Repo sync

.github/workflows/check-for-spammy-issues.yml

@@ -30,6 +30,7 @@ jobs:
             const titleWordCountMin = 3
             const urlRegex = /https?:\/\/\S+/i
             const titleHasUrl = urlRegex.test(issue.title)
+            const titleHasDollarSign = issue.title.includes('$')
 
             try {
               await github.rest.teams.getMembershipForUserInOrg({
@@ -45,7 +46,7 @@ jobs:
               // An error will be thrown if the user is not a GitHub employee
               // If a user is not a GitHub employee, we should check to see if title has at least the minimum required number of words in it and if it does, we can exit the workflow
 
-              if (titleWordCount >= titleWordCountMin && !titleHasUrl) {
+              if (titleWordCount >= titleWordCountMin && !titleHasUrl && !titleHasDollarSign) {
                 return
               }
             }

.github/workflows/send-to-triage-board.yml

@@ -0,0 +1,45 @@
+name: Add new issues and PRs to central triage board
+
+# **What it does**: Adds newly opened or reopened issues and pull requests in github/docs to the right place for triage, and stamps the item with today's date.
+# **Why we have it**: To ensure incoming work in the public docs repo is triaged properly.
+# **Who does it impact**: Writers, FRs.
+
+on:
+  issues:
+    types: [opened, reopened]
+  pull_request_target:
+    types: [opened, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  add-to-central-triage:
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/docs'
+    steps:
+      - name: Triage to central triage board
+        env:
+          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          ITEM_URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }}
+          # Add to the Central Triage Group project board and set date to now
+          PROJECT_NUMBER: '19598'
+          PROJECT_ID: 'PVT_kwDNJr_OAJ4AfQ'
+          DATE_FIELD_ID: 'PVTF_lADNJr_OAJ4Afc4IAbbv'
+        run: |
+          echo "Adding $ITEM_URL to project $PROJECT_NUMBER..."
+          ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner github --url "$ITEM_URL" --format json --jq '.id' || true)
+
+          sleep 10
+
+          if [ -n "$ITEM_ID" ] && [ "$ITEM_ID" != "null" ]; then
+            echo "Editing date on item $ITEM_ID..."
+            DATE=$(date '+%Y-%m-%d')
+            if gh project item-edit --project-id "$PROJECT_ID" --id "$ITEM_ID" --field-id "$DATE_FIELD_ID" --date "$DATE"; then
+              echo "done editing"
+            else
+              echo "::warning::gh project item-edit failed for $ITEM_URL (item $ITEM_ID); the item is on the board but the date field was not set"
+            fi
+          else
+            echo "::warning::gh project item-add did not return an item id for $ITEM_URL; skipping item-edit"
+          fi

content/copilot/concepts/agents/copilot-cli/about-copilot-cli.md

@@ -80,7 +80,7 @@ You can start a {% data variables.copilot.copilot_cli_short %} session inside an
 To start a cloud-backed session, run:
 
 ```bash copy
-copilot ‑‑cloud
+copilot --cloud
 ```
 
 ## Use cases for {% data variables.copilot.copilot_cli %}

content/copilot/how-tos/copilot-cli/automate-copilot-cli/schedule-prompts.md

@@ -73,7 +73,7 @@ The prompt fires once, after the delay has elapsed, and is then removed from the
 You can use `/every` and `/after` to schedule a skill. To do this, you can reference the skill explicitly by using its slash command, or you can use natural language to tell {% data variables.product.prodname_copilot_short %} to run the skill.
 
 > [!NOTE]
-> Only user-invocable skills can be scheduled this way. You cannot include built-in slash commands (such as `/clear`) in a scheduled prompt.
+> Only user-invocable skills and a subset of built-in slash commands can be scheduled. Commands that start a self-contained piece of work—such as `/plan`, `/review`, `/research`, or `/security-review`—are schedulable. Commands that change your session or configuration (for example, `/model`, `/clear`, `/compact`, `/permissions`, or `/sandbox`), that only display information (such as `/usage` or `/context`), or that manage scheduling itself (`/every` and `/after`) can't be scheduled, and {% data variables.product.prodname_copilot_short %} rejects them when you try.
 
 ### Examples
 
@@ -94,9 +94,11 @@ You can use `/every` and `/after` to schedule a skill. To do this, you can refer
 | `h`    | hours   | `2h`    |
 | `d`    | days    | `1d`    |
 
-A bare number with no suffix is interpreted as minutes—for example, `/every 30 remind me to check for Slack messages` schedules the prompt every 30 minutes.
+When you specify a numeric duration, always include the suffix. A bare number—for example, `/every 30 remind me to check for Slack messages`—is not recognized as an interval.
 
-The minimum interval is **10 seconds** and the maximum is **1 day** (24 hours).
+For a fixed interval, the minimum is **10 seconds** and the maximum is **1 day** (24 hours).
+
+You can also describe the timing in plain language instead of using a duration—for example, `/after at 3pm push the release`, or `/every day at 9am post the standup`. {% data variables.product.prodname_copilot_short %} uses a model to interpret the phrase, then creates the schedule from it.
 
 ## Identifying scheduled prompts in the session
 
@@ -116,9 +118,9 @@ Press <kbd>Esc</kbd> to exit the schedule list.
 
 Scheduled prompts are scoped to the session they were created in, and they are only triggered while that session is running.
 
-When you reopen the session (using the `--continue` or `--resume` command line options) the schedules are restarted, with interval before a schedule is triggered measured from the moment you reopen the session.
+When you reopen the session (using the `--continue` or `--resume` command line options) the schedules are restored. For a recurring schedule created with a fixed interval, the wait before the next run is measured from the moment you reopen the session.
 
-If an `/after` schedule had not been triggered before you closed the session, it remains in the schedule list and will be triggered after the specified delay in the reopened session.
+An `/after` schedule that had not been triggered before you closed the session keeps its original target time, rather than restarting the delay. If that time passed while the session was closed, the prompt is submitted as soon as you reopen the session.
 
 ## Running a prompt from an external scheduler
 

content/copilot/how-tos/copilot-cli/set-up-copilot-cli/authenticate-copilot-cli.md

@@ -18,9 +18,9 @@ If you use your own LLM provider API keys (BYOK), {% data variables.product.gith
 
 Authentication is required for any other {% data variables.copilot.copilot_cli %} usage.
 
-When authentication is required, {% data variables.copilot.copilot_cli_short %} supports three methods. The method you use depends on whether you are working interactively or in an automated environment.
+When authentication is required, {% data variables.copilot.copilot_cli_short %} supports several methods. The method you use depends on whether you are working interactively or in an automated environment.
 
-* **OAuth device flow**: The default and recommended method for interactive use. When you run `/login` in {% data variables.copilot.copilot_cli_short %}, the CLI generates a one-time code and directs you to authenticate in your browser. This is the simplest way to authenticate. See [Authenticating with OAuth](#authenticating-with-oauth).
+* **OAuth**: The default and recommended method for interactive use. There are two OAuth flows. The browser (web) flow opens your browser to authorize the sign-in and completes it on a local loopback callback. The device code flow displays a one-time code that you enter in your browser. The browser flow is the default on a local desktop, and known remote or headless environments (including SSH, {% data variables.product.prodname_github_codespaces %}, dev containers, and CI) default to the device code flow. See [Authenticating with OAuth](#authenticating-with-oauth).
 * **Environment variables**: Recommended for CI/CD pipelines, containers, and non-interactive environments. You set a supported token as an environment variable (`COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN`), and the CLI uses it automatically without prompting. See [Authenticating with environment variables](#authenticating-with-environment-variables).
 * **{% data variables.product.prodname_cli %} fallback**: If you have {% data variables.product.prodname_cli %} (`gh`) (note: the `gh` CLI, not `copilot`) installed and authenticated, {% data variables.copilot.copilot_cli_short %} can use its token automatically. This is the lowest priority method and activates only when no other credentials are found. See [Authenticating with {% data variables.product.prodname_cli %}](#authenticating-with-github-cli).
 
@@ -52,7 +52,7 @@ Offline mode is **only fully air-gapped** if your BYOK provider is local or othe
 
 | Token type                 | Prefix        | Supported | Notes                                                  |
 |----------------------------|---------------|-----------|--------------------------------------------------------|
-| OAuth token (device flow)  | `gho_`        | Yes       | Default method via `copilot login`                     |
+| OAuth token (browser or device flow) | `gho_` | Yes    | Default method via `copilot login`                     |
 | Fine-grained PAT           | `github_pat_` | Yes       | Must be owned by your personal account (not an organization) with the **{% data variables.product.prodname_copilot_short %} Requests** account permission |
 | GitHub App user-to-server  | `ghu_`        | Yes       | Via environment variable                               |
 | Classic PAT                | `ghp_`        | No        | Not supported by {% data variables.copilot.copilot_cli_short %} |
@@ -78,12 +78,12 @@ When you run a command, {% data variables.copilot.copilot_cli_short %} checks fo
 1. GitHub CLI (`gh auth token`) fallback
 
 > [!NOTE]
-> * An environment variable silently overrides a stored OAuth token. If you set `GH_TOKEN` for another tool, the CLI uses that token instead of the OAuth token from `copilot login`. To avoid unexpected behavior, unset environment variables you do not intend the CLI to use.
+> * An environment variable silently overrides a stored OAuth token. If you set `GH_TOKEN` for another tool, the CLI uses that token instead of the OAuth token from `copilot login`. To avoid unexpected behavior, unset environment variables you do not intend the CLI to use. There is one exception: in {% data variables.product.prodname_github_codespaces %}, the `GITHUB_TOKEN` that is injected automatically does not take precedence over an account you signed in with using `/login`. A `GITHUB_TOKEN`, `COPILOT_GITHUB_TOKEN`, or `GH_TOKEN` that you export explicitly still does.
 > * When you configure BYOK provider environment variables (for example, `COPILOT_PROVIDER_BASE_URL`, `COPILOT_PROVIDER_API_KEY`), {% data variables.copilot.copilot_cli_short %} uses these for AI model requests regardless of your {% data variables.product.github %} authentication status. {% data variables.product.github %} tokens are only needed for {% data variables.product.github %}-hosted features.
 
 ## Authenticating with OAuth
 
-The OAuth device flow is the default authentication method for interactive use. You can authenticate by running `/login` from {% data variables.copilot.copilot_cli_short %} or `copilot login` from your terminal.
+OAuth is the default authentication method for interactive use. You can authenticate by running `/login` from {% data variables.copilot.copilot_cli_short %} or `copilot login` from your terminal. Both offer a browser (web) flow and a device code flow.
 
 ### Authenticate with `/login`
 
@@ -101,16 +101,28 @@ The OAuth device flow is the default authentication method for interactive use.
     2. {% data variables.product.prodname_ghe_cloud %} with data residency (*.ghe.com)
    ```
 
-1. The CLI displays a one-time user code and automatically copies it to your clipboard and opens your browser.
+1. Choose how you want to sign in. The recommended option is listed first, and depends on your environment: the browser flow on a local terminal, or the device code flow in a remote or headless environment. The following example shows the prompt in a local terminal:
 
    ```text
-   Waiting for authorization...
-   Enter one-time code: 1234-5678 at https://github.com/login/device
-   Press any key to copy to clipboard and open browser...
+   How do you want to sign in?
+    1. Sign in with your browser (recommended)
+    2. Sign in with a device code
    ```
 
-1. Navigate to the verification URL at `https://github.com/login/device` if your browser did not open automatically.
-1. Paste the one-time code in the field on the page.
+1. Complete the flow you selected.
+
+   * **Browser**: {% data variables.copilot.copilot_cli_short %} opens your browser so that you can authorize the sign-in. If your browser does not open automatically, the terminal displays a URL that you can visit instead.
+
+   * **Device code**: The CLI displays a one-time user code, and can copy it to your clipboard and open your browser for you.
+
+     ```text
+     Waiting for authorization...
+     Enter one-time code: 1234-5678 at https://github.com/login/device
+     Press any key to copy to clipboard and open browser...
+     ```
+
+     Navigate to the verification URL at `https://github.com/login/device` if your browser did not open automatically, then paste the one-time code in the field on the page.
+
 1. If your organization uses SAML SSO, click **Authorize** next to each organization you want to grant access to.
 1. Review the requested permissions and click **Authorize GitHub Copilot CLI**.
 1. Return to your terminal. The CLI displays a success message when authentication is complete.
@@ -133,14 +145,27 @@ The OAuth device flow is the default authentication method for interactive use.
    copilot login --host HOSTNAME
    ```
 
-   The CLI displays a one-time user code and automatically copies it to your clipboard and opens your browser.
+1. Authorize the sign-in.
+
+   On a local desktop, `copilot login` uses the browser flow by default. It opens your browser to authorize the sign-in and captures the result on a local loopback callback.
+
+   ```text
+   Opening your browser to authenticate...
+   If it doesn't open automatically, visit:
+   URL
+   Waiting for authorization...
+   ```
+
+   Known remote or headless environments (including SSH, {% data variables.product.prodname_github_codespaces %}, dev containers, and CI) use the device code flow instead. The CLI displays a one-time code and, when supported by the environment, can copy it to your clipboard and open a browser.
 
    ```text
-   To authenticate, visit https://github.com/login/device and enter code 1234-5678.
+   To authenticate, visit https://github.com/login/device and enter code 1234-5678
+   Waiting for authorization...
    ```
 
-1. Navigate to the verification URL at `https://github.com/login/device` if your browser did not open automatically.
-1. Paste the one-time code in the field on the page.
+   To force a particular flow, add the `--web-flow` or `--device-code` option.
+
+1. Navigate to the URL displayed in your terminal if your browser did not open automatically. For the device code flow, paste the one-time code in the field on the page.
 1. If your organization uses SAML SSO, click **Authorize** next to each organization you want to grant access to.
 1. Review the requested permissions and click **Authorize GitHub Copilot CLI**.
 1. Return to your terminal. The CLI displays a success message when authentication is complete.

content/copilot/how-tos/copilot-cli/set-up-copilot-cli/troubleshoot-copilot-cli-auth.md

@@ -62,7 +62,7 @@ If you are using an environment variable, check whether the `COPILOT_GITHUB_TOKE
 If the command prints nothing, the variable is not set. Set the variable to a valid token. To generate a token, see [AUTOTITLE](/copilot/how-tos/copilot-cli/set-up-copilot-cli/authenticate-copilot-cli#authenticating-with-environment-variables).
 
 ```bash copy
- export $COPILOT_GITHUB_TOKEN=PERSONAL_ACCESS_TOKEN
+ export COPILOT_GITHUB_TOKEN=PERSONAL_ACCESS_TOKEN
  ```
 
 #### macOS keychain
@@ -106,7 +106,31 @@ Review the token's status and permissions on {% data variables.product.prodname_
 
 ## {% data variables.product.pat_classic_caps %} rejected
 
-A token starting with `ghp_` is silently ignored and the CLI behaves as if no token is set.
+A token starting with `ghp_` is rejected. What happens next depends on how you are running {% data variables.copilot.copilot_cli_short %}.
+
+In an interactive session, the classic {% data variables.product.pat_generic %} is ignored and the CLI keeps running, so you can authenticate another way, such as with `/login`. {% data variables.copilot.copilot_cli_short %} displays a warning like the following, naming the environment variable that holds the token:
+
+<!-- markdownlint-disable GHD005 -->
+```text
+Classic Personal Access Tokens (ghp_) are not supported. GITHUB_TOKEN contains a classic PAT and will be ignored. Use /login to authenticate, or replace it with a fine-grained PAT.
+```
+<!-- markdownlint-enable GHD005 -->
+
+In non-interactive use, such as `copilot -p` or other automation, if the classic {% data variables.product.pat_generic %} is the only credential available, the CLI refuses to start and displays the following error, naming the environment variable that holds the token:
+
+<!-- markdownlint-disable GHD005 -->
+```text
+Error: Classic Personal Access Tokens (ghp_) are not supported by Copilot.
+
+The GITHUB_TOKEN environment variable contains a classic PAT.
+Please use a Fine-Grained Personal Access Token or another authentication method.
+
+To fix this, you can:
+  • Replace the token in GITHUB_TOKEN with a fine-grained PAT
+  • Unset GITHUB_TOKEN and run 'gh auth login' to authenticate
+  • Unset GITHUB_TOKEN and start 'copilot', then use the '/login' command
+```
+<!-- markdownlint-enable GHD005 -->
 
 ### Cause
 

content/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions.md

@@ -50,19 +50,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: {% data reusables.actions.action-checkout %}
+        with:
+          fetch-depth: 2
       - name: Install Copilot CLI
         run: npm install -g @github/copilot
       - name: Run Copilot
-        run: copilot --yolo -p "Summarize the changes in this commit"
+        run: copilot -p "Use git show HEAD to summarize the changes in this commit" -s --allow-tool='shell(git show:*)'
         env:
           GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
 ```
 
 Key details about this example:
 
-* The `--yolo` flag automatically approves all tool, path, and URL permission requests. Non-interactive (`-p`) runs can't display an interactive approval prompt, so any action that isn't pre-approved is denied automatically. To grant only the permissions the task needs, use narrower options such as `--allow-tool`, `--add-dir`, and `--allow-url` instead.
+* The `fetch-depth: 2` option fetches the current commit and its parent, allowing `git show HEAD` to calculate the changes introduced by the current commit.
+* The `--allow-tool='shell(git show:*)'` option allows {% data variables.copilot.copilot_cli_short %} to run `git show` commands without requesting approval. Non-interactive (`-p`) runs can't display an interactive approval prompt, so any action that isn't pre-approved is denied automatically.
 * The `copilot-requests: write` permission is required for the workflow to make {% data variables.product.prodname_copilot_short %} requests.
-* The `GITHUB_TOKEN` provided by {% data variables.product.prodname_actions %} handles authentication automatically, no additional secrets are needed.
+* The `GITHUB_TOKEN` provided by {% data variables.product.prodname_actions %} handles authentication automatically. No additional secrets are needed.
 
 > [!NOTE]
 > You must be on a recent version of {% data variables.copilot.copilot_cli_short %} to use `GITHUB_TOKEN` authentication. Update with `copilot update`, or reinstall the latest version with `npm install -g @github/copilot`.