mirror of
https://github.com/zhom/donutbrowser.git
synced 2026-10-19 22:17:28 +02:00
52 lines
1.9 KiB
YAML
52 lines
1.9 KiB
YAML
name: Set up Copilot CLI
|
|
description: >-
|
|
Installs a pinned GitHub Copilot CLI and `copilot-locked`, a launcher that
|
|
runs it with everything that lets it act switched off.
|
|
|
|
inputs:
|
|
version:
|
|
description: The @github/copilot npm version to install.
|
|
required: false
|
|
default: "1.0.88"
|
|
|
|
outputs:
|
|
launcher:
|
|
description: Absolute path of `copilot-locked`. Pass it as `copilot-cli-path` to actions/ai-inference.
|
|
value: ${{ steps.install.outputs.launcher }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install Copilot CLI
|
|
id: install
|
|
shell: bash
|
|
env:
|
|
COPILOT_CLI_VERSION: ${{ inputs.version }}
|
|
run: |
|
|
# Pinned: the AI workflows run with write tokens next to text anyone
|
|
# can write, so a new CLI release must not change what they execute
|
|
# until someone bumps this on purpose. The package ships prebuilt
|
|
# binaries as optional dependencies and needs no install scripts.
|
|
npm install --global --no-audit --no-fund --ignore-scripts "@github/copilot@${COPILOT_CLI_VERSION}"
|
|
|
|
# The prompts carry issue bodies, pull request text and translations.
|
|
# Without repository instructions (AGENTS.md would be read as orders),
|
|
# built-in MCP servers (the GitHub server holds the token) or temp-dir
|
|
# access, and in prompt mode, which denies every tool that needs
|
|
# approval, the model can answer but cannot act.
|
|
launcher_dir="$RUNNER_TEMP/copilot-launcher"
|
|
mkdir -p "$launcher_dir"
|
|
cat > "$launcher_dir/copilot-locked" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
exec copilot "$@" \
|
|
--no-custom-instructions \
|
|
--disable-builtin-mcps \
|
|
--no-auto-update \
|
|
--disallow-temp-dir
|
|
EOF
|
|
chmod +x "$launcher_dir/copilot-locked"
|
|
echo "$launcher_dir" >> "$GITHUB_PATH"
|
|
echo "launcher=$launcher_dir/copilot-locked" >> "$GITHUB_OUTPUT"
|
|
|
|
copilot --version
|