debug: Copilot rejects successfully minted GitHub App installation token #1745

Diagnostic Summary

• Pipeline: Private Azure DevOps stage-template workflow
• Definition ID: Redacted
• Build ID: Redacted
• Run URL: Redacted (private Azure DevOps organization)
• Result: Failed
• Failing stage/job/step: Stage 1 → Agent → Run copilot (AWF network isolated)
• First failed timeline record: Run copilot (AWF network isolated) task
• Suspected root cause: The GitHub App installation token is minted successfully, but the App installation or owning organization is not enabled/approved for organization-backed Copilot authentication. The App requests copilot_requests: write, so the unresolved distinction is the installation/org-side capability described in docs/engine.md.
• Confidence: Medium-high

Evidence

Relevant log excerpts

[github-app-token] minted installation token for owner '<redacted>' (installation <redacted>, 1 repo(s)) -> $(GITHUB_APP_TOKEN)
Error: Authentication failed
Your GitHub token may be invalid, expired, or lacking the required permissions.

The failure occurs immediately when Copilot CLI starts. It makes successful firewall tunnels to api.github.com and api.githubcopilot.com; no MCP tool call or model request runs.

Timeline observations

• Secret download succeeded.
• Mint GitHub App token (Copilot engine auth) succeeded.
• AWF, MCPG, SafeOutputs HTTP server, Docker, and Copilot CLI installation all succeeded.
• Agent failed only at Copilot authentication.
• Detection and SafeOutputs were skipped as expected after the Agent failure; Conclusion ran.
• Three runs of this definition failed identically; there is no successful baseline.

Changes since last successful build

• No previous successful build exists for this definition.
• Equivalent workflows in two other private repositories work with another GitHub App.

Environment

• Agent source file: Private repository path, redacted
• Compiled pipeline YAML: Present and wiring matches source
• Compilation in sync: Yes (pipeline integrity step succeeded; IR inspection matches generated token wiring)
• ado-aw version: 0.45.1
• AWF version: 0.27.9
• MCPG version: 0.27.9
• Agent pool: Microsoft-hosted Ubuntu
• OS/image: ubuntu-22.04
• Engine/model: copilot 1.0.72-1 / gpt-5.6-sol
• Relevant MCP servers: SafeOutputs only

Analysis

• Stage classification: Stage 1 (Agent)
• Why this stage failed: The compiler correctly minted an installation token and mapped $(GITHUB_APP_TOKEN) to the Copilot step's GITHUB_TOKEN. The token mint proves the private key, App ID, owner, installation lookup, and repository selection are valid. The same compiler version and Copilot CLI version work with another App. Network access to both GitHub API endpoints succeeded. The failing App's public metadata requests copilot_requests: write, but the installation's effective grant/org-backed Copilot eligibility could not be inspected with the available user token. This points to the App installation or owning org not having the required Copilot capability approved/enabled.

Root Cause

• Root cause: GitHub App/org-side Copilot authentication eligibility or installation approval is missing/incomplete; this is outside the generated ADO token wiring.
• Category: User configuration
• Ruled-out causes: Missing private key, invalid App ID, missing installation, wrong repository selection, compiler token wiring, AWF/firewall denial, MCPG failure, unavailable Copilot CLI, and CLI-version regression.
• Related recent changes: New GitHub App configuration; no successful run exists with this App.

Issue

• Title: debug: Copilot rejects successfully minted GitHub App installation token
• Label: question (user-configuration is not available in this repository)

A documentation improvement that exposes how to verify the installation's effective Copilot capability (not only the App's requested permissions) would make this failure actionable.