From 97f505ced60f24d28643321683d732929624e59a Mon Sep 17 00:00:00 2001 From: Ieuan Walker Date: Fri, 8 May 2026 14:06:06 +0100 Subject: [PATCH 1/3] Disable CI workflows on forked repositories (#1232) * Restrict CI workflows to non-forked repositories Add if: github.event.repository.fork == false to all workflow jobs to ensure CI only runs in the main repository. This improves security and conserves resources by preventing workflow execution in forked repos. * Restrict Rust CLI build job to non-forked repos Added a condition to the "Rust SDK Bundled CLI Build" job in rust-sdk-tests.yml to ensure it only runs when the workflow is triggered from the main repository, preventing execution on forked repositories. --- .github/workflows/codegen-check.yml | 1 + .github/workflows/copilot-setup-steps.yml | 1 + .github/workflows/corrections-tests.yml | 1 + .github/workflows/docs-validation.yml | 4 ++++ .github/workflows/dotnet-sdk-tests.yml | 1 + .github/workflows/go-sdk-tests.yml | 1 + .github/workflows/nodejs-sdk-tests.yml | 1 + .github/workflows/python-sdk-tests.yml | 1 + .github/workflows/rust-publish-release.yml | 1 + .github/workflows/rust-sdk-tests.yml | 2 ++ .github/workflows/scenario-builds.yml | 5 +++++ .github/workflows/verify-compiled.yml | 1 + 12 files changed, 20 insertions(+) diff --git a/.github/workflows/codegen-check.yml b/.github/workflows/codegen-check.yml index d48b6a491f..0bef145316 100644 --- a/.github/workflows/codegen-check.yml +++ b/.github/workflows/codegen-check.yml @@ -23,6 +23,7 @@ permissions: jobs: check: name: "Verify generated files are up-to-date" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index afe9b03bdd..daa9d66948 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -14,6 +14,7 @@ on: jobs: # The job MUST be called 'copilot-setup-steps' to be recognized by GitHub Copilot Agent copilot-setup-steps: + if: github.event.repository.fork == false runs-on: ubuntu-latest # Set minimal permissions for setup steps diff --git a/.github/workflows/corrections-tests.yml b/.github/workflows/corrections-tests.yml index 7654f3c9b9..693b4a4088 100644 --- a/.github/workflows/corrections-tests.yml +++ b/.github/workflows/corrections-tests.yml @@ -16,6 +16,7 @@ permissions: jobs: test: runs-on: ubuntu-latest + if: github.event.repository.fork == false steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 diff --git a/.github/workflows/docs-validation.yml b/.github/workflows/docs-validation.yml index 4c26e9ec14..e7f64be5b5 100644 --- a/.github/workflows/docs-validation.yml +++ b/.github/workflows/docs-validation.yml @@ -20,6 +20,7 @@ permissions: jobs: validate-typescript: name: "Validate TypeScript" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -44,6 +45,7 @@ jobs: validate-python: name: "Validate Python" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -76,6 +78,7 @@ jobs: validate-go: name: "Validate Go" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -99,6 +102,7 @@ jobs: validate-csharp: name: "Validate C#" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/dotnet-sdk-tests.yml b/.github/workflows/dotnet-sdk-tests.yml index 872f06668a..d3b2ef162a 100644 --- a/.github/workflows/dotnet-sdk-tests.yml +++ b/.github/workflows/dotnet-sdk-tests.yml @@ -29,6 +29,7 @@ permissions: jobs: test: name: ".NET SDK Tests" + if: github.event.repository.fork == false env: POWERSHELL_UPDATECHECK: Off strategy: diff --git a/.github/workflows/go-sdk-tests.yml b/.github/workflows/go-sdk-tests.yml index 733954f1dd..e262961096 100644 --- a/.github/workflows/go-sdk-tests.yml +++ b/.github/workflows/go-sdk-tests.yml @@ -30,6 +30,7 @@ permissions: jobs: test: name: "Go SDK Tests" + if: github.event.repository.fork == false env: POWERSHELL_UPDATECHECK: Off strategy: diff --git a/.github/workflows/nodejs-sdk-tests.yml b/.github/workflows/nodejs-sdk-tests.yml index 141b161b68..8880cadfa3 100644 --- a/.github/workflows/nodejs-sdk-tests.yml +++ b/.github/workflows/nodejs-sdk-tests.yml @@ -32,6 +32,7 @@ permissions: jobs: test: name: "Node.js SDK Tests" + if: github.event.repository.fork == false env: POWERSHELL_UPDATECHECK: Off strategy: diff --git a/.github/workflows/python-sdk-tests.yml b/.github/workflows/python-sdk-tests.yml index 5b305ed099..e6260dd0b2 100644 --- a/.github/workflows/python-sdk-tests.yml +++ b/.github/workflows/python-sdk-tests.yml @@ -32,6 +32,7 @@ permissions: jobs: test: name: "Python SDK Tests" + if: github.event.repository.fork == false env: POWERSHELL_UPDATECHECK: Off strategy: diff --git a/.github/workflows/rust-publish-release.yml b/.github/workflows/rust-publish-release.yml index 348d2acf01..daf768929f 100644 --- a/.github/workflows/rust-publish-release.yml +++ b/.github/workflows/rust-publish-release.yml @@ -24,6 +24,7 @@ concurrency: jobs: publish: name: Publish to crates.io + if: github.event.repository.fork == false runs-on: ubuntu-latest defaults: run: diff --git a/.github/workflows/rust-sdk-tests.yml b/.github/workflows/rust-sdk-tests.yml index 201841784e..5dc100e721 100644 --- a/.github/workflows/rust-sdk-tests.yml +++ b/.github/workflows/rust-sdk-tests.yml @@ -30,6 +30,7 @@ permissions: jobs: test: name: "Rust SDK Tests" + if: github.event.repository.fork == false env: POWERSHELL_UPDATECHECK: Off CARGO_TERM_COLOR: always @@ -119,6 +120,7 @@ jobs: # bundled-CLI release pipeline) hit them downstream. bundle: name: "Rust SDK Bundled CLI Build" + if: github.event.repository.fork == false env: CARGO_TERM_COLOR: always RUST_BACKTRACE: 1 diff --git a/.github/workflows/scenario-builds.yml b/.github/workflows/scenario-builds.yml index 923560aba1..8114176e73 100644 --- a/.github/workflows/scenario-builds.yml +++ b/.github/workflows/scenario-builds.yml @@ -28,6 +28,7 @@ jobs: # ── TypeScript ────────────────────────────────────────────────────── build-typescript: name: "TypeScript scenarios" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -74,6 +75,7 @@ jobs: # ── Python ────────────────────────────────────────────────────────── build-python: name: "Python scenarios" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -112,6 +114,7 @@ jobs: # ── Go ────────────────────────────────────────────────────────────── build-go: name: "Go scenarios" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -149,6 +152,7 @@ jobs: # ── C# ───────────────────────────────────────────────────────────── build-csharp: name: "C# scenarios" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -191,6 +195,7 @@ jobs: # ── Rust ──────────────────────────────────────────────────────────── build-rust: name: "Rust scenarios" + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/verify-compiled.yml b/.github/workflows/verify-compiled.yml index 792dac1728..1d265dc49a 100644 --- a/.github/workflows/verify-compiled.yml +++ b/.github/workflows/verify-compiled.yml @@ -12,6 +12,7 @@ permissions: jobs: verify: + if: github.event.repository.fork == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 From 299ea2116b058a7239865307d592f4e1db0e7234 Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Fri, 8 May 2026 09:31:37 -0400 Subject: [PATCH 2/3] Default publish workflow to prerelease (#1233) Agent-Logs-Url: https://github.com/github/copilot-sdk/sessions/c70da0eb-ac13-4b57-b27b-628b04b13c2e Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com> --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6add87e286..a567522f69 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -10,7 +10,7 @@ on: description: "Tag to publish under" type: choice required: true - default: "latest" + default: "prerelease" options: - latest - prerelease From ce56eb81a1b57f72f603f8cd3e7fb5ce9ee2dbc3 Mon Sep 17 00:00:00 2001 From: Stephen Toub Date: Fri, 8 May 2026 11:58:35 -0400 Subject: [PATCH 3/3] Fix SDK documentation typos (#1235) * Fix SDK documentation typos Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Preserve embedded CLI verbose log output Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 2 +- docs/setup/github-oauth.md | 2 +- docs/troubleshooting/mcp-debugging.md | 2 +- dotnet/README.md | 2 +- dotnet/src/JsonRpc.cs | 2 +- go/internal/jsonrpc2/frame.go | 2 +- nodejs/README.md | 2 +- nodejs/src/sessionFsProvider.ts | 2 +- python/copilot/_jsonrpc.py | 18 +++++++++--------- python/test_jsonrpc.py | 2 +- 10 files changed, 18 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index 8388478209..186cf0b988 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,7 @@ Advanced: You can override the bundled CLI using `cliPath` or `cliUrl` if you wa ### What tools are enabled by default? -By default, the SDK will operate the Copilot CLI in the equivalent of `--allow-all` being passed to the CLI, enabling all first-party tools, which means that the agents can perform a wide range of actions, including file system operations, Git operations, and web requests. You can customize tool availability by configuring the SDK client options to enable and disable specific tools. Refer to the individual SDK documentation for details on tool configuration and Copilot CLI for the list of tools available. +By default, the SDK operates the Copilot CLI as if `--allow-all` were passed, enabling all first-party tools. This means that agents can perform a wide range of actions, including file system operations, Git operations, and web requests. You can customize tool availability by configuring the SDK client options to enable and disable specific tools. Refer to the individual SDK documentation for details on tool configuration and to the Copilot CLI documentation for the list of available tools. ### Can I use custom agents, skills or tools? diff --git a/docs/setup/github-oauth.md b/docs/setup/github-oauth.md index 74fa1fc654..31a3b9001b 100644 --- a/docs/setup/github-oauth.md +++ b/docs/setup/github-oauth.md @@ -113,7 +113,7 @@ async function handleOAuthCallback(code: string): Promise { ## Step 3: pass the token to the SDK -Create a SDK client for each authenticated user, passing their token: +Create an SDK client for each authenticated user, passing their token:
Node.js / TypeScript diff --git a/docs/troubleshooting/mcp-debugging.md b/docs/troubleshooting/mcp-debugging.md index 12ce8f0706..fe001a13fd 100644 --- a/docs/troubleshooting/mcp-debugging.md +++ b/docs/troubleshooting/mcp-debugging.md @@ -335,7 +335,7 @@ Windows Defender or other AV may block: #### Gatekeeper blocking ```bash -# If server is blocked +# If the server is blocked xattr -d com.apple.quarantine /path/to/mcp-server ``` diff --git a/dotnet/README.md b/dotnet/README.md index 37de80afdc..6b76f39131 100644 --- a/dotnet/README.md +++ b/dotnet/README.md @@ -35,7 +35,7 @@ await using var session = await client.CreateSessionAsync(new SessionConfig OnPermissionRequest = PermissionHandler.ApproveAll, }); -// Wait for response using session.idle event +// Wait for the response using the session.idle event var done = new TaskCompletionSource(); session.On(evt => diff --git a/dotnet/src/JsonRpc.cs b/dotnet/src/JsonRpc.cs index c57166aeef..7480aa8ffc 100644 --- a/dotnet/src/JsonRpc.cs +++ b/dotnet/src/JsonRpc.cs @@ -365,7 +365,7 @@ private async Task ReadLoopAsync(CancellationToken cancellationToken) // line; we walk the lines and require an exact "Content-Length: " prefix at the // start of one of them. A substring match anywhere in the header block would // false-positive on values like "X-Trace: Content-Length: 5" and desync the stream. - // A missing or unparseable Content-Length means the framing is broken — there's + // A missing or unparsable Content-Length means the framing is broken — there's // no safe way to resync, so throw and let the read loop terminate the connection. int contentLength = -1; ReadOnlySpan prefix = "Content-Length: "u8; diff --git a/go/internal/jsonrpc2/frame.go b/go/internal/jsonrpc2/frame.go index 6cd931dc66..b54f2857b1 100644 --- a/go/internal/jsonrpc2/frame.go +++ b/go/internal/jsonrpc2/frame.go @@ -82,7 +82,7 @@ func newHeaderWriter(w io.Writer) *headerWriter { return &headerWriter{out: w} } -// Write sends a single frame with Content-Length header. +// Write sends a single frame with a Content-Length header. func (w *headerWriter) Write(data []byte) error { if _, err := fmt.Fprintf(w.out, "Content-Length: %d\r\n\r\n", len(data)); err != nil { return err diff --git a/nodejs/README.md b/nodejs/README.md index 93861c4e23..a8ada97ed5 100644 --- a/nodejs/README.md +++ b/nodejs/README.md @@ -38,7 +38,7 @@ const session = await client.createSession({ onPermissionRequest: approveAll, }); -// Wait for response using typed event handlers +// Wait for the response using typed event handlers const done = new Promise((resolve) => { session.on("assistant.message", (event) => { console.log(event.data.content); diff --git a/nodejs/src/sessionFsProvider.ts b/nodejs/src/sessionFsProvider.ts index 721a990ec0..920ea3cd1a 100644 --- a/nodejs/src/sessionFsProvider.ts +++ b/nodejs/src/sessionFsProvider.ts @@ -17,7 +17,7 @@ import type { export type SessionFsFileInfo = Omit; /** - * Interface for session filesystem providers. Implementors use idiomatic + * Interface for session filesystem providers. Implementers use idiomatic * TypeScript patterns: throw on error, return values directly. Use * {@link createSessionFsAdapter} to convert a provider into the * {@link SessionFsHandler} expected by the SDK. diff --git a/python/copilot/_jsonrpc.py b/python/copilot/_jsonrpc.py index 61e2169682..ecae75b6b7 100644 --- a/python/copilot/_jsonrpc.py +++ b/python/copilot/_jsonrpc.py @@ -137,7 +137,7 @@ async def request( self, method: str, params: dict | None = None, timeout: float | None = None ) -> Any: """ - Send a JSON-RPC request and wait for response + Send a JSON-RPC request and wait for the response. Args: method: Method name @@ -149,8 +149,8 @@ async def request( The result from the response Raises: - JsonRpcError: If server returns an error - asyncio.TimeoutError: If request times out (only when timeout is set) + JsonRpcError: If the server returns an error + asyncio.TimeoutError: If the request times out (only when timeout is set) """ request_start = time.perf_counter() request_id = str(uuid.uuid4()) @@ -198,7 +198,7 @@ async def request( async def notify(self, method: str, params: dict | None = None): """ - Send a JSON-RPC notification (no response expected) + Send a JSON-RPC notification (no response expected). Args: method: Method name @@ -212,7 +212,7 @@ async def notify(self, method: str, params: dict | None = None): await self._send_message(message) def set_notification_handler(self, handler: Callable[[str, dict], None]): - """Set handler for incoming notifications from server""" + """Set the handler for incoming notifications from the server.""" self.notification_handler = handler def set_request_handler(self, method: str, handler: RequestHandler): @@ -222,7 +222,7 @@ def set_request_handler(self, method: str, handler: RequestHandler): self.request_handlers[method] = handler async def _send_message(self, message: dict): - """Send a JSON-RPC message with Content-Length header""" + """Send a JSON-RPC message with a Content-Length header.""" loop = self._loop or asyncio.get_event_loop() def write(): @@ -311,10 +311,10 @@ def _read_exact(self, num_bytes: int) -> bytes: def _read_message(self) -> dict | None: """ - Read a single JSON-RPC message with Content-Length header (blocking) + Read a single JSON-RPC message with a Content-Length header (blocking). Returns: - Parsed JSON message or None if connection closed + Parsed JSON message, or None if the connection is closed. """ # Read header line header_line = self.process.stdout.readline() @@ -362,7 +362,7 @@ def _handle_message(self, message: dict): loop.call_soon_threadsafe(future.set_exception, exc) return - # Check if it's a notification from server + # Check if it's a notification from the server if "method" in message and "id" not in message: if self.notification_handler and self._loop: method = message["method"] diff --git a/python/test_jsonrpc.py b/python/test_jsonrpc.py index c0ab2c6f42..56ce44e374 100644 --- a/python/test_jsonrpc.py +++ b/python/test_jsonrpc.py @@ -166,7 +166,7 @@ class TestReadMessageWithLargePayloads: """Tests for _read_message() with large JSON-RPC messages""" def create_jsonrpc_message(self, content_dict: dict) -> bytes: - """Create a complete JSON-RPC message with Content-Length header""" + """Create a complete JSON-RPC message with a Content-Length header.""" content = json.dumps(content_dict, separators=(",", ":")) content_bytes = content.encode("utf-8") header = f"Content-Length: {len(content_bytes)}\r\n\r\n"