Regression in `1.0.13`: `session.send_and_wait` fails with `400` Bad Request in GitHub Actions (works on `1.0.11`)

[Pantelis-Santorinios]

Warning - This might be a public repository, please be mindful of sharing sensitive data

Why are you seeing this issue?

This is a support escalation! You can find out more about expectations on communications and response times in the on-call docs. Thank you for doing your part to keep GitHub customers happy!

Severity

Note, for Sev1 issues always page the team first, using the PagerDuty information in the service catalog and the command .pager trigger N/A <reason>. Opening an issue for a Sev2 incident can come later (and can be done by the available Escalation Engineer).

• sev1 - Engineering must respond, when paged, within 1 business day
• sev2 - Engineering must respond to this issue within 2 business days
• sev3 - Engineering must respond to this issue within 2 business days

Service

copilot-sdk

Context

⚠️ Kindly provide all the requested information to ensure a prompt and efficient response. ⚠️

GitHub Support Plan

• Top 20
• Premium Plus
• Premium
• Enterprise
• Free/Pro/Team

GitHub Product(s) Impacted (check appropriate boxes and provide GHES version if applicable)

• GitHub.com (including GHEC)
• GitHub Enterprise Server.
  • Running version: x.y.z
  • Recently upgraded from version: x.y.z (upgrade date: yyyy-mm-dd)
• Proxima (ghe.com)
  • Customer tenant: -

Customer Impact

If applicable, list the impacted entities:

• Enterprise: - Sabre Corporation
• Organization: -
• Repository: -
• User: -

Zendesk Ticket(s), support bundles, and other relevant Issues and links

• https://github.zendesk.com/agent/tickets/4735364

Issue

we have build some workflows/actions which use python/copilot-sdk to execute some code with copilot.
It was working fine until Friday (maybe longer, but we don't run it in weekends) but today we are getting errors.
We used GITHUB_TOKEN with copilot-requests: write persmission.

Using 1.0.11 works. On Friday we released 1.0.13 and that is confirmed that is causing the issue.

To Reproduce

Steps to reproduce the behavior:

1. Use the workflow and python from the ticket https://github.zendesk.com/agent/tickets/4735364
2. See the error
3. Force Copilot-sdk to be 1.0.11
4. Now it works

Expected behavior

1.0.13 not throwing 400 bad request.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

splunk

exception.message: request failed: checking server-to-server token: bad request: GitHub App Server-To-Server Tokens are not supported for this endpoint

That looks just weird. example request id in the splunk query. You can reproduce this easily.

cc:
@EvanBoyle
@patniko

Support Squad(s): @github/support-squad-copilot @github/support-squad-c2c

[github-actions]

Investigation summary

What I looked at

• CHANGELOG.md entry for v1.0.13 (feature list: cancellation for external tools, clientInfo, Agent Factories pagination, askUserVariant, session-scoped GitHub credential rotation, extension env access, early session-event subscription (Rust), managedSettings, Auto model tiers, sandbox allowBypass, featureFlags).
• python/copilot/client.py — github_token / use_logged_in_user handling in CopilotClient.__init__ and create_session (no SDK-side changes to how GITHUB_TOKEN is forwarded were found between these areas that would explain a 400).
• docs/auth/server-to-server-tokens.md, which documents that GitHub Actions' built-in GITHUB_TOKEN (a GitHub App installation/server-to-server token) is expected to work against Copilot when the org has "Allow use of Copilot CLI billed to the organization" enabled and copilot-requests: write permission is granted — this is exactly the customer's setup.
• nodejs/src/cliVersion.ts, which pins the bundled Copilot CLI/runtime version (1.0.83 as of the latest commit). Each SDK release pins a specific CLI/runtime build, so behavioral differences between SDK 1.0.11 and 1.0.13 are very likely explained by a different pinned Copilot CLI/runtime version, not an SDK code change.

Finding

The error checking server-to-server token: bad request: GitHub App Server-To-Server Tokens are not supported for this endpoint originates from the Copilot backend/runtime's token-validation path — not from SDK-side authentication code. I did not find any diff in python/copilot/client.py's token-handling logic between the relevant versions that would cause this. This strongly suggests the regression was introduced by the newer Copilot CLI/runtime build pinned by SDK 1.0.13, which appears to now reject GitHub App server-to-server tokens (including the Actions GITHUB_TOKEN) on an endpoint that previously accepted them under the CLI pinned by 1.0.11.

This is inconsistent with the documented, supported flow in docs/auth/server-to-server-tokens.md (Actions GITHUB_TOKEN + copilot-requests: write), so I'm classifying this as a genuine regression/bug rather than a documentation or usage issue. The root cause likely lives in the Copilot backend/runtime (server-to-server token validation for this endpoint), and pinpointing the exact runtime change will need input from the runtime/backend team — but from the SDK's perspective, no client-side auth-handling regression was found, pointing the fix toward the CLI/runtime version bump shipped with SDK 1.0.13.

Label applied: bug (confidence: medium — the customer-confirmed regression window strongly implicates the bundled CLI/runtime version bump, but the actual fix will require runtime-side investigation to confirm and resolve).

Generated by Bug Handler for #2559 · copilot · auto · 66.7 AIC · ⌖ 4.43 AIC · ⊞ 7.6K · ◷