Using secrets in copilot agent environment

[mortenvp]

Select Topic Area

Question

Copilot Feature Area

Copilot Agent Mode

Body

You can provide copilot-setup-steps.yml, and if you use your organization secret in there to clone private repos, that works fine during normal workflow execution. But when Copilot runs as an agent, it does not seem to have access to organization secrets. This means the access token is not available.

To fix this, you need to define a Copilot environment. Go to:

repo -> settings -> environments -> copilot

Here you can add the secret that Copilot should use.

It seems you must add the secret in both places if you want to:

1. test the workflow by triggering it manually (this uses the organization secret), and

2. allow Copilot to use it inside an agent session (this uses the Copilot environment secret).

I created a secret with the same name in both places - but is this the right way?

[phanduykhai05]

Yes, defining the same secret in both the org/repo secrets and the Copilot environment is the correct and necessary approach
Copilot Agent Mode does not inherit organization secrets, so duplicating them is currently required.

[jvilimek]

I experimented with the coding agent, and 2025/09 it was possible to use the organization-scoped secret. It seemed to be changed, though :/

Any plans to allow organization-wide copilot environment secrets?

[jvilimek]

Can someone from Github also elaborate, how to test such workflows? Like now, when someone change the setup workflow, during PR the workflow is executed and works fine, as it grabs the token from the org-scope. When executed during @copilot work, it fails obviously :(

[jvilimek]

Also, seems duplicate to https://github.com/orgs/community/discussions/177690

[wvxi]

Hey there, Please any res´ponse for this case? have been passed many months from this issue creation

[mortenvp]

I did what https://github.com/orgs/community/discussions/180346#discussioncomment-15071753 suggested and it worked for me. Have you tried that?