1. Documentation
  2. Providers
  3. GitHub Copilot
ReadmeMarketplaceGitHub
  • Introduction
  • Quickstart
  • Supported providers
  • API-key providers
  • GitHub Copilot
  • OpenAI Codex
  • Amazon Bedrock
  • Action inputs
  • Reporting and severity
  • Audit lifecycle
  • Incremental audits
  • Safety boundaries
  • Troubleshooting

GitHub Copilot

Use an externally supplied GitHub Copilot access token.

Loading documentation…

API-key providers< PreviousOpenAI CodexNext >

Powered by heyo

On this page

Token handling

GitHub Copilot uses Pi's github-copilot provider with auth-type: oauth. The Action cannot open Pi's interactive /login flow or refresh a token, so the workflow must supply an access token that remains valid for the complete audit.

yaml
with:  provider: github-copilot  model: claude-sonnet-4.5  auth-type: oauth  auth-token: ${{ secrets.GITHUB_COPILOT_TOKEN }}  github-token: ${{ github.token }}

The available Copilot models depend on your Copilot plan and enabled model access. Select a model available to the token's account or organization.

Token handling

  • Store the token in an Actions secret, for example GITHUB_COPILOT_TOKEN.
  • Ensure it remains valid for the audit; Heyo cannot renew it.
  • Keep github-token separate. It is used only to read pull-request metadata and publish the Check and review.

See Pi's GitHub Copilot notes for subscription and model-enablement requirements.