Use a scoped Aspire App token for Copilot review requests (#20016)

* Add dry-run organization-funded Copilot review workflow

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 98e48823-4d0d-4cbc-aa9b-eba1c86342b0

* Skip stale PRs in scheduled Copilot review scans

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 98e48823-4d0d-4cbc-aa9b-eba1c86342b0

* Request Copilot reviews with a scoped Aspire App token

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 98e48823-4d0d-4cbc-aa9b-eba1c86342b0

* Defer Dependabot Copilot reviews to scheduled reconciliation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 98e48823-4d0d-4cbc-aa9b-eba1c86342b0

---------

Copilot-Session: 98e48823-4d0d-4cbc-aa9b-eba1c86342b0

Author: joperezr

.github/workflows/organization-funded-copilot-reviews.yml

@@ -1,4 +1,4 @@
-# Bot-requested reviews are billed to the organization, unlike ruleset reviews.
+# Request reviews through the Aspire App; organization billing still needs verification.
 # See docs/ci/organization-funded-copilot-reviews.md before enabling writes.
 name: Organization-funded Copilot reviews
 
@@ -28,23 +28,38 @@ concurrency:
 
 jobs:
   request-reviews:
+    # Dependabot PR events can lack Actions secrets. Skip before token creation;
+    # scheduled/manual runs still reconcile those PRs using their own credentials.
+    # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions#restrictions-when-dependabot-triggers-events
     if: >-
       github.repository == 'microsoft/aspire' &&
       vars.COPILOT_REVIEW_MODE != 'disabled' &&
+      (github.event_name != 'pull_request_target' || github.actor != 'dependabot[bot]') &&
       (github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    permissions:
-      pull-requests: write
+    permissions: {}
     steps:
+      # Explicit scope avoids inheriting the App's broader installation permissions.
+      # Dry-run gets read access only; the action revokes the token during job cleanup.
+      - name: Create Aspire App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.ASPIRE_BOT_APP_ID }}
+          private-key: ${{ secrets.ASPIRE_BOT_PRIVATE_KEY }}
+          owner: microsoft
+          repositories: aspire
+          permission-pull-requests: ${{ vars.COPILOT_REVIEW_MODE == 'enabled' && 'write' || 'read' }}
+          skip-token-revoke: false
       # Intentionally inline: this privileged workflow never checks out code.
       - name: Reconcile Copilot reviews
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           COPILOT_REVIEW_MODE: ${{ vars.COPILOT_REVIEW_MODE }}
           COPILOT_REVIEW_PR_NUMBER: ${{ vars.COPILOT_REVIEW_PR_NUMBER }}
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.app-token.outputs.token }}
           # A timed-out POST may already have started a billable review.
           retries: 0
           script: |
@@ -157,7 +172,7 @@ jobs:
                 return;
               }
               await github.rest.pulls.requestReviewers({ ...args, reviewers: [reviewer] });
-              record(number, sha, 'Requested Copilot review as the Actions bot.');
+              record(number, sha, 'Requested Copilot review as the Aspire App.');
             }
 
             if (context.eventName === 'pull_request_target') {

docs/ci/organization-funded-copilot-reviews.md

@@ -1,12 +1,28 @@
 # Organization-funded Copilot reviews
 
 The `Organization-funded Copilot reviews` workflow requests Copilot code review
-(CCR) using the repository's `GITHUB_TOKEN`, not a contributor's personal token.
+(CCR) using an installation token for `aspire-repo-bot`, not the workflow's
+`GITHUB_TOKEN` or a contributor's personal token. Organization funding is the
+goal, not a verified billing guarantee.
 It covers open PRs (including drafts) targeting `main` or `release/**`, including forks
 and bot-authored PRs. There is no author permission or license filter.
 
-**The default is dry-run. Merging this workflow does not enable billable review
-requests or change any GitHub rulesets.**
+**The default is dry-run only when the mode variable is unset. If it is already
+`enabled`, merging this change switches subsequent runs to the App immediately.
+Set dry-run and a pilot PR before merging to stage the rollout.** No GitHub
+rulesets are changed by the workflow.
+
+## App prerequisites
+
+The Aspire App must be installed on `microsoft/aspire` with Pull requests: write.
+The workflow uses the existing `ASPIRE_BOT_APP_ID` and `ASPIRE_BOT_PRIVATE_KEY`
+Actions secrets. The token action accepts the existing identifier via its
+`client-id` input, matching other repository workflows.
+
+Each run mints an installation token scoped explicitly to the `microsoft`
+installation and the `aspire` repository. Only Pull requests access is requested:
+write when the mode is exactly `enabled`, otherwise read. Token creation or
+permission failures stop the job; there is no fallback to `GITHUB_TOKEN`.
 
 ## Controls
 
@@ -16,7 +32,7 @@ Variables**. No follow-up PR is needed to change modes.
 | Variable | Value | Effect |
 | --- | --- | --- |
 | `COPILOT_REVIEW_MODE` | Unset or `dry-run` | Read metadata and report decisions; never request reviews. |
-| `COPILOT_REVIEW_MODE` | `enabled` | Request reviews using the Actions bot. |
+| `COPILOT_REVIEW_MODE` | `enabled` | Request reviews using the Aspire App. |
 | `COPILOT_REVIEW_MODE` | `disabled` | Skip the job (kill switch). |
 | `COPILOT_REVIEW_PR_NUMBER` | Unset | Consider all eligible PRs, including PRs opened before rollout. |
 | `COPILOT_REVIEW_PR_NUMBER` | A positive PR number | Restrict both event-driven and scheduled processing to that PR for a pilot. |
@@ -33,6 +49,15 @@ including for draft PRs. Reopening a PR or marking a draft ready does not trigge
 an additional run. Manual dispatch on `main` and a scheduled
 scan every 15 minutes reconcile open PRs. GitHub can delay scheduled runs.
 
+`pull_request_target` runs initiated by `dependabot[bot]` skip the entire job,
+before App token creation, because [Dependabot PR events can lack Actions
+secrets](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions#restrictions-when-dependabot-triggers-events).
+Dependabot-authored PRs remain eligible for scheduled scans and maintainer
+manual dispatches, which use their own execution context and credentials.
+Their reviews therefore normally wait for the next scan rather than running
+immediately on creation or push. Do not copy the App private key into Dependabot
+secrets; it is not needed for this recovery path.
+
 Scheduled scans skip PRs with no activity in the last 14 days, using GitHub's
 `updated_at` timestamp (not the PR creation date or latest commit date). The
 cutoff is inclusive: an update exactly 14 days before the run is stale. The
@@ -76,11 +101,17 @@ removes someone else's review request to force a retry.
 
 - The privileged workflow does not check out source, execute PR code, load local
   actions, install packages, or consume artifacts or caches.
-- The only action is a full-SHA-pinned `actions/github-script`. All logic is
-  inline so even loading policy code does not require checkout.
-- The only token permission is `pull-requests: write`. The job uses an ephemeral
-  GitHub-hosted runner with a ten-minute timeout. No App private key or PAT is
-  used.
+- Both actions (`actions/create-github-app-token` and `actions/github-script`)
+  are full-SHA-pinned. All policy logic is inline, requiring no checkout.
+- The workflow's `GITHUB_TOKEN` has no granted permissions. The App installation
+  token is restricted to this repository and Pull requests read/write as
+  described above, plus GitHub's mandatory metadata read access. The token action
+  revokes it during job cleanup; installation tokens also expire after one hour.
+- The App private key is passed only to the token action, not to the inline
+  reconciliation script. Unlike the narrowed token, the private key can mint
+  tokens with the App's broader installed permissions: protecting the secret
+  and trusted workflow/runtime remains essential. No PAT is used. The job uses
+  an ephemeral GitHub-hosted runner with a ten-minute timeout.
 - Repository and reviewer identities are fixed. PR-controlled values are API
   data, never interpolated into scripts or used as API URLs. Logs and summaries
   include only validated PR numbers, SHAs, and fixed decision messages.
@@ -91,45 +122,56 @@ removes someone else's review request to force a retry.
   suggestions. CCR's own runner/setup and secret configuration is a separate
   security boundary that must be assessed before the pilot.
 
-Dry-run uses the same token permissions but never calls the write endpoint.
+Dry-run uses a read-only App token and never calls the write endpoint. It still
+requires the App secrets for token creation; disabled mode skips the entire job.
 The single-PR scope and kill switch are rollout controls, not a hard spending
-limit. Once enabled for everyone, contributors can generate organization-paid
-reviews by pushing changes. Configure organization budgets/alerts and monitor
+limit. Once enabled for everyone, contributors can generate potentially billable
+reviews by pushing changes. Configure appropriate budgets/alerts and monitor
 usage; reconsider cadence if this becomes expensive or is abused.
 
 ## Billing and rollout
 
 [GitHub's CCR documentation](https://docs.github.com/en/copilot/concepts/agents/code-review#code-review-usage)
 attributes built-in automatic reviews to the author and explicitly states that
 bot-requested reviews are billed directly to the organization.
-[`GITHUB_TOKEN`](https://docs.github.com/en/actions/concepts/security/github_token)
-is an installation token, not the identity of the contributor triggering the
-workflow. GitHub documents
+However, the previous `GITHUB_TOKEN` implementation showed an Actions-bot review
+request followed by CCR starting on behalf of the contributor on PR #18530,
+and a quota-limit rejection on PR #17949. Neither is a billing receipt, but
+they undermine the assumption that a bot requester alone proves organization
+funding. `GITHUB_TOKEN` is itself an installation token; using a separate App
+changes the requesting identity, not a documented billing-account selector.
+
+GitHub documents
 [requesting the Copilot reviewer through REST](https://docs.github.com/en/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review).
-These rules support this design, but actual execution and billing under
-Microsoft's policies must be confirmed before broad rollout.
+Actual execution, quota enforcement, and billing under Microsoft's policies must
+be confirmed separately before broad rollout.
 
-1. Merge in dry-run mode and inspect workflow decisions. No production billing
-   settings or automatic review rules are changed by this PR.
+1. Before merging, set `COPILOT_REVIEW_MODE=dry-run` and
+   `COPILOT_REVIEW_PR_NUMBER` to an agreed team-owned pilot PR. Cancel existing
+   enabled workflow runs if needed; changing variables does not stop them.
+   After merging, inspect workflow decisions and successful App token creation.
 2. Identify applicable repository and organization automatic CCR rules,
    including "Review new pushes." Disable those paths before enabling writes,
    or they can still create author-attributed or duplicate reviews.
-3. Set `COPILOT_REVIEW_PR_NUMBER` to an agreed pilot PR. Assess CCR's downstream
-   runner permissions and confirm organization funding/budget policies.
-4. Set `COPILOT_REVIEW_MODE=enabled`. Confirm that the Actions bot starts a
+3. Assess CCR's downstream runner permissions and confirm organization
+   funding/budget policies. Obtain the pilot participant's consent for possible
+   personal allowance consumption; do not experiment on unsuspecting customers.
+4. Set `COPILOT_REVIEW_MODE=enabled`. Confirm that `aspire-repo-bot[bot]` requests a
    review, then push another commit and confirm a re-review, including a push
-   during an active review. Include an external contributor in the pilot.
+   during an active review. Record PR/head, timestamps, requesting actor,
+   execution attribution, and any quota errors for billing correlation.
 5. Have a billing administrator confirm organization attribution and no
    contributor allowance consumption for these bot-requested reviews. An API
    success or a posted review alone is not proof of billing attribution.
 6. Clear the pilot variable to cover all eligible open PRs. Keep human approval
    requirements unchanged and monitor spend and failed workflow runs.
 
-If `GITHUB_TOKEN` cannot initiate CCR under organization policy, leave writes
-disabled until that failure is understood. An Aspire bot App installation token
-is a possible follow-up, scoped to this repository with Pull requests: write.
-Do not substitute a personal token, silently escalate permissions, or claim
-organization billing based only on the human who triggered a workflow run.
+If the App cannot initiate CCR or attribution remains unclear, leave writes
+disabled and escalate the pilot evidence to GitHub support. Ask which principal
+is checked for quota and which account is billed, and whether Actions and
+independent App installation tokens are handled differently. Do not substitute
+a personal token, silently escalate permissions, or infer billing solely from
+the requesting bot or the displayed "on behalf of" identity.
 
 Personal automatic-review settings and manual requests are outside this
 workflow's control and retain their own billing attribution. Actions usage for

tests/Infrastructure.Tests/WorkflowScripts/OrganizationFundedCopilotReviewsTests.cs

@@ -29,13 +29,29 @@ public void WorkflowKeepsPrivilegedExecutionMetadataOnly()
         var job = Assert.IsType<YamlMappingNode>(Assert.Single(jobs.Children).Value);
         Assert.Equal(
             "github.repository == 'microsoft/aspire' && vars.COPILOT_REVIEW_MODE != 'disabled' && " +
+            "(github.event_name != 'pull_request_target' || github.actor != 'dependabot[bot]') && " +
             "(github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main')",
             Scalar(job, "if"));
         Assert.Equal("ubuntu-latest", Scalar(job, "runs-on"));
         Assert.Equal("10", Scalar(job, "timeout-minutes"));
-        var permission = Assert.Single(Mapping(job, "permissions").Children);
-        Assert.Equal("pull-requests", permission.Key.ToString());
-        Assert.Equal("write", permission.Value.ToString());
+        Assert.Empty(Mapping(job, "permissions").Children);
+
+        var steps = Assert.IsType<YamlSequenceNode>(job.Children[new YamlScalarNode("steps")]);
+        Assert.Equal(2, steps.Children.Count);
+        var tokenStep = Assert.IsType<YamlMappingNode>(steps.Children[0]);
+        Assert.Equal(["name", "id", "uses", "with"], tokenStep.Children.Keys.Select(key => key.ToString()));
+        Assert.Equal("app-token", Scalar(tokenStep, "id"));
+        Assert.Matches("^actions/create-github-app-token@[a-f0-9]{40}$", Scalar(tokenStep, "uses"));
+        var tokenOptions = Mapping(tokenStep, "with");
+        Assert.Equal(
+            ["client-id", "private-key", "owner", "repositories", "permission-pull-requests", "skip-token-revoke"],
+            tokenOptions.Children.Keys.Select(key => key.ToString()));
+        Assert.Equal("${{ secrets.ASPIRE_BOT_APP_ID }}", Scalar(tokenOptions, "client-id"));
+        Assert.Equal("${{ secrets.ASPIRE_BOT_PRIVATE_KEY }}", Scalar(tokenOptions, "private-key"));
+        Assert.Equal("microsoft", Scalar(tokenOptions, "owner"));
+        Assert.Equal("aspire", Scalar(tokenOptions, "repositories"));
+        Assert.Equal("${{ vars.COPILOT_REVIEW_MODE == 'enabled' && 'write' || 'read' }}", Scalar(tokenOptions, "permission-pull-requests"));
+        Assert.Equal("false", Scalar(tokenOptions, "skip-token-revoke"));
 
         var step = ScriptStep(root);
         Assert.Equal(["name", "uses", "env", "with"], step.Children.Keys.Select(key => key.ToString()));
@@ -46,7 +62,7 @@ public void WorkflowKeepsPrivilegedExecutionMetadataOnly()
         Assert.Equal("${{ vars.COPILOT_REVIEW_PR_NUMBER }}", Scalar(environment, "COPILOT_REVIEW_PR_NUMBER"));
         var options = Mapping(step, "with");
         Assert.Equal(["github-token", "retries", "script"], options.Children.Keys.Select(key => key.ToString()));
-        Assert.Equal("${{ github.token }}", Scalar(options, "github-token"));
+        Assert.Equal("${{ steps.app-token.outputs.token }}", Scalar(options, "github-token"));
         Assert.Equal("0", Scalar(options, "retries"));
         Assert.Equal(-1, Scalar(options, "script").IndexOf("${{", StringComparison.Ordinal));
     }
@@ -71,6 +87,8 @@ public void WorkflowKeepsPrivilegedExecutionMetadataOnly()
     [InlineData("stale-manual")]
     [InlineData("external-author")]
     [InlineData("bot-author")]
+    [InlineData("dependabot-scheduled")]
+    [InlineData("dependabot-manual")]
     [InlineData("draft")]
     [InlineData("draft-scheduled")]
     [InlineData("closed")]
@@ -131,7 +149,8 @@ private static YamlMappingNode LoadWorkflow()
     private static YamlMappingNode ScriptStep(YamlMappingNode root)
     {
         var job = Mapping(Mapping(root, "jobs"), "request-reviews");
-        return Assert.IsType<YamlMappingNode>(Assert.Single(Assert.IsType<YamlSequenceNode>(job.Children[new YamlScalarNode("steps")])));
+        var steps = Assert.IsType<YamlSequenceNode>(job.Children[new YamlScalarNode("steps")]);
+        return Assert.IsType<YamlMappingNode>(steps.Children[1]);
     }
 
     private static YamlMappingNode Mapping(YamlMappingNode node, string key)

tests/Infrastructure.Tests/WorkflowScripts/organization-funded-copilot-reviews.harness.mjs

@@ -131,6 +131,12 @@ switch (scenario) {
         }
         expectedWrites = 1;
         break;
+    case 'dependabot-scheduled':
+    case 'dependabot-manual':
+        pull.user = { login: 'dependabot[bot]', type: 'Bot' };
+        context.eventName = scenario === 'dependabot-scheduled' ? 'schedule' : 'workflow_dispatch';
+        expectedWrites = 1;
+        break;
     case 'draft':
     case 'draft-scheduled':
         pull.draft = true;