Skip to content

Fix PR reviewer auth: cap max-ai-credits at 100M instead of -1#1472

Merged
jonathanpeppers merged 1 commit into
mainfrom
jonathanpeppers/fix-pr-reviewer-auth
Jun 16, 2026
Merged

Fix PR reviewer auth: cap max-ai-credits at 100M instead of -1#1472
jonathanpeppers merged 1 commit into
mainfrom
jonathanpeppers/fix-pr-reviewer-auth

Conversation

@jonathanpeppers

Copy link
Copy Markdown
Member

Re: the changelog you mentioned — PR #1469 already handled https://github.blog/changelog/2026-06-11-agentic-workflows-no-longer-need-a-personal-access-token/ by adding copilot-requests: write and switching to GITHUB_TOKEN / org billing. Nothing else to do there.

This PR fixes the auth failure in run 27626399934. After #1471 landed, the reviewer started failing with:

Authentication failed with provider at http://172.30.0.30:10002 (HTTP 403).
[copilot-harness] awf-reflect: models fetch returned 403 for http://api-proxy:10002/models

Root cause: I had set max-ai-credits: -1 in #1471. The frontmatter spec says -1 "disables enforcement and token steering" — and token steering is exactly the mechanism the AWF firewall uses to inject Copilot provider credentials into outbound requests. With it off, the api-proxy refuses model calls.

Fix: change to max-ai-credits: 100M (effectively unlimited) so per-run cost is uncapped while token steering stays on. After recompiling, the lock file shows GH_AW_MAX_AI_CREDITS: "100000000" and enableTokenSteering:true is preserved.

max-daily-ai-credits: -1 is left as-is since that flag's -1 only toggles the daily guardrail and doesn't touch token steering.

Setting max-ai-credits: -1 disables token steering, which the AWF firewall needs to inject Copilot provider auth. The api-proxy returned HTTP 403 on /models and Copilot CLI bailed with 'Authentication failed with provider'.

Use 100M (effectively unlimited) instead so per-run cost is uncapped while token steering stays on.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 16, 2026 14:57

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adjusts the Agentic Workflow configuration for the Java.Interop PR reviewer so the firewall keeps token steering enabled (required for Copilot provider credential injection) while still effectively removing per-run AI credit enforcement.

Changes:

  • Set max-ai-credits to 100M in the reviewer workflow frontmatter to avoid disabling token steering.
  • Recompiled the workflow so the lock file preserves enableTokenSteering:true and sets GH_AW_MAX_AI_CREDITS to 100000000.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/java-interop-reviewer.md Updates per-run AI credit cap to 100M to keep token steering enabled.
.github/workflows/java-interop-reviewer.lock.yml Regenerated lock file reflecting maxAiCredits: 100000000 and enableTokenSteering:true.

jonathanpeppers added a commit to jonathanpeppers/xamarin-android that referenced this pull request Jun 16, 2026
Matches dotnet/java-interop#1472. Setting max-ai-credits: -1 disables enforcement *and token steering*, which causes the AWF api-proxy to return HTTP 403 when injecting Copilot provider credentials. 100M leaves token steering on while keeping per-run cost effectively uncapped.

max-daily-ai-credits: -1 is left as-is — that flag's -1 only toggles the daily guardrail and doesn't touch token steering.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jonathanpeppers added a commit to dotnet/android-tools that referenced this pull request Jun 16, 2026
Setting `max-ai-credits: -1` disables both AIC enforcement *and* token
steering, which is the mechanism the AWF firewall uses to inject
Copilot provider credentials into outbound requests. With it off, the
api-proxy returns 403 on model calls.

Use `100M` (effectively unlimited) so per-run cost is uncapped while
token steering stays on. After recompiling, the lock file shows
`GH_AW_MAX_AI_CREDITS: "100000000"` and `enableTokenSteering:true` is
preserved.

`max-daily-ai-credits: -1` is left as-is since that flag''s `-1` only
toggles the daily guardrail and doesn''t touch token steering.

Mirrors dotnet/java-interop#1472.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@jonathanpeppers jonathanpeppers merged commit fc30bd5 into main Jun 16, 2026
3 checks passed
@jonathanpeppers jonathanpeppers deleted the jonathanpeppers/fix-pr-reviewer-auth branch June 16, 2026 15:18
jonathanpeppers added a commit that referenced this pull request Jun 16, 2026
PR #1469 added `copilot-requests: write` to the java-interop-reviewer
workflow permissions block to opt into the new feature where gh-aw uses
the built-in GITHUB_TOKEN for Copilot CLI inference, with AI credits
billed to the org.

That feature requires the "Allow use of Copilot CLI billed to the
organization" Copilot policy to be enabled at the org level. The dotnet
org has not enabled that policy yet, so the workflow now fails with HTTP
403 from api.githubcopilot.com/models. See failing run:
https://github.com/dotnet/java-interop/actions/runs/27628125187/job/81695629467

Revert just the opt-in line in java-interop-reviewer.md and recompile
the lock file. After this merges, the COPILOT_GITHUB_TOKEN secret needs
to be re-added to the copilot-pr-reviewer environment so the PAT-based
flow works again.

Also revert max-ai-credits from 100M back to -1 (truly unlimited). PR
#1472 capped it at 100M based on a wrong theory that -1 was causing the
auth 403; that 403 reproduced under 100M too, so the cap wasn't the
issue and the user prefers -1.

The gh-aw CLI v0.79.8 bump and the agentics-maintenance.yml updates
from PR #1469 are intentionally left in place.

See: https://github.blog/changelog/2026-06-11-agentic-workflows-no-longer-need-a-personal-access-token/

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jonathanpeppers added a commit that referenced this pull request Jun 16, 2026
)

PR #1469 added `copilot-requests: write` to the java-interop-reviewer
workflow permissions block to opt into the new feature where gh-aw uses
the built-in GITHUB_TOKEN for Copilot CLI inference, with AI credits
billed to the org.

That feature requires the "Allow use of Copilot CLI billed to the
organization" Copilot policy to be enabled at the org level. The dotnet
org has not enabled that policy yet, so the workflow now fails with HTTP
403 from api.githubcopilot.com/models. See failing run:
https://github.com/dotnet/java-interop/actions/runs/27628125187/job/81695629467

Revert just the opt-in line in java-interop-reviewer.md and recompile
the lock file. After this merges, the COPILOT_GITHUB_TOKEN secret needs
to be re-added to the copilot-pr-reviewer environment so the PAT-based
flow works again.

Also revert max-ai-credits from 100M back to -1 (truly unlimited). PR
#1472 capped it at 100M based on a wrong theory that -1 was causing the
auth 403; that 403 reproduced under 100M too, so the cap wasn't the
issue and the user prefers -1.

The gh-aw CLI v0.79.8 bump and the agentics-maintenance.yml updates
from PR #1469 are intentionally left in place.

See: https://github.blog/changelog/2026-06-11-agentic-workflows-no-longer-need-a-personal-access-token/

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants