-color git /usr/bin/git --show-toplevel x_amd64/vet /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel x_amd64/vet /home/REDACTED/.lo-m git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reference: https://github.com/github/gh-aw/actions/runs/22184500836/job/64154322391

Fix tests

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.