chore: centralize comment verification in one reusable workflow

build/github_action/index.js

@@ -81005,6 +81005,63 @@ function isCopilotCommentRequest(commentBody, botLogin) {
 }
 
 
+/***/ }),
+
+/***/ 33430:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.COPILOT_COMMENT_REMOTE_WORKFLOW = exports.COPILOT_COMMENT_SELF_WORKFLOW = exports.COPILOT_COMMENT_RUNTIME = void 0;
+exports.isCopilotCommentWorkflow = isCopilotCommentWorkflow;
+exports.isCopilotCommentRunner = isCopilotCommentRunner;
+exports.copilotCommentRunner = copilotCommentRunner;
+/** The comment coordinator is a versioned Copilot workflow, not an arbitrary reusable job. */
+exports.COPILOT_COMMENT_RUNTIME = 'copilot_comment_runtime.yml';
+exports.COPILOT_COMMENT_SELF_WORKFLOW = `$/.github/workflows/${exports.COPILOT_COMMENT_RUNTIME}`;
+exports.COPILOT_COMMENT_REMOTE_WORKFLOW = `vypdev/copilot/.github/workflows/${exports.COPILOT_COMMENT_RUNTIME}@v3`;
+function isCopilotCommentWorkflow(value) {
+    return typeof value === 'string' && (value === exports.COPILOT_COMMENT_SELF_WORKFLOW
+        || /^vypdev\/copilot\/\.github\/workflows\/copilot_comment_runtime\.yml@(?:v3(?:\.[0-9]+\.[0-9]+)?|[a-f0-9]{40})$/u.test(value));
+}
+const literal = (value) => typeof value === 'string' && value.length > 0 && value.length <= 100
+    && value === value.trim() && !/[\p{Cc}\p{Cf}${}<>]/u.test(value);
+const labels = (value) => literal(value) || Array.isArray(value) && value.length > 0 && value.length <= 10
+    && value.every(literal) && new Set(value.map(label => label.toLowerCase())).size === value.length;
+/** Runner routing is literal data; expressions need their original full workflow reviewed. */
+function isCopilotCommentRunner(value) {
+    if (labels(value))
+        return true;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const route = value;
+    const keys = Object.keys(route);
+    return keys.length > 0 && (route.group !== undefined || route.labels !== undefined)
+        && keys.every(key => key === 'group' || key === 'labels')
+        && (route.group === undefined || literal(route.group))
+        && (route.labels === undefined || labels(route.labels));
+}
+function copilotCommentRunner(job) {
+    if (!job || !isCopilotCommentWorkflow(job.uses))
+        return job?.['runs-on'];
+    const inputs = job.with;
+    if (typeof inputs?.['runs-on'] !== 'string')
+        throw new Error('Comment workflow runner JSON is unavailable; review the workflow separately.');
+    try {
+        if (inputs['runs-on'].length > 16000)
+            throw new Error('Runner JSON exceeds its bound.');
+        const route = JSON.parse(inputs['runs-on']);
+        if (!isCopilotCommentRunner(route))
+            throw new Error('Unsupported execution route.');
+        return route;
+    }
+    catch {
+        throw new Error('Comment workflow runner JSON is invalid; review the workflow separately.');
+    }
+}
+
+
 /***/ }),
 
 /***/ 72418:
@@ -92895,6 +92952,7 @@ const sensitive_text_1 = __nccwpck_require__(47122);
 const repository_agent_guidance_policy_1 = __nccwpck_require__(67402);
 const setup_verification_action_1 = __nccwpck_require__(33156);
 const setup_verification_action_2 = __nccwpck_require__(12471);
+const copilot_comment_workflow_1 = __nccwpck_require__(33430);
 exports.SETUP_RUNNER_SNAPSHOT = '.copilot/runner-profile.json';
 const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value)
     ? value : undefined;
@@ -92960,7 +93018,7 @@ function inspectSetupInstallation(root, configuration, setup = (0, node_path_1.j
         if (!parsedJobs)
             throw new Error('Workflow jobs are unavailable for review.');
         for (const [job, raw] of Object.entries(parsedJobs)) {
-            const runsOn = object(raw)?.['runs-on'];
+            const runsOn = (0, copilot_comment_workflow_1.copilotCommentRunner)(object(raw));
             if (runsOn === undefined)
                 continue; // reusable workflow calls have no runner
             jobs.push({ file, job, role: (0, setup_runner_policy_1.setupRunnerRole)(file, job) ?? 'validation',
@@ -93067,6 +93125,7 @@ const js_yaml_1 = __nccwpck_require__(783);
 const node_util_1 = __nccwpck_require__(47261);
 const setup_runner_policy_1 = __nccwpck_require__(91027);
 const action_types_1 = __nccwpck_require__(19625);
+const copilot_comment_workflow_1 = __nccwpck_require__(33430);
 const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
 const document = (value) => {
     try {
@@ -93088,6 +93147,8 @@ const runner = (value) => labels(value) || !!object(value)
     && (object(value).labels === undefined || labels(object(value).labels));
 const copilotCommands = new Set(Object.values(action_types_1.ACTIONS));
 const callsRootAction = (jobs) => !!jobs && Object.values(jobs).some(job => {
+    if (object(job)?.uses === copilot_comment_workflow_1.COPILOT_COMMENT_SELF_WORKFLOW)
+        return true;
     const steps = object(job)?.steps;
     return Array.isArray(steps) && steps.some(step => {
         const invocation = object(step);
@@ -93150,6 +93211,32 @@ function renderSetupWorkflowUpgrade(template, existing, selection) {
     const templateJobs = object(document(template)?.jobs);
     if (!previousJobs || !templateJobs)
         throw new Error('Workflow jobs cannot be inspected; review the workflow separately.');
+    if (Object.values(templateJobs).some(job => (0, copilot_comment_workflow_1.isCopilotCommentWorkflow)(object(job)?.uses))) {
+        const parsed = document(template);
+        const jobs = object(parsed.jobs);
+        let changed = false;
+        for (const [name, value] of Object.entries(jobs)) {
+            const job = object(value);
+            if (!(0, copilot_comment_workflow_1.isCopilotCommentWorkflow)(job.uses))
+                throw new Error('Mixed comment workflow jobs require separate workflow review before setup.');
+            const previousJob = object(previousJobs[name]);
+            if (Array.isArray(previousJob?.steps) && previousJob.steps.some(raw => {
+                const uses = object(raw)?.uses;
+                return typeof uses !== 'string' || !(uses.startsWith('actions/checkout@')
+                    || /^vypdev\/copilot@[^\s]+$/u.test(uses) || uses === './.git/copilot-verification-setup');
+            }))
+                throw new Error('Custom comment job steps require migration to the reviewed repository verification setup action before switching to the reusable workflow. Review the workflow separately.');
+            const retained = (0, setup_runner_policy_1.selectedSetupRunsOn)(selection?.runners, selection && (0, setup_runner_policy_1.setupRunnerRole)(selection.file, name))
+                ?? (0, copilot_comment_workflow_1.copilotCommentRunner)(previousJob) ?? (0, copilot_comment_workflow_1.copilotCommentRunner)(job);
+            if (!runner(retained))
+                throw new Error('Existing runner selection is invalid; review the workflow separately.');
+            if (JSON.stringify(retained).includes('${{') && existing !== template)
+                throw new Error('Dynamic runner selection requires separate workflow review before setup.');
+            changed || (changed = !(0, node_util_1.isDeepStrictEqual)(retained, (0, copilot_comment_workflow_1.copilotCommentRunner)(job)));
+            job.with = { ...object(job.with), 'runs-on': JSON.stringify(retained) };
+        }
+        return changed ? (0, js_yaml_1.dump)(parsed, { noRefs: true, lineWidth: -1 }) : template;
+    }
     const lines = template.split('\n');
     let job = '';
     let insideJobs = false;

docs/configuration-checklist.mdx

@@ -4,6 +4,10 @@ description: Required checks before enabling Copilot automation.
 ---
 # Configuration checklist
 
+For compact comment callbacks, verify runner 2.336.0+, platform support and the
+Actions policy for Copilot's reusable coordinator. Review the retained runner and
+any custom bootstrap migration using the [upgrade guide](/security-operations/operations/upgrade-rollback#upgrade-an-existing-copilot-repository).
+
 Before enabling repository verification or automated fixes, provision required
 project runtimes in **each** executing job and add the reviewed
 [runtime declaration](/security-operations/operations/verification#repository-verification-prerequisites).

docs/configuration.mdx

@@ -5,6 +5,13 @@ description: Detailed configuration options for Copilot
 
 # Configuration Options
 
+The generated comment callbacks delegate their whole job to
+`vypdev/copilot/.github/workflows/copilot_comment_runtime.yml@v3`. The coordinator
+reads this repository's existing Variables and explicitly forwarded Secrets;
+project setup remains isolated from provider/PAT inputs. Setup stores the reviewed
+runner route as JSON in the call's `with.runs-on`, including label arrays and group
+objects. See [verification and coordinator configuration](/security-operations/operations/verification#repository-owned-setup).
+
 For a new installation, use [web setup](/setup-web). To configure a specific outcome, start with the [goal guides](/guides); they connect setup choices, runtime configuration and verification. This page is the input and scope reference.
 
 Copilot provides extensive configuration options to customize your workflow. Use the tabs below to jump to the category you need.

docs/development/architecture.mdx

@@ -4,6 +4,16 @@ description: Clean Architecture boundaries for agent execution and workflow auto
 ---
 # Architecture
 
+Issue/review comment callbacks are compact entrypoints into the Copilot-owned
+`copilot_comment_runtime.yml` reusable workflow. One job owns the existing native
+worker, project composite setup, continuations and reverse post cleanup. Internal
+`uses: $/` references bind all runtime phases to the called workflow commit. The
+pure known-workflow/runner contract lives in `copilot_comment_workflow.ts`; existing
+setup adapters retain YAML/filesystem inspection, preview/Apply and migration.
+Safe Variable/default bindings are shared by the workflow generator and maintenance
+reader. See the [coordinator SDD](https://github.com/vypdev/copilot/blob/develop/specs/copilot-comment-workflow-coordinator.md)
+and [operational contract](/security-operations/operations/verification#repository-owned-setup).
+
 Verification setup onboarding uses the shared repository questionnaire and the
 existing `repository.verificationSetup` boolean. The package supplies a native
 composite starter under `setup/actions/`; the filesystem adapter inspects only

docs/issues/comment-commands.mdx

@@ -5,6 +5,12 @@ description: Use @vypbot from issues and pull requests for help, analysis, plann
 
 # Comment commands
 
+Generated comment workflows call one Copilot-owned coordinator. The command,
+project dependency setup, verification and cleanup still run in the same job;
+inspect the comment run's nested `Copilot` job for preparation/continuation logs.
+Command permissions and result cards retain their existing behavior. See
+[repository setup and verification](/security-operations/operations/verification#repository-owned-setup).
+
 Branchless help requests stay on the read-only answer route even when natural
 language classification suggests a repository task. File changes require an
 authoritative branch from a supported surface, such as a PR review comment;

docs/security-operations/operations/upgrade-rollback.mdx

@@ -43,8 +43,8 @@ Copilot has three separate versioned layers:
 | Layer | What changes it | What still needs review |
 |---|---|---|
 | Installed CLI | `copilot upgrade` or an explicit npm/pnpm package version | The CLI prepares local files; it does not rewrite committed workflows merely by upgrading |
-| Remote Action reference | The Copilot `uses` references in committed workflows | `@v3` follows the published major tag; an exact version or commit SHA stays pinned until explicitly changed |
-| Generated workflow files | An approved `copilot setup --update-workflows` run | New jobs, inputs and native continuation steps must be committed, reviewed and merged |
+| Remote Copilot reference | Action and reusable-workflow `uses` references in committed workflows | `@v3` follows the published major tag; an exact version or commit SHA stays pinned until explicitly changed |
+| Generated workflow files | An approved `copilot setup --update-workflows` run | New jobs, inputs and coordinator calls must be committed, reviewed and merged |
 
 Moving a tag does not add steps to an old YAML file. Upgrading the CLI does not
 change the Action references in Git. A merge into `develop` is not a package or
@@ -72,6 +72,18 @@ copilot setup --web --dry-run
 
 **3. Regenerate and review workflows.**
 
+Before upgrading the comment callbacks, update self-hosted GitHub Actions runners
+to **2.336.0+**. The centralized coordinator uses GitHub.com's self-repository
+references to keep its internal Action on the exact selected workflow commit.
+Verify platform support before adopting this format on other GitHub deployments.
+Check that the repository/organization Actions policy permits the published
+`vypdev/copilot/.github/workflows/copilot_comment_runtime.yml` reusable workflow
+at your selected ref, as well as the existing Copilot Action.
+If the existing comment jobs have custom dependency/bootstrap steps, migrate them
+into the reviewed repository setup action before replacing those jobs; setup
+blocks silently dropping them. Keep the prior reviewed callbacks until this is
+ready. See [repository-owned setup](/security-operations/operations/verification#repository-owned-setup).
+
 Apply a reviewed workflow upgrade:
 
 ```bash
@@ -83,9 +95,14 @@ verification setup question disabled for this preparation pass. Review the
 displayed create/preserve result and changes before approval. The installer
 creates `.github/actions/copilot-verification-setup/action.yml` only if absent;
 existing action bytes and auxiliary files are preserved through upgrades.
-Generated workflows use `vypdev/copilot@v3`. If your repository pins versions
-or SHAs, review **every** Copilot `uses` reference, including native
-continuation/post steps, and apply the same chosen compatible published ref.
+Generated comment callbacks use
+`vypdev/copilot/.github/workflows/copilot_comment_runtime.yml@v3`; other generated
+callbacks continue using `vypdev/copilot@v3`. The coordinator owns setup,
+continuations and cleanup in one job, keeping consumer YAML compact. If your
+repository pins versions or SHAs, update the reusable-workflow and remaining
+Action references to the chosen compatible published release. You do not edit
+the internal `uses: $/` references: GitHub pins them to the called workflow commit.
+The reviewed runner route is retained in the comment call's `with.runs-on` JSON.
 Workflow backups are retained under `.copilot/setup-backups/`.
 
 **4. Customize and merge on trusted main.**
@@ -110,7 +127,8 @@ repository:
 Setup writes `VERIFICATION_SETUP` only when Variable management is enabled
 and follows the reviewed storage/reuse policy. With `--skip-variables`, update
 the effective Variable manually. Confirm that generated workflows pass the
-`verification-setup` input and that the trusted action has been customized.
+`VERIFICATION_SETUP` Variable through the coordinator (or the direct Action's
+`verification-setup` input), and that the trusted action has been customized.
 Choose **Customize** when changing an existing repository Variable; **Reuse**
 keeps existing values. If an organization value must differ for this project,
 select `VERIFICATION_SETUP` in the repository Variable overrides and review the

docs/security-operations/operations/verification.mdx

@@ -125,6 +125,26 @@ Each repository can prepare its dependencies in a native composite action, witho
 editing generated Copilot workflows. GitHub Actions executes the YAML's `uses` and
 `run` steps in the same job where Copilot verifies the candidate.
 
+The generated issue-comment and PR-review-comment workflows call
+`vypdev/copilot/.github/workflows/copilot_comment_runtime.yml@v3`. This reusable
+workflow keeps the complete job inside Copilot: checkout, the admitted operation,
+project setup, verification continuations and native cleanup. Consumer callbacks
+contain one call; they do not copy the twenty possible continuation slots.
+Your dependency action stays in your own repository.
+
+The coordinator reads the caller repository's existing Variables and receives
+only the named Secrets forwarded by the generated callback. Provider credentials
+remain scoped to the initial Copilot step. The project setup action receives the
+existing private runtime environment. Setup retains the selected runner in the
+call's `with.runs-on` JSON string, including self-hosted labels and runner groups.
+
+GitHub Actions runner **2.336.0 or newer** is required: the coordinator's `uses: $/`
+references load Copilot from the exact reusable-workflow commit, including a
+consumer's pinned SHA, outside the mutable project checkout. This is supported on
+GitHub.com; verify equivalent platform support before adopting it elsewhere.
+See [GitHub's self-repository reference announcement](https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/).
+The existing five-minute setup limit and 120-minute job budget remain in force.
+
 ```mermaid
 flowchart LR
   A[Copilot prepares changes] --> B[Repository composite installs dependencies]
@@ -148,8 +168,8 @@ apply the existing publication guards. A separate CI job does not prepare this j
    your project's reviewed runtime and dependency setup; no language, version or
    install command is inferred, and setup does not execute the action.
 3. Update the generated comment workflows with `copilot setup --update-workflows`
-   and review the complete diff. They need the native setup and continuation
-   steps; an older callback cannot execute YAML. Review the action, auxiliary
+   and review the complete diff. They need the reusable coordinator call; an older
+   callback without native support cannot execute YAML. Review the action, auxiliary
    scripts and workflows onto the configured `main-branch` (`MAIN_BRANCH`, normally
    production). Candidate or model changes cannot replace the trusted action.
 4. Enable the same question in the terminal/web assistant, or set non-secret
@@ -182,6 +202,14 @@ procedure](/security-operations/operations/upgrade-rollback#upgrade-an-existing-
 This repository's `setup_platform_smoke.yml` is internal CI and is not installed
 in consumer projects.
 
+If your old comment job contains custom bootstrap steps, keep that reviewed
+workflow until you move those steps into the trusted project setup action and
+review its activation. A job that calls a reusable workflow cannot also declare
+its own steps. Setup blocks that migration rather than silently removing custom
+preparation; it also blocks malformed runner JSON or dependent runner expressions
+that require separate workflow review. Plain generated callbacks and previously
+upgraded callbacks retain their static runner selection automatically.
+
 Copilot captures the complete action directory from an immutable trusted Git SHA
 before candidate changes. The trusted origin ref must be available locally;
 generated comment workflows use a full checkout. The runner executes that snapshot

docs/security-operations/security/self-hosted-runners.mdx

@@ -14,6 +14,12 @@ A self-hosted runner that can access agent credentials MUST be dedicated or isol
 - audit runner labels and permissions;
 - keep local session files outside repository workspaces.
 
+The compact Copilot comment callbacks require GitHub Actions runner **2.336.0+**
+and platform support for self-repository references. Their reusable coordinator
+keeps the Action on the called workflow's exact commit. Setup retains self-hosted
+labels and groups in the call's `with.runs-on` JSON; it does not change group
+access or prove capacity. See [comment workflow upgrades](/security-operations/operations/upgrade-rollback#upgrade-an-existing-copilot-repository).
+
 A shared persistent runner is not equivalent to an ephemeral trusted runner.
 
 The self-hosted platform smoke uses the local pnpm store without exporting a