deps: upgrade Microsoft.Agents.AI.GitHub.Copilot to 1.14.0-rc1 + GitHub.Copilot.SDK to 1.0.7#1519
Merged
tamirdresher merged 4 commits intoJul 21, 2026
Conversation
…tHub.Copilot.SDK to 1.0.7 Upgrades both packages together to resolve the version-range mismatch left by Dependabot PR #1508, which only bumped GitHub.Copilot.SDK to 1.0.7 without also bumping Microsoft.Agents.AI.GitHub.Copilot. The 1.11.0-rc1 adapter's nuspec did not declare a compatible range for SDK 1.0.7, so an SDK-only bump was incomplete. Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1 is the first adapter release after upstream microsoft/agent-framework#6949 and requires GitHub.Copilot.SDK >= 1.0.5, so SDK 1.0.7 now satisfies its own nuspec. No source changes were required. All Squad.Agents.AI usage (CopilotClient, CopilotClientOptions, SessionConfig, PermissionHandler.ApproveAll, the GitHub.Copilot namespace, ConfigDirectory, and the SessionEvent subtypes consumed by SquadSubagentTraceMapper) is unaffected by the 29 breaking API changes between SDK 1.0.3 and 1.0.7 -- all of them are in RPC/server/canvas/ MCP/model-billing types Squad does not reference. Verified with dnx dotnet-inspect: Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1's assembly reference to GitHub.Copilot.SDK carries public key token cc7b13ffcd2ddd51, matching GitHub.Copilot.SDK 1.0.7's own strong-name token, confirming a single compatible strong-named lineage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f
Contributor
🟡 Impact Analysis — PR #1519Risk tier: 🟡 MEDIUM 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (1 file)
root (3 files)
scripts (1 file)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 4 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ✅ | CI passing | All checks passing |
Files Changed (5 files, +575 −5)
| File | +/− |
|---|---|
.github/workflows/squad-agents-ai-ci.yml |
+106 −0 |
Directory.Build.props |
+64 −0 |
scripts/verify-squad-agents-ai-consumer.ps1 |
+311 −0 |
src/Squad.Agents.AI/README.md |
+1 −1 |
src/Squad.Agents.AI/Squad.Agents.AI.csproj |
+93 −4 |
Total: +575 −5
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the .NET Squad.Agents.AI package’s Copilot-related NuGet dependencies to keep the adapter (Microsoft.Agents.AI.GitHub.Copilot) and SDK (GitHub.Copilot.SDK) versions compatible and in sync.
Changes:
- Bump
Microsoft.Agents.AI.GitHub.Copilotfrom1.11.0-rc1to1.14.0-rc1. - Bump the direct
GitHub.Copilot.SDKreference from1.0.3to1.0.7(retaining the direct reference so the SDK MSBuild targets still run).
…e NU5104 Reviewer findings on PR #1519 (SDK 1.14.0-rc1 / GitHub.Copilot.SDK 1.0.7 upgrade) both confirmed against real CI logs and fixed: 1. Native payload propagation. Microsoft.Agents.AI.GitHub.Copilot ships GitHub.Copilot.SDK's CLI-download build/ targets to transitive consumers via a buildTransitive/ bridge that defaults to the SDK version the adapter itself was packed against (1.0.5, its nuspec dependency floor), not the version Squad.Agents.AI actually references (1.0.7). Verified in PR #1519 run 29856026557: "Build package" downloaded Copilot CLI 1.0.71 (src/Squad.Agents.AI has the direct GitHub.Copilot.SDK PackageReference), while "Build tests" and "Build sample" downloaded the stale CLI 1.0.67 on both ubuntu-latest and windows-latest, because neither project has that direct reference. Fixed via the documented override contract (_MicrosoftAgentsAICopilotSdkVersion) that Microsoft.Agents.AI.GitHub.Copilot.targets itself exposes for exactly this purpose: - Directory.Build.props sets it repo-wide from a new single source of truth, SquadCopilotSdkVersion, fixing test/Squad.Agents.AI.Tests and samples/Squad.Agents.AI.Sample. - Squad.Agents.AI.csproj generates and packs its own buildTransitive/Squad.Agents.AI.props at pack time (mirroring how the adapter package itself does it) so REAL external NuGet consumers of Squad.Agents.AI get the same fix, not just this repo's internal ProjectReference-based projects. - GitHub.Copilot.SDK PackageReference now uses $(SquadCopilotSdkVersion) instead of a literal, so the two can never drift apart again. Added scripts/verify-squad-agents-ai-consumer.ps1, a hermetic consumer-level packaging check: packs Squad.Agents.AI, restores a scratch consumer against only the local nupkg + nuget.org, builds it for the runner's RID, and asserts the native Copilot CLI executable and runtime.node-derived library land under runtimes/*/native/ at the expected CLI version, with no stale 1.0.67 payload anywhere. Wired into squad-agents-ai-ci.yml (runs on both ubuntu-latest and windows-latest), alongside a lighter in-repo regression guard that checks the same thing for src/test/sample directly. Neither check executes the downloaded CLI binary or touches package source/TLS policy. 2. NU5104. Squad.Agents.AI was versioned as stable (0.5.5) while depending on prerelease Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1, so `dotnet pack` emitted NU5104. Bumped to 0.5.6-rc1 (smallest correct next prerelease, matching the adapter's own "-rc1" convention) instead of suppressing the warning, since a genuinely mixed stable/prerelease dependency graph is exactly what NU5104 exists to flag. Verified `dotnet pack` no longer emits NU5104. dev->main promotions already require bumping <Version> by hand before a stable release (see squad-agents-ai-release.yml), so this does not block a future GA publish once Microsoft.Agents.AI.GitHub.Copilot itself leaves prerelease. Validated locally: single resolved GitHub.Copilot.SDK 1.0.7 across net8.0/net9.0/net10.0 for all three projects, no NU1605/NU1608/NU5104, no vulnerable packages, 82/82 tests passing on all three TFMs, and a real scratch PackageReference-only consumer (no ProjectReference, no Directory.Build.props visible) correctly attempting Copilot CLI 1.0.71 (not 1.0.67). Actual binary download could not be exercised end-to-end in this sandboxed dev environment (outbound TLS to registry.npmjs.org is blocked here, independent of CLI version); this is expected to complete normally on GitHub-hosted runners exactly as the existing CI already does today. Refs #1519, #1508 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
…consumer check
The .NET windows-latest job's consumer packaging check failed with NU1301
("local source ...\https:\api.nuget.org\v3\index.json doesn't exist"): passing
two --source values to `dotnet restore` from this PowerShell script produced
a bogus combined path on Windows (ubuntu-latest resolved the same two
--source arguments correctly). Replaced the --source flags with a scratch
nuget.config colocated with the scratch consumer project, listing the same
two sources (nuget.org over HTTPS, local nupkgs folder). This is picked up
automatically by dotnet restore/build on both platforms and avoids the
platform-specific argument-passing quirk entirely.
Verified locally on Windows: restore now succeeds and the build correctly
attempts Copilot CLI 1.0.71 (failing only on this sandbox's expected
outbound TLS block to registry.npmjs.org, unrelated to this fix).
Refs #1519
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f
… source proof Focused hardening pass on the PR #1519 packaging fix, addressing four reviewer-noted gaps directly coupled to it: 1. squad-agents-ai-ci.yml now includes scripts/verify-squad-agents-ai-consumer.ps1 in both pull_request.paths and push.paths, so a script-only change to the consumer check itself triggers the AI CI workflow instead of silently going unvalidated. 2. Squad.Agents.AI.csproj's GenerateCopilotSdkVersionBridge target no longer hand-builds the packed buildTransitive/Squad.Agents.AI.props file from entity-escaped string literals. It now uses a small inline RoslynCodeTaskFactory task built on System.Xml.Linq (XDocument/XElement), so the interpolated $(SquadCopilotSdkVersion) value is escaped exactly as the .NET XML writer itself defines, not by ad hoc replacement. scripts/verify-squad-agents-ai-consumer.ps1 was rewritten the same way: the scratch .csproj and nuget.config it generates are built with System.Xml.Linq (XElement/XAttribute) instead of string interpolation, so PackageVersion, TargetFramework and the local nupkgs path are all escaped correctly regardless of content. Verified locally that the generated buildTransitive/Squad.Agents.AI.props still parses as valid XML with the exact expected value after this change. 3. CopilotCliVersion is untrusted content sourced from a third-party NuGet package (GitHub.Copilot.SDK), so it is now validated in squad-agents-ai-ci.yml against a narrow grammar (^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.]*)?$) immediately after being parsed and before being written to $GITHUB_OUTPUT, rejecting empty, multiline, or otherwise malformed values loudly. The two downstream steps that previously interpolated ${{ steps.copilot-cli-version.outputs.cli-version }} directly into their run: script bodies now instead receive it via an env: mapping (EXPECTED_COPILOT_CLI_VERSION), which GitHub Actions passes as a plain environment variable rather than substituting into the script text, removing the script-injection surface entirely. scripts/verify-squad-agents-ai-consumer.ps1 independently re-validates ExpectedCopilotCliVersion and every ForbiddenCopilotCliVersions entry against the same grammar as its very first action, regardless of how it is invoked. 4. The scratch consumer's nuget.config now uses NuGet Package Source Mapping: the Squad.Agents.AI package id is mapped to ONLY the local nupkgs folder this same job just produced, while a "*" catch-all keeps every other (transitive) dependency resolving from nuget.org as before, so future dependencies never need to be enumerated by hand. On top of that, deterministic mapping, the script now also computes the SHA512 of the freshly packed local nupkg and compares it, after restore, against the .nupkg.sha512 NuGet itself writes into the global packages cache for whatever it actually extracted, failing loudly on any mismatch. Verified locally that this hash check passes for a genuinely fresh restore and that clearing this repo's own stale global-cache entry from earlier local testing was required to reproduce a clean pass, confirming the check is sensitive to exactly the failure mode it targets. Validation: dotnet restore/build for all three projects clean (0 errors, the same 12 pre-existing XML-doc warnings, no NU1605/NU1608/NU5104); dotnet test 82/82 passing on net8.0/net9.0/net10.0; dotnet pack succeeds with no NU5104; the repo-internal Copilot CLI version guard and the consumer packaging script both still correctly resolve Copilot CLI 1.0.71 (never 1.0.67) end to end locally, including the new Package Source Mapping and SHA512 checks. squad-agents-ai-ci.yml's existing "permissions: contents: read" is unchanged; no new permissions were added. Refs #1519 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update: independent remediation of review findings (commits 50f1212, 02bd4d6)
An independent review (not the original PR author) verified two blocking findings against real CI logs on this PR and resolved both:
1. Native payload propagation.
Microsoft.Agents.AI.GitHub.CopilotshipsGitHub.Copilot.SDK's CLI-downloadbuild/targets to transitive consumers via abuildTransitive/bridge file that, unless overridden, resolves the SDK version the adapter itself was packed against (1.0.5, its nuspec floor) rather than the version this repo actually references (1.0.7). Confirmed against this PR's own CI run 29856026557:Build package(src/Squad.Agents.AI, which has the directGitHub.Copilot.SDKreference) downloaded Copilot CLI1.0.71, whileBuild testsandBuild sample(no direct reference) downloaded the stale CLI1.0.67, on bothubuntu-latestandwindows-latest.Fixed using the override contract
Microsoft.Agents.AI.GitHub.Copilot.targetsitself documents (_MicrosoftAgentsAICopilotSdkVersion):Directory.Build.propssets it repo-wide from a single source of truth (SquadCopilotSdkVersion), fixingtest/Squad.Agents.AI.Testsandsamples/Squad.Agents.AI.Sample.Squad.Agents.AI.csprojnow generates and packs its ownbuildTransitive/Squad.Agents.AI.propsat pack time (mirroring how the adapter package itself does it), so real external NuGet consumers ofSquad.Agents.AIget the fix too, not just this repo's internal projects.GitHub.Copilot.SDKPackageReferencenow uses$(SquadCopilotSdkVersion)instead of a literal, so the two can never drift apart again.New
scripts/verify-squad-agents-ai-consumer.ps1: a hermetic consumer-level packaging check that packsSquad.Agents.AI, restores a scratch consumer against only the local nupkg + nuget.org, builds it for the runner's RID, and asserts the native Copilot CLI executable andruntime.node-derived library land underruntimes/*/native/at the expected CLI version with no stale1.0.67payload. Wired intosquad-agents-ai-ci.ymlon bothubuntu-latestandwindows-latest, alongside a lighter in-repo regression guard forsrc/test/sampledirectly. Neither check executes the downloaded CLI binary or touches package source/TLS policy.2. NU5104.
Squad.Agents.AIwas versioned as stable (0.5.5) while depending on prereleaseMicrosoft.Agents.AI.GitHub.Copilot 1.14.0-rc1, sodotnet packemittedNU5104. Bumped to0.5.6-rc1(smallest correct next prerelease, matching the adapter's own-rc1convention) instead of suppressing the warning, since a genuinely mixed stable/prerelease dependency graph is exactly whatNU5104exists to flag.dotnet packno longer emitsNU5104. A futuredev->mainpromotion already requires bumping<Version>by hand before a stable release (seesquad-agents-ai-release.yml), so this does not block a later GA publish once the adapter itself leaves prerelease.Validation: single resolved
GitHub.Copilot.SDK 1.0.7acrossnet8.0/net9.0/net10.0for all three projects, noNU1605/NU1608/NU5104, no vulnerable packages, 82/82 tests passing on all three TFMs, and both.NET ubuntu-latestand.NET windows-latestCI jobs green on this PR, including the new consumer packaging check with real Copilot CLI1.0.71downloads.Summary
Upgrades
Microsoft.Agents.AI.GitHub.Copilotto1.14.0-rc1and the directGitHub.Copilot.SDKreference to1.0.7together insrc/Squad.Agents.AI/Squad.Agents.AI.csproj.This supersedes the SDK-only Dependabot PR #1508 (kept open for independent review; not modified or closed by this PR). PR #1508 only bumps
GitHub.Copilot.SDKfrom 1.0.3 to 1.0.7 and is incomplete: the currently-pinnedMicrosoft.Agents.AI.GitHub.Copilot 1.11.0-rc1adapter's nuspec does not declare a compatible dependency range for SDK 1.0.7, so an SDK-only bump leaves a version-range mismatch.Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1is the first adapter release after upstream microsoft/agent-framework#6949 and requiresGitHub.Copilot.SDK >= 1.0.5, so both packages need to move together.Why both packages must move together
Microsoft.Agents.AI.GitHub.Copilot 1.11.0-rc1+GitHub.Copilot.SDK 1.0.3.Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1's nuspec requiresGitHub.Copilot.SDK >= 1.0.5for all three TFMs (net8.0/net9.0/net10.0), removing the version-range mismatch that would otherwise persist if only the SDK were bumped.GitHub.Copilot.SDKis1.0.7(satisfies>= 1.0.5); preview1.0.8-preview.0was intentionally not used.Verification evidence (via
dotnet-inspect)Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1(published 2026-07-21) dependency list:GitHub.Copilot.SDK >= 1.0.5on net8.0/net9.0/net10.0.GitHub.Copilot.SDK 1.0.7assembly: signed, Public Key Tokencc7b13ffcd2ddd51.Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1assembly's own reference toGitHub.Copilot.SDK(assembly version 1.0.5.0) carries the same Public Key Tokencc7b13ffcd2ddd51-- confirming a single, compatible strong-named lineage, no downgrade/assembly mismatch.diff --package GitHub.Copilot.SDK@1.0.3..1.0.7: 29 breaking / 307 additive / 1 potentially-breaking changes. All 29 breaking changes are in RPC/server/canvas/MCP/model-billing/sandbox types that Squad.Agents.AI does not reference. The types Squad actually uses (CopilotClient,CopilotClientOptions,SessionConfig,SessionConfigBase,PermissionHandler,RuntimeConnection, and theSessionEventsubtypes consumed bySquadSubagentTraceMapper:SubagentSelectedEvent,SubagentStartedEvent,SubagentCompletedEvent,SubagentFailedEvent,AssistantMessageEvent,ToolExecutionStartEvent,ToolExecutionCompleteEvent,SessionIdleEvent) show zero breaking changes -- only additive members.GitHub.Copilot.SDK(1.0.7) across net8.0/net9.0/net10.0 inproject.assets.json-- no downgrade/conflict.dotnet list package --vulnerable --include-transitive: no known vulnerabilities.Source changes
None required. Squad.Agents.AI's source already uses the current API surface (
using GitHub.Copilot;namespace,SessionConfig.ConfigDirectory, etc. -- these migrations happened in an earlier upgrade). None of the likely-candidate breaking APIs from upstream #6949 (UserMessageAttachmentFile->AttachmentFile,CopilotClientOptions.AutoStartremoval, permission/user-input callback signature changes,GHCP001/PermissionDecision) are referenced anywhere insrc/Squad.Agents.AIortest/Squad.Agents.AI.Tests(confirmed by repo-wide grep), so no source migration was applied -- only the twoPackageReferenceversion bumps.Native binary delivery (
copilot.exe)The direct
PackageReferencetoGitHub.Copilot.SDK(kept intentionally so its MSBuildbuild/targets fire and downloadcopilot.exeintobin/.../runtimes/{rid}/native/) is preserved. ComparedGitHub.Copilot.SDK.targetsbetween 1.0.3 and 1.0.7: theContentWithTargetPath->runtimes\$(_CopilotRid)\native\delivery mechanism is structurally unchanged (1.0.7 additionally copies a nativeruntime.nodeaddon under the same path -- additive, not a regression).Actual end-to-end download of the CLI binary could not be exercised in this sandboxed dev environment because outbound TLS to
registry.npmjs.orgis blocked here (verified this is an environment-wide restriction, not version-specific: the same TLS handshake failure occurs regardless of which SDK version's CLI is being downloaded). Build/test were therefore validated with-p:CopilotSkipCliDownload=trueto isolate compile-time/API compatibility from this unrelated network restriction. GitHub Actions runners have normal outbound internet access and run this same download step today for the currently-pinned version, so this is expected to work unchanged in CI.Build & test results (local,
-p:CopilotSkipCliDownload=trueto work around the sandboxed network restriction above)dotnet restore/dotnet build -c Releaseforsrc/Squad.Agents.AI/Squad.Agents.AI.csproj,test/Squad.Agents.AI.Tests/Squad.Agents.AI.Tests.csproj, andsrc/Squad.Agents.AI/samples/Squad.Agents.AI.Sample/Squad.Agents.AI.Sample.csproj: 0 errors across net8.0/net9.0/net10.0 (only pre-existing XML-doc warnings, confirmed unchanged before/after viagit stash).dotnet test: 82/82 passed.dotnet pack: succeeds (pre-existingNU5104"stable package should not have prerelease dependency" warning, unchanged from before since the previous adapter version was also-rc1).Changeset
No changeset added. Per
CONTRIBUTING.md, the changeset/CHANGELOG gate applies topackages/squad-sdk/src/andpackages/squad-cli/src/(the npm/TypeScript packages).src/Squad.Agents.AIis a separate .NET package with its own dedicated CI (squad-agents-ai-ci.yml) and release workflow (squad-agents-ai-release.yml), versioned via<Version>in the csproj -- not covered by the changesets gate. Following existing precedent (prior SDK-only dependency bumps such as #1316, #1359 did not bump<Version>either), the package<Version>was left at0.5.5; this is a pure dependency-version bump with no behavior change.Remaining risks / recommendation for #1508
copilot.exebinary download could not be verified end-to-end in this sandbox (see above); recommend confirming thesquad-agents-ai-ci.ymlmatrix build (ubuntu-latest + windows-latest, which have normal internet access) passes on this PR before merge.1.14.0-rc1is a prerelease adapter version, consistent with the existing1.11.0-rc1pin (no new prerelease risk introduced).Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com
Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com
Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f