Skip to content

Conversation

Copy link

Copilot AI commented Jan 9, 2026

GitHub platform limitation: organization-owned fine-grained PATs cannot have "Copilot Requests" permission, blocking CI/CD automation for org repos.

Changes

  • Token Setup section: Added "Organization Repositories" subsection documenting the two-token workaround pattern
  • Troubleshooting section: New entry explaining the limitation with root cause and solution
  • action.yml: Updated copilot-token and repo-token descriptions to clarify org repo usage
  • File encoding: Converted README.md from UTF-16 to UTF-8

Workaround Pattern

- uses: austenstone/copilot-cli@v2
  with:
    copilot-token: ${{ secrets.COPILOT_TOKEN }}  # User PAT with "Copilot Requests"
    repo-token: ${{ secrets.GITHUB_TOKEN }}      # Org token for repo operations

The copilot-token authenticates with Copilot API using a user-owned PAT, while repo-token handles repository operations with org credentials.

Original prompt

This section details on the original issue you should resolve

<issue_title>[Question] Copilot Requests permission unavailable for organization-owned repos, fine-grained PATs blocks CI/CD automation</issue_title>
<issue_description>### Question

Summary

When using GitHub Copilot CLI (@github/copilot) in GitHub Actions for organization repositories, authentication fails because fine-grained PATs cannot have both "Copilot Requests" permission AND organization repository access simultaneously.

Problem

Fine-grained Personal Access Tokens have a fundamental limitation:

Token Resource Owner Copilot Requests Permission Org Repository Access
Personal Account ✅ Available ❌ Limited
Organization ❌ Not Available ✅ Full Access

This forces users to choose between:

  1. A user-owned token with Copilot access but limited org repo visibility
  2. An org-owned token with repo access but no Copilot authentication

Use Case

We are trying to automate release notes generation using Copilot CLI in GitHub Actions:

- name: Generate release notes with Copilot
  env:
    COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_TOKEN }}
  run: |
    copilot -p "Generate release notes for changes in the last 7 days across all repos in 'our-org'" --allow-all-tools < /dev/null

Error

When using an org-owned fine-grained PAT (with repo access but no Copilot Requests permission):

The organization 'org-name' either doesn't exist or isn't accessible.

When using a user-owned fine-grained PAT (with Copilot Requests but limited org access):

  • Cannot access organization repositories

Expected Behavior

Organization-owned fine-grained PATs should have the "Copilot Requests" permission available, allowing enterprises to:

  • Use Copilot CLI in CI/CD pipelines
  • Access organization repositories with proper scoping</issue_description>

Comments on the Issue (you are @copilot in this section)


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Copilot AI and others added 2 commits January 9, 2026 12:06
…entation

Co-authored-by: austenstone <22425467+austenstone@users.noreply.github.com>
…ons and two-token workaround

Co-authored-by: austenstone <22425467+austenstone@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix Copilot requests permission issue for organization-owned repos Document fine-grained PAT limitation for organization repositories Jan 9, 2026
Copilot AI requested a review from austenstone January 9, 2026 12:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Question] Copilot Requests permission unavailable for organization-owned repos, fine-grained PATs blocks CI/CD automation

2 participants