|
| 1 | +# Secrets management |
| 2 | + |
| 3 | +This document covers secrets management for the github/copilot-sdk repository. It lists the GitHub Actions secrets that maintainers must keep configured and not expired. |
| 4 | + |
| 5 | +> [!WARNING] |
| 6 | +> If any of these secrets expire or are revoked, the corresponding workflows will fail silently or with opaque permission errors. Review this list periodically and rotate secrets before they expire. |
| 7 | +
|
| 8 | +## SDK test secrets |
| 9 | + |
| 10 | +These secrets are used by the per-language SDK test workflows and the canary workflow. |
| 11 | + |
| 12 | +* **`COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY`**: HMAC key used to authenticate with the Copilot Developer CLI integration endpoint during tests. Injected as `COPILOT_HMAC_KEY` in test environments. |
| 13 | + * Workflows: `nodejs-sdk-tests.yml`, `python-sdk-tests.yml`, `go-sdk-tests.yml`, `dotnet-sdk-tests.yml`, `rust-sdk-tests.yml`, `sdk-canary.yml` |
| 14 | + |
| 15 | +## Agentic workflow secrets |
| 16 | + |
| 17 | +These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage, code generation, and release automation. |
| 18 | + |
| 19 | +* **`COPILOT_GITHUB_TOKEN`**: GitHub OAuth token consumed by the Copilot CLI for AI authentication. Required by all agentic workflows when invoking `copilot` for AI inference. |
| 20 | + * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-check.yml`, `java-codegen-fix.lock.yml`, `java-smoke-test.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` |
| 21 | + |
| 22 | +* **`GH_AW_GITHUB_TOKEN`**: Optional GitHub token override for repository operations (reading code, creating pull requests, and making GitHub API calls). If unset, workflows use the automatic `GITHUB_TOKEN`. |
| 23 | + * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` |
| 24 | + |
| 25 | +* **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Optional token override for the GitHub MCP server container. If unset, workflows fall back to `GH_AW_GITHUB_TOKEN` and then the automatic `GITHUB_TOKEN`. |
| 26 | + * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml` |
| 27 | + |
| 28 | +* **`GH_AW_CI_TRIGGER_TOKEN`**: Token used to trigger CI workflows from within agentic workflow runs. |
| 29 | + * Workflows: `java-codegen-fix.lock.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml` |
| 30 | + |
| 31 | +* **`RUNTIME_TRIAGE_TOKEN`**: GitHub token with issue write access to both `github/copilot-sdk` and `github/copilot-agent-runtime`, and read access to `github/copilot-agent-runtime` contents. Used to clone that repository, add labels to the source issue, create linked runtime issues, and make GitHub API calls. |
| 32 | + * Workflows: `cross-repo-issue-analysis.lock.yml` |
| 33 | + |
| 34 | +## Java publishing secrets |
| 35 | + |
| 36 | +These secrets are used by the Java SDK Maven Central publishing workflow (`java-publish-maven.yml`) and the snapshot publishing workflow (`java-publish-snapshot.yml`). |
| 37 | + |
| 38 | +* **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username generated by a Maven Central Portal user token. |
| 39 | + * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml` |
| 40 | + |
| 41 | +* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication. |
| 42 | + * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml` |
| 43 | + |
| 44 | +* **`JAVA_GPG_SECRET_KEY`**: GPG private key used to sign Java release artifacts for Maven Central. |
| 45 | + * Workflows: `java-publish-maven.yml` |
| 46 | + |
| 47 | +* **`JAVA_GPG_PASSPHRASE`**: Passphrase for the GPG signing key. |
| 48 | + * Workflows: `java-publish-maven.yml` |
| 49 | + |
| 50 | +* **`JAVA_RELEASE_TOKEN`**: GitHub token with **push** permission on the repository. Used by the release workflow for `actions/checkout`, pushing release commits and tags to `main`, and running `mvn release:prepare -DpushChanges=true`. |
| 51 | + * Workflows: `java-publish-maven.yml` |
| 52 | + |
| 53 | +* **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission on this repository and `github/copilot-sdk-java`. Used to trigger the `release-changelog.lock.yml` workflow and the documentation site deployment after a release is published. |
| 54 | + * Workflows: `java-publish-maven.yml` |
| 55 | + |
| 56 | +## Rust publishing secret |
| 57 | + |
| 58 | +* **`CARGO_REGISTRY_TOKEN`**: Authentication token for publishing the Rust SDK crate to crates.io. |
| 59 | + * Workflows: `publish.yml` |
| 60 | + |
| 61 | +## Secrets not managed in this repository |
| 62 | + |
| 63 | +* **`GITHUB_TOKEN`**: Automatically provided by GitHub Actions. No manual management required. |
| 64 | + |
| 65 | +## Further reading |
| 66 | + |
| 67 | +* [GitHub docs: Using secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) |
| 68 | +* [Repository secrets settings](https://github.com/github/copilot-sdk/settings/secrets/actions) (maintainer access required) |
0 commit comments