The agent session (with custom environment) fails when pushing its output to the GitHub repo

[duylam-katalon]

Select Topic Area

Bug

Copilot Feature Area

Copilot Coding Agent

Body

Hi,

I follow the doc to customize the environment for the Coding Agent with copilot-setup-steps.yml, the content is as below (truncated unnecessary things)

name: "Copilot Coding Agent Environment Setup"

on:
  # Allow for easy validation
  workflow_dispatch:

jobs:
  copilot-setup-steps:
    runs-on: ubuntu-latest
    permissions:
      contents: write # to create new branch
      pull-requests: write # to create new PR
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          lfs: true

      - name: Prepare Git Submodules
        uses: ./.github/actions/prepare-gitsubmodules

I start a new agent session on a branch, and put my prompt

However, these sessions always fail, as the screenshots below (the custom workflow ran successfully)

Below is the log of the section Process Request (Linux)

[truncated]

MCP transport enabled
Fetching tools from MCP server
Base commit 'refs/heads/[my branch name]' not found locally, attempting to fetch from remote
Error: Command failed with exit code 128: git fetch origin REDACTED
    at ChildProcess.<anonymous> (file:///home/runner/work/_temp/***-action-main/dist/index.js:8:2876709)
    at ChildProcess.emit (node:events:531:35)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5) {
  cmd: 'git fetch origin REDACTED',
  code: 128,
  stdout: '',
  stderr: 'remote: Repository not found.\n' +
    "fatal: repository 'https://github.com/[org]/[repo]/' not found\n",
  signal: null
}
Failed to fetch base commit 'refs/heads/[my branch name]': unknown git error: Command failed with exit code 128: git fetch origin REDACTED
CodeQL directory found in toolcache at '/opt/hostedtoolcache/CodeQL/2.23.8/x64'.
Did not enable GitHub Code Search (not enabled in settings)
Request to GitHub API at https://api.githubcopilot.com/agents/swe/internal/memory/v0/[org]/[repo]/recent?limit=20 failed with status 404 (request ID: C808:362362:1ADF76C:1FDECD0:696710D2), body: Resource not found

Failed to read memories with status 404: Resource not found

[truncated]

Already on 'copilot/[generated name]'

Error: Command failed with exit code 128: git push -v origin REDACTED
    at ChildProcess.<anonymous> (file:///home/runner/work/_temp/***-action-main/dist/index.js:8:2876709)
    at ChildProcess.emit (node:events:531:35)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5) {
  cmd: 'git push -v origin REDACTED',
  code: 128,
  stdout: '',
  stderr: 'Pushing to [https://github.com/[org]/[repo]\n](https://github.com/[org]/[repo]/n)' +
    'remote: Repository not found.\n' +
    "fatal: repository 'https://github.com/[org]/[repo]/' not found\n",
  signal: null
}
GitError unknown git error: Command failed with exit code 128: git push -v origin REDACTED git push -v origin REDACTED
Pushing to https://github.com/[org]/[repo]
remote: Repository not found.
fatal: repository 'https://github.com/[org]/[repo]/' not found

ERROR: {
  "name": "GitError",
  "text": "Copilot encountered an unknown Git error. If the problem persists, please contact GitHub Support. To retry, leave a comment on this pull request asking Copilot to try again.",
  "stack": "GitError: unknown git error: Command failed with exit code 128: git push -v origin REDACTED\n    at Ka.execGit (file:///home/runner/work/_temp/******-action-main/dist/index.js:8:2897339)\n    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at async Ka.commitAndPushChanges (file:///home/runner/work/_temp/******-action-main/dist/index.js:8:2888918)\n    at async Xet (file:///home/runner/work/_temp/******-action-main/dist/index.js:122:771118)\n    at async XBl (file:///home/runner/work/_temp/******-action-main/dist/index.js:122:772666)\n    at async fBl (file:///home/runner/work/_temp/******-action-main/dist/index.js:122:779456)",
  "message": "unknown git error: Command failed with exit code 128: git push -v origin REDACTED",
  "cmd": "git push -v origin REDACTED",
  "stderr": "Pushing to [https://github.com/[org]/[repo]\nremote:](https://github.com/[org]/[repo]/nremote:) Repository not found.\nfatal: repository 'https://github.com/[org]/[repo]/' not found\n",
  "code": "unknown",
  "service": "git",
  "skipReport": false,
  "isVisionFlow": false
}
Committing and pushing any changes that occurred before error occurred.

Error: Command failed with exit code 128: git push -v origin REDACTED --no-verify
    at ChildProcess.<anonymous> (file:///home/runner/work/_temp/***-action-main/dist/index.js:8:2876709)
    at ChildProcess.emit (node:events:531:35)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5) {
  cmd: 'git push -v origin REDACTED --no-verify',
  code: 128,
  stdout: '',
  stderr: 'Pushing to [https://github.com/[org]/[repo]\n](https://github.com/[org]/[repo]/n)' +
    'remote: Repository not found.\n' +
    "fatal: repository 'https://github.com/[org]/[repo]' not found\n",
  signal: null
}
Error while committing content to session: GitError: unknown git error: Command failed with exit code 128: git push -v origin REDACTED --no-verify
ERROR: {
  "name": "GitError",
  "text": "Copilot encountered an unknown Git error. If the problem persists, please contact GitHub Support. To retry, leave a comment on this pull request asking Copilot to try again.",
  "stack": "GitError: unknown git error: Command failed with exit code 128: git push -v origin REDACTED --no-verify\n    at Ka.execGit (file:///home/runner/work/_temp/******-action-main/dist/index.js:8:2897339)\n    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at async Ka.commitAndPushChanges (file:///home/runner/work/_temp/******-action-main/dist/index.js:8:2888918)\n    at async Oge.handleError (file:///home/runner/work/_temp/******-action-main/dist/index.js:122:706037)\n    at async fBl (file:///home/runner/work/_temp/******-action-main/dist/index.js:122:779846)",
  "message": "unknown git error: Command failed with exit code 128: git push -v origin REDACTED --no-verify",
  "cmd": "git push -v origin REDACTED --no-verify",
  "stderr": "Pushing to [https://github.com/[org]/[repo]\nremote:](https://github.com/[org]/[repo]/nremote:) Repository not found.\nfatal: repository 'https://github.com/[org]/[repo]/' not found\n",
  "code": "unknown",
  "service": "git",
  "skipReport": false,
  "isVisionFlow": false
}
forceExit is shutting down the process

⚠️ Warning: I tried to connect to the following addresses, but was blocked by firewall rules:


If you need me to access, download, or install something from one of these locations, you can either:

  - Configure Actions setup steps (https://gh.io/copilot/actions-setup-steps) to set up my env before the firewall is enabled.
  - Add the appropriate URLs or hosts to my firewall allow list (https://gh.io/copilot/firewall-config)

In the custom workflow (copilot-setup-steps.yml), I already specify the necessary permissions (content and pull-requests) so I suppose the Copilot should be able to push its changes (in the runner) to the repo

What's else I miss here?

Duy

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[duylam-katalon]

Update: it's actually a logic bug in my pipeline regarding to the access token for retrieving the Git submodules.

I'd like to share more details here as a lesson learn for my own.

My repo has a git submodule to contain another repo called c1. And the copilot-setup-steps.yml is as follows

jobs:
  copilot-setup-steps:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Acquire the access token for submodule repositories
        id: repo_auth
        uses: actions/create-github-app-token@v2
        with:
          app-id: [id]
          private-key: [secret]
          owner: ${{ github.repository_owner }}
          repositories: |
            c1
          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@v5
        with:
          lfs: true

    - name: Initialize git submodules
      shell: bash
      env:
        GH_TOKEN: ${{ steps.repo_auth.outputs.token }}
      run: |
        # use http protocol instead of git
        sed -i 's|git@github.com:|https://github.com/|g' .gitmodules
          
        # Configure auth token for git submodule fetching
        git config --global url."https://x-access-token:$GH_TOKEN@github.com/".insteadOf "https://github.com/"

        git submodule update --init --recursive

The logic bug is: the last step uses the token, which has no access to the current repo (only access to c1 repo). Hence when the Copilot issues the command git push, it basically uses the wrong access token