Support github-app: auth in dependencies: for cross-org APM packages

[Copilot]

APM dependencies: fails for cross-org private repos because the default GITHUB_TOKEN is org-scoped. The token was also generated after the APM pack step, making it unavailable even when configured elsewhere.

Changes

• APMDependenciesInfo — added GitHubApp *GitHubAppConfig field
• extractAPMDependenciesFromFrontmatter — parses github-app: from object format; silently ignores incomplete configs (missing app-id or private-key)
• buildAPMAppTokenMintStep — new function generating an actions/create-github-app-token step with id apm-app-token, supporting explicit owner/repositories and ["*"] for org-wide access; accepts a fallbackRepoExpr parameter (matching the pattern of buildGitHubAppTokenMintStep) so the correct repository scope is used in workflow_call relay scenarios
• buildActivationJob — mints the APM app token before the pack step when GitHubApp is set; in workflow_call relay workflows passes ${{ steps.resolve-host-repo.outputs.target_repo_name }} as the fallback repository so the token is scoped to the platform (host) repo rather than the caller repo
• GenerateAPMPackStep — injects GITHUB_TOKEN: ${{ steps.apm-app-token.outputs.token }} in env: when GitHubApp is configured
• JSON schema — github-app added to the dependencies object format
• smoke-claude.md — updated to use github-app: config (${{ vars.APP_ID }} / ${{ secrets.APP_PRIVATE_KEY }}) for its APM dependency, consistent with the credential pattern from shared/safe-output-app.md

Usage

dependencies:
  github-app:
    app-id: ${{ vars.APP_ID }}
    private-key: ${{ secrets.APP_PRIVATE_KEY }}
    repositories:
      - acme-skills        # or ["*"] for all repos in the installation owner
  packages:
    - acme-platform-org/acme-skills/plugins/dev-tools

Compiled output ordering is now:

1. Generate GitHub App token for APM dependencies (id: apm-app-token)
2. Install and pack APM dependencies (with env.GITHUB_TOKEN set to the minted token)

Simple array format and existing object format (packages: + isolated:) are unchanged.

workflow_call relay support

In cross-repo workflow_call scenarios (including event-driven relays via issue_comment/push), github.event.repository.name refers to the caller repo rather than the platform (host) repo where the GitHub App is installed. The compiler now automatically uses ${{ steps.resolve-host-repo.outputs.target_repo_name }} — already computed earlier in the activation job — as the repository scope when a workflow_call trigger is present, ensuring the minted token is always scoped to the correct repository.

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

[pelikhan]

@copilot update agentic workflow that uses dependencies to also configure the github-app based on the shared/safe-output-app.md info

[Copilot]

@copilot update agentic workflow that uses dependencies to also configure the github-app based on the shared/safe-output-app.md info

Updated smoke-claude.md in c4e1398 to use the object format with github-app: credentials matching shared/safe-output-app.md (${{ vars.APP_ID }} / ${{ secrets.APP_PRIVATE_KEY }}):

dependencies:
  github-app:
    app-id: ${{ vars.APP_ID }}
    private-key: ${{ secrets.APP_PRIVATE_KEY }}
  packages:
    - microsoft/apm-sample-package

The compiled lock file now mints the app token before the APM pack step and injects it as GITHUB_TOKEN.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Adds GitHub App-based authentication support for APM dependencies: so workflows can pack/install private cross-org APM packages by minting an installation token before the APM pack step.

Changes:

• Extend dependencies: object format to accept github-app config and parse it from frontmatter.
• Generate an actions/create-github-app-token step (id: apm-app-token) before the APM pack step and inject the minted token via env.GITHUB_TOKEN.
• Update schema, docs, and smoke workflow fixtures; add/extend unit tests for parsing and step generation.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/workflow/frontmatter_types.go	Adds GitHubApp field to APM dependency configuration type.
pkg/workflow/frontmatter_extraction_metadata.go	Parses dependencies.github-app from object format and wires it into extracted config.
pkg/workflow/compiler_activation_job.go	Emits the GitHub App token-mint step before the APM pack step when configured.
pkg/workflow/apm_dependencies.go	Implements token mint step generation and injects minted token into APM pack step env.
pkg/workflow/apm_dependencies_test.go	Adds tests for github-app parsing and token/env step rendering; refactors step string combining.
pkg/parser/schemas/main_workflow_schema.json	Adds github-app to dependencies object format schema.
docs/src/content/docs/reference/frontmatter.md	Documents array vs object formats and shows GitHub App auth example.
docs/src/content/docs/reference/dependencies.md	Adds dedicated section documenting GitHub App auth fields/usage for APM dependencies.
.github/workflows/smoke-claude.md	Updates smoke workflow frontmatter to use dependencies.github-app object format.
.github/workflows/smoke-claude.lock.yml	Updates compiled workflow to include token mint step and injected GITHUB_TOKEN env.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[pelikhan]

@copilot review generated code and ensure it works in the context of workflow_call in different repository.

[Copilot]

@copilot review generated code and ensure it works in the context of workflow_call in different repository.

Fixed in b5c9927. buildAPMAppTokenMintStep now accepts a fallbackRepoExpr parameter (same pattern as buildGitHubAppTokenMintStep). In the activation job, when a workflow_call trigger is present and imports are not inlined, the compiler passes ${{ steps.resolve-host-repo.outputs.target_repo_name }} as the fallback — which is already computed by that point — so the minted token is scoped to the platform (host) repo's name rather than github.event.repository.name (the caller repo). When no fallback is passed (non-workflow_call workflows), it falls back to github.event.repository.name as before.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD erignore go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility /tmp/go-build189remote.origin.url -trimpath r: $owner, name: $name) { hasDiscussionsEnabled } } -p github.com/githu-C -lang=go1.25 go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go node (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)