Private/waabusea/switchgh token

[WaelAbuSeada]

Switch gh copilot CLI to built-in auth

Fixes AB#638509

[github-actions]

$\textbf{🟡\ Medium\ Severity\ —\ Security} \quad \color{gray}{\texttt{\small Iteration\ 1}}$

Subprocess receives over-privileged token

The GITHUB_TOKEN passed as GH_TOKEN to the Copilot CLI subprocess carries pull-requests: write and issues: write permissions that the CLI needs only copilot-requests: write for. If the CLI process were compromised or behaved unexpectedly, it could modify PR/issue data using those extra scopes.

Recommendation:

• This is an inherent limitation of the GitHub Actions token model (sub-tokens with reduced scopes cannot be minted), but the risk should be acknowledged in the code comment. Ensure the Copilot CLI version is pinned to a verified release to reduce the blast radius of a supply-chain compromise.

Suggested change

	$cleanEnv['GH_TOKEN'] = $CopilotToken
	# Pass only a safe allowlist of env vars to the subprocess.
	# NOTE: GH_TOKEN carries full workflow permissions (pull-requests: write,
	# issues: write, copilot-requests: write). GitHub Actions cannot mint a
	# narrower sub-token, so pin the Copilot CLI version to a verified release.
	$cleanEnv['GH_TOKEN'] = $GithubToken

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why}