compile re-adds a COPILOT_GITHUB_TOKEN reference even when `copilot-requests: write` is set (v0.82.7+)

[remypanicker]

Summary

We pin gh-aw and rely on PAT-free, org-billed Copilot inference by declaring copilot-requests: write in the workflow permissions: block (so the Copilot engine authenticates via the Actions github.token and does not need a COPILOT_GITHUB_TOKEN PAT). This worked on v0.81.6: the compiled .lock.yml contained no secrets.COPILOT_GITHUB_TOKEN reference and no COPILOT_GITHUB_TOKEN entry in the generated manifest secrets array.

Starting with v0.82.7 (and still in v0.85.4), a recompile of the same unchanged source re-introduces a COPILOT_GITHUB_TOKEN PAT reference, via a new "Check for OAuth tokens" step whose env includes COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}, and adds COPILOT_GITHUB_TOKEN back to the # gh-aw-manifest: secrets array — even though the source declares copilot-requests: write.

Question / request

When copilot-requests: write is declared (i.e. the workflow opts into org-billed Copilot via github.token), is there a supported way to prevent the compiler from emitting the secrets.COPILOT_GITHUB_TOKEN reference / re-adding it to the manifest secrets array? Our security policy tracks the presence of that PAT reference in generated locks and treats its re-introduction as a regression, which currently blocks us from upgrading past v0.81.6.

Reproduction

Source workflow frontmatter (excerpt):

permissions:
  contents: read
  copilot-requests: write   # Copilot engine auth via github.token (org-billed, no PAT)
engine: copilot

Compile the same source with each CLI version and diff the generated .lock.yml:

• v0.81.6: manifest secrets = [GH_AW_GITHUB_MCP_SERVER_TOKEN, GH_AW_GITHUB_TOKEN, GITHUB_TOKEN]; no secrets.COPILOT_GITHUB_TOKEN anywhere.
• v0.82.7 and v0.85.4: manifest secrets gains COPILOT_GITHUB_TOKEN; a new "Check for OAuth tokens" step references COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}.

Environment

• Observed with the copilot engine and copilot-requests: write.
• Versions compared: v0.81.6 (good), v0.82.7 (regressed), v0.85.4 (regressed).

Happy to provide a fuller redacted lock diff if useful. Thanks!

[pelikhan]

@copilot add a test that COPILOT_GITHUB_TOKEN is not present in the lock.yml file when copilot-requests: write is enabled. Fix compiler.