Files

Devraj Mehta 0d854367d9 Add step to warn about unnecessary write permissions

Probes the github-token for write access to actions, checks, contents,
deployments, issues, packages, pages, pull-requests, security-events,
and statuses. Emits a visible warning if any write scopes are detected.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-03-16 23:14:29 -04:00

1.7 KiB

Raw Permalink Blame History

setup-copilot

A GitHub Action to install the GitHub Copilot CLI in your workflow.

Usage

steps:
  - uses: actions/setup-copilot@v0
    with:
      version: "latest" # optional, defaults to "latest"
      github-token: ${{ secrets.GITHUB_TOKEN }} # optional, defaults to github.token
  - run: copilot --version

Inputs

Input	Description	Required	Default
`version`	Version to install (`latest`, `prerelease`, or a specific version like `1.0.0`)	No	`latest`
`github-token`	GitHub token for downloading Copilot CLI	No	`github.token`

Outputs

Output	Description
`version`	The version of Copilot CLI installed

Examples

Install latest version

- uses: actions/setup-copilot@v0

Install a specific version

- uses: actions/setup-copilot@v0
  with:
    version: "1.2.3"

Use with a custom token

- uses: actions/setup-copilot@v0
  with:
    github-token: ${{ secrets.GH_TOKEN }}

How it works

This action uses the official Copilot CLI install script to download and install the binary, with checksum verification. The binary is installed to the runner's tool cache and added to PATH.

License

MIT

Contributions

Contributions are welcome! See Contributor's Guide

Code of Conduct

👋 Be nice. See our code of conduct

1.7 KiB Raw Permalink Blame History