Function buildSecretVerificationContext

actions/setup/js/handle_agent_failure.cjs:2194–2211

* For the Copilot engine, adds a suggestion to use `permissions.copilot-requests: write` * to enable Copilot inference through the org without a personal access token. * @param {string} secretVerificationResult - The secret verification result ("failed" or other) * @param {string} engineId - The

(secretVerificationResult, engineId)

 * @returns {string} Formatted context string, or empty string if verification did not fail
 */
function buildSecretVerificationContext(secretVerificationResult, engineId) {
  if (secretVerificationResult !== "failed") {
    return "";
  }

  let context =
    buildWarningAlertLine("Secret Verification Failed", "The workflow's secret validation step failed. Please check that the required secrets are configured in your repository settings.") +
    "\nFor more information on configuring tokens, see: https://github.github.com/gh-aw/reference/engines/\n";

  if ((engineId || "").toLowerCase() === "copilot") {
    context +=
      "\n**Alternative**: If your organization has a Copilot subscription, you can avoid the need for a personal access token by adding a top-level `permissions` block to your workflow file. This enables Copilot inference through the org using the built-in GitHub Actions token.\n" +
      "\n```yaml\npermissions:\n  copilot-requests: write\n```\n" +
      "\nSee: https://github.github.com/gh-aw/reference/engines/#github-copilot-default\n";
  }

  return context;
}

/**
 * Check whether agent-stdio.log contains a terminal_reason: "completed" result entry,