Advanced A3 · Cloud agentVerified 2 Nov 2026

Issue to pull request, with guardrails

Hand an issue to the Copilot cloud agent only after the repository is ready to receive its pull request.

Key ideas

Agent-ready issues: One outcome, testable acceptance criteria, out-of-scope files and a verification command. The agent works from the issue; vague issues get vague PRs.
copilot-setup-steps.yml: A workflow whose job must be named copilot-setup-steps. Only steps, permissions, runs-on, services, snapshot and timeout-minutes (max 59) are honoured. Other keys are ignored.
Least-privilege CI: Top-level permissions: contents: read, pull_request rather than pull_request_target, timeouts on every job, and actions pinned to full commit SHAs.
Human gates: The agent works on a copilot/ branch and opens a draft PR. A person with write access approves workflow runs. The person who asked for the work can't approve the PR, and Copilot can't approve or merge it.

Worked example: Making setup steps valid

The starter job is called setup, uses a container, runs for 90 minutes and writes a secret into .npmrc.

Before

before

jobs:
  setup:
    runs-on: ubuntu-latest
    container: node:24
    timeout-minutes: 90
    permissions: write-all
    steps:
      - uses: actions/checkout@v5
      - run: echo "token=${{ secrets.DEPLOY_TOKEN }}" > .npmrc

After

after

jobs:
  copilot-setup-steps:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
      - run: node --version && npm test

Why it works: Wrong job name: Copilot ignores the file. container isn't supported. Timeouts over 59 aren't allowed. write-all and a secret in a file give an autonomous agent far more than it needs.

An agent PR quietly changes ci.yml to pull_request_target with write permissions. Tests pass and the summary says "CI improvements". Without CODEOWNERS on /.github/ and a checklist item for workflow changes, a busy reviewer merges it.

Lab setup

Folder: issue-to-pr/ in the labs download.

Node.js 22+ and Git for the local checks.
Optional for the hosted part: a private GitHub repository with the Copilot cloud agent enabled (plan and policy dependent).

Terminal

cd issue-to-pr && git init -q && git add -A && git commit -qm baseline
npm run verify   # expect 3 FAIL. npm run check:workflows lists every seeded problem.

When you're done, npm run verify prints:

Expected result

PASS  1. Issue acceptance criteria met (npm test)
PASS  2. CLI prints JSON (node bin/todos.mjs --format=json)
PASS  3. Workflows, templates and runbook are safe and complete

Review rubric

Score each line 0 (missing), 1 (partly there) or 2 (as described). Passing verify is necessary, not sufficient.

Rubric for issue-to-pr
Criterion	2 points means
Issue quality	Testable acceptance criteria; out-of-scope explicit
Least privilege	contents: read by default; writes per job only when needed
Supply chain	Every action pinned to a SHA with its tag noted
Setup steps	Valid job name and keys, timeout ≤ 59, no secrets, tested on change
Review	Checklist used; diff and session log read; scope respected
Recovery	Runbook covers setup failure, missing capability and rollback

Safety note

Use a private or throwaway repository and no real secrets. Read the diff before you click Approve and run workflows. The agent firewall doesn't cover processes started by setup steps, so keep setup minimal.

Run the lab

Pro

Lab repository and walkthrough

The issue-to-pr/ practice repository with npm run verify, a reference solution, and a step-by-step walkthrough.

Workflow checker that explains every seeded problem
Agent-task issue template, PR template and CODEOWNERS
Review runbook and reference solution

Unlock Pro — $19 Already a member? Sign in

One payment, lifetime access. $29 $19 launch price.

Try it yourself· about 75 min

Make the repository safe to automate, then hand issue 0001 to an agent and review its PR.

Fix everything npm run check:workflows reports.
Add the PR template, CODEOWNERS and RUNBOOK.md.
Assign the issue to the cloud agent in a private repo, or run it in local agent mode.
Review with your checklist, request one change, then run npm run verify.

You should see: Three PASS lines from npm run verify and a reviewed PR (or local diff) that touches src/report.js only.

Knowledge check

Get every answer right to complete this module. Progress is saved in this browser only.