Skip to content

docs: update fine-grained PAT repository access instructions for Copi…#18682

Merged
dsyme merged 2 commits intomainfrom
upd-copilot-auth-docs
Feb 27, 2026
Merged

docs: update fine-grained PAT repository access instructions for Copi…#18682
dsyme merged 2 commits intomainfrom
upd-copilot-auth-docs

Conversation

@mnkiefer
Copy link
Contributor

@mnkiefer mnkiefer commented Feb 27, 2026

  • For COPILOT_GITHUB_TOKEN setup instructions:
    • Removes an embedded instructional video from the page.
    • Simplifies by removing description on recommended repository access

/cc @dsyme

@mnkiefer mnkiefer self-assigned this Feb 27, 2026
Copilot AI review requested due to automatic review settings February 27, 2026 13:09
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Copilot authentication documentation for fine-grained PAT setup, specifically around how to choose repository access scope.

Changes:

  • Adjusts guidance on fine-grained PAT Repository access selection to emphasize least-privilege (select specific repos) while noting public repos as an option.
  • Removes an embedded video walkthrough for creating a Copilot-permission PAT.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@github-actions
Copy link
Contributor

Hey @mnkiefer 👋 — thanks for the docs cleanup on the fine-grained PAT setup instructions! Simplifying the auth guide and trimming the embedded video is a thoughtful improvement.

That said, there's a process concern that needs addressing before this can move forward:

  • Contribution process not followed — This repository's CONTRIBUTING.md requires non-core-team contributors to open an issue with a detailed agentic plan first, rather than submitting pull requests directly. Core team members (@dsyme, @eaftan, @pelikhan, @krzysztof-cieslak) then pick up the plan and implement it via a coding agent. Since mnkiefer is not listed in CODEOWNERS as a core team member, this PR bypasses that process.
  • Content concern to flag — Step 2 in the original instructions ("Repository access is set to Public repositories…") was removed. That note existed because the "Copilot Requests" account permission is only available when Public repositories access is selected during PAT creation. Removing it may silently break the setup for users who don't choose public access. This is worth surfacing clearly in any follow-up issue so the implementing agent can decide whether to remove, reword, or keep the note.

Suggested next steps

  1. Close this PR.
  2. Open an issue with an agentic plan describing the proposed doc changes (remove the video, simplify the repo-access step with a note about the Copilot Requests permission constraint).
  3. A core team member will pick it up and implement it via agent.

If you'd like a head start on the issue plan, here's a ready-to-use prompt:

Update the fine-grained PAT setup instructions in docs/src/content/docs/reference/auth.mdx for the COPILOT_GITHUB_TOKEN section.

Proposed changes:
1. Remove the embedded (Video) component for "create-pat-user-copilot.mp4" — it is no longer needed.
2. Revisit step 2 ("Repository access is set to Public repositories"):
   - Determine whether the "Copilot Requests" account permission truly requires Public repository access or if it is now available for other access scopes.
   - If the restriction still applies, reword the step to be clearer about *why* Public repository access is required (to surface the Copilot Requests permission option).
   - If the restriction no longer applies, remove the step and renumber accordingly.
3. Ensure the numbered list remains coherent after changes.
4. Run `make agent-finish` to validate the docs build passes.

Generated by Contribution Check

[**Create a fine-grained PAT**](https://github.com/settings/personal-access-tokens/new?name=COPILOT_GITHUB_TOKEN&description=GitHub+Agentic+Workflows+-+Copilot+engine+authentication&user_copilot_requests=read) (this link pre-fills the token name, description, and Copilot Requests permission). Verify the following settings before generating:

1. **Resource owner** is your **user account**, not an organization.
2. **Repository access** is set to **Public repositories**, even if you will be using it with private repositories. This is required for the "Copilot Requests" permission to be available.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be bolded. Half the room in my team changed the setting.

@dsyme dsyme merged commit 1e8d7df into main Feb 27, 2026
96 checks passed
@dsyme dsyme deleted the upd-copilot-auth-docs branch February 27, 2026 13:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants