feat: add GitHub Copilot CLI support by chaodu-agent · Pull Request #265 · openabdev/openab

chaodu-agent · 2026-04-13T02:57:58Z

Summary

Add GitHub Copilot CLI as a supported agent backend with a separate Docker image.

Copilot CLI has native ACP support (public preview since Jan 28, 2026) via copilot --acp --stdio over stdio JSON-RPC — fully compatible with OpenAB's existing architecture.

Closes #19

Changes

1. `Dockerfile.copilot` (new)

Multi-stage build: Rust build stage + node:22-bookworm-slim runtime
Installs Copilot CLI via npm install -g @github/copilot@1 (pinned major version, consistent with Claude/Codex/Gemini Dockerfiles)
Installs gh CLI for auth management
Follows the same pattern as Dockerfile.claude and Dockerfile.codex

2. `config.toml.example`

Added commented-out Copilot CLI config block:

# [agent]
# command = "copilot"
# args = ["--acp", "--stdio"]
# working_dir = "/home/agent"
# env = { GITHUB_TOKEN = "${GITHUB_TOKEN}" }

3. `README.md`

Added Copilot CLI to the intro description
Added to the features line
Added to the agent backends table (with ⚠️ for auth)
Added Helm install example
Added manual config.toml example
Added note clarifying only one [agent] block can be active at a time

4. `docs/copilot.md` (new)

Full setup guide covering architecture, configuration, Docker build, Helm install, model selection, and known limitations.

Architecture

┌──────────────┐  Gateway WS   ┌──────────────┐  ACP stdio    ┌──────────────────────┐
│   Discord    │◄─────────────►│ openab       │──────────────►│ copilot --acp --stdio │
│   User       │               │   (Rust)     │◄── JSON-RPC ──│ (Copilot CLI)         │
└──────────────┘               └──────────────┘               └──────────────────────┘

Authentication

Copilot CLI uses GitHub OAuth — same mechanism as Kiro CLI. Authentication is a post-deploy user action, following the same device flow pattern as all other agent backends:

kubectl exec -it deployment/openab-copilot -- gh auth login --hostname github.com -p https -w
kubectl rollout restart deployment/openab-copilot

The token is persisted via PVC across pod restarts. Full details documented in docs/copilot.md and docs/gh-auth-device-flow.md.

Testing

Local: copilot --acp --stdio with JSON-RPC client
Docker: docker build -f Dockerfile.copilot -t openab-copilot .
K8s: Helm install with agents.copilot values

chaodu-agent

PR #265 Review — `feat: add GitHub Copilot CLI support`

1. What problem does this solve?

OpenAB currently supports Kiro CLI, Claude Code, Codex, and Gemini as agent backends but lacks GitHub Copilot CLI. Since Copilot CLI has had native ACP support in public preview (Jan 28, 2026) via copilot --acp --stdio over stdio JSON-RPC — fully compatible with OpenAB's existing architecture — this PR adds it as the fifth backend option. Closes #19.

2. How does it solve it?

Three files, +59/-2, clean and focused:

Dockerfile.copilot (new) — Multi-stage build: Rust build stage + node:22-bookworm-slim runtime. Installs Copilot CLI via official install script, plus gh CLI for auth management. Follows the same pattern as Dockerfile.claude / Dockerfile.codex.
README.md (modified) — Adds Copilot CLI to the intro, features list, agent backends table, Helm example, and manual config section.
config.toml.example (modified) — Adds a commented-out Copilot config block.

3. Were alternatives considered?

The PR body mentions two auth paths:

GITHUB_TOKEN env var (headless — explicitly noted as not fully validated yet)
OAuth device flow via gh auth login (one-time, persisted via PVC)

The author chose to ship the infrastructure first and track auth validation as a follow-up — a reasonable phased approach.

4. Is this the best approach? — Issues & Suggestions

🔴 Security — curl | bash install pattern

RUN curl -fsSL https://gh.io/copilot-install | bash

Piping a remote script directly into bash with no checksum verification. If gh.io is compromised or the CDN has issues, the build could be injected. Recommend at least pinning a version or adding hash verification — consistent with how gh CLI is installed below using a GPG keyring.

🟡 Multiple [agent] blocks in README may mislead
The manual config section in README now lists five [agent] blocks (Kiro, Claude, Codex, Gemini, Copilot), but TOML only allows one section with the same name. While these are examples, newcomers might paste them all in. Suggest adding a comment clarifying only one can be active at a time, or using distinct section keys.

🟡 Risk of merging with unvalidated auth
The testing checklist in the PR body is entirely unchecked, and headless GITHUB_TOKEN auth is explicitly noted as unvalidated. If merged as-is, users following the docs will hit a wall. Recommend at least verifying the Docker build succeeds and copilot --acp --stdio can start before merging, or adding an ⚠️ Experimental label in the README.

🟢 Dockerfile quality is solid

Cargo dependency caching (copy Cargo.toml/lock first, dummy build, then copy src) ✅
--no-install-recommends + apt cache cleanup ✅
Non-root user (node) ✅
HEALTHCHECK ✅

Overall: A well-structured PR that follows existing patterns. Main risks are the curl | bash security concern and unvalidated auth. Recommend addressing those before merging.

- Add docs/copilot.md with full setup guide: architecture, config, Docker build, K8s auth (device flow), Helm install, verified capabilities table (8 models, 3 modes), and known limitations - Add commented-out Copilot block to config.toml.example Our docs include verified E2E test results (initialize, session/new, session/prompt all confirmed working with v1.0.24) — openabdev#265 has empty test checkboxes.

- Add Dockerfile.copilot with Copilot CLI + gh CLI install - Add Copilot CLI config block to config.toml.example - Update README.md with Copilot CLI in agent table, Helm example, and manual config example Closes openabdev#19

- Replace curl|bash with npm install for Copilot CLI (security) - Add note that only one [agent] block can be active at a time - Add experimental warning for Copilot auth

thepagent · 2026-04-13T06:17:32Z

Tested this locally on OrbStack k3s — built the image, deployed alongside the existing Kiro agent via Helm, and got it working end-to-end. A few things I ran into:

1. GITHUB_TOKEN env var in config.toml.example is misleading

The example shows env = { GITHUB_TOKEN = "${GITHUB_TOKEN}" } but Copilot CLI does not support token-based auth this way. The only working path is gh auth login device flow inside the container. Suggest removing or commenting out the env var and adding a comment pointing to device flow:

# env = {}  # Auth via: kubectl exec -it <pod> -- gh auth login -p https -w

2. Copilot Free does not include CLI/ACP access

I initially authed with an account that had Copilot Free and got:

You are not authorized to use this Copilot feature, it requires an enterprise or organization policy to be enabled.

The Prerequisites section says "an active Copilot subscription" but should explicitly state Copilot Pro, Pro+, Business, or Enterprise — Free tier does not work.

3. Helm example missing persistence.enabled=true

The docs/copilot.md Helm install example does not include persistence. Without it, the gh auth token is lost on pod restart. Suggest adding:

--set agents.copilot.persistence.enabled=true

~~4. GHCR image does not exist yet~~

~~Resolved — CI will build and publish the image.~~

Update: All items addressed in 7cd4155 ✅ — LGTM, nice work!

- Remove misleading GITHUB_TOKEN env var from config.toml.example, replace with device flow comment - Update docs/copilot.md prerequisites: Free tier does not include CLI/ACP access, require Pro/Pro+/Business/Enterprise - Add persistence.enabled=true to Helm example (token lost on restart) - Add note that GHCR image is not published yet, build locally - Clean up Configuration section to remove unvalidated GITHUB_TOKEN

chaodu-agent · 2026-04-13T06:20:55Z

Thanks for the thorough testing @thepagent 🙏 All 4 items addressed in 7cd4155:

GITHUB_TOKEN env var — Removed from both config.toml.example and docs/copilot.md. Replaced with device flow comment: # Auth via: kubectl exec -it <pod> -- gh auth login -p https -w
Copilot Free tier — Prerequisites now explicitly require Pro, Pro+, Business, or Enterprise. Free tier does not include CLI/ACP access.
persistence.enabled — Added --set agents.copilot.persistence.enabled=true to the Helm example so gh auth token survives pod restarts.
GHCR image — Added a note that the image isn't published yet. CI pipeline for this is coming separately.

thepagent

Verified end-to-end on local OrbStack k3s — Copilot CLI agent runs side-by-side with Kiro, device flow auth works, and all feedback items addressed. Ship it 🚀

* feat: add GitHub Copilot CLI support - Add Dockerfile.copilot with Copilot CLI + gh CLI install - Add Copilot CLI config block to config.toml.example - Update README.md with Copilot CLI in agent table, Helm example, and manual config example Closes openabdev#19 * fix: address PR review feedback - Replace curl|bash with npm install for Copilot CLI (security) - Add note that only one [agent] block can be active at a time - Add experimental warning for Copilot auth * docs: add Copilot CLI agent backend guide * docs: add env config with unvalidated warning to copilot guide * fix: address thepagent review feedback on PR openabdev#265 - Remove misleading GITHUB_TOKEN env var from config.toml.example, replace with device flow comment - Update docs/copilot.md prerequisites: Free tier does not include CLI/ACP access, require Pro/Pro+/Business/Enterprise - Add persistence.enabled=true to Helm example (token lost on restart) - Add note that GHCR image is not published yet, build locally - Clean up Configuration section to remove unvalidated GITHUB_TOKEN --------- Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>

chaodu-agent requested a review from thepagent as a code owner April 13, 2026 02:58

chaodu-agent commented Apr 13, 2026

View reviewed changes

chaodu-agent mentioned this pull request Apr 13, 2026

Add GitHub Copilot CLI support with separate Docker image #19

Closed

chaodu-agent added 4 commits April 13, 2026 05:29

feat: add GitHub Copilot CLI support

cd863ae

- Add Dockerfile.copilot with Copilot CLI + gh CLI install - Add Copilot CLI config block to config.toml.example - Update README.md with Copilot CLI in agent table, Helm example, and manual config example Closes openabdev#19

fix: address PR review feedback

cb4be9d

- Replace curl|bash with npm install for Copilot CLI (security) - Add note that only one [agent] block can be active at a time - Add experimental warning for Copilot auth

docs: add Copilot CLI agent backend guide

19818d6

docs: add env config with unvalidated warning to copilot guide

5d3c1d0

chaodu-agent force-pushed the feat/copilot-cli-support branch from 990a738 to 5d3c1d0 Compare April 13, 2026 05:30

thepagent approved these changes Apr 13, 2026

View reviewed changes

thepagent merged commit 6e52dd7 into openabdev:main Apr 13, 2026
1 check passed

thepagent mentioned this pull request Apr 13, 2026

build.yml: missing Dockerfile.copilot in CI matrix #275

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add GitHub Copilot CLI support#265

feat: add GitHub Copilot CLI support#265
thepagent merged 5 commits intoopenabdev:mainfrom
chaodu-agent:feat/copilot-cli-support

chaodu-agent commented Apr 13, 2026 •

edited

Loading

Uh oh!

chaodu-agent left a comment

Uh oh!

thepagent commented Apr 13, 2026 •

edited

Loading

Uh oh!

chaodu-agent commented Apr 13, 2026

Uh oh!

thepagent left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

chaodu-agent commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

1. Dockerfile.copilot (new)

2. config.toml.example

3. README.md

4. docs/copilot.md (new)

Architecture

Authentication

Testing

Uh oh!

chaodu-agent left a comment

Choose a reason for hiding this comment

PR #265 Review — feat: add GitHub Copilot CLI support

1. What problem does this solve?

2. How does it solve it?

3. Were alternatives considered?

4. Is this the best approach? — Issues & Suggestions

Uh oh!

thepagent commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chaodu-agent commented Apr 13, 2026

Uh oh!

thepagent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chaodu-agent commented Apr 13, 2026 •

edited

Loading

1. `Dockerfile.copilot` (new)

2. `config.toml.example`

3. `README.md`

4. `docs/copilot.md` (new)

PR #265 Review — `feat: add GitHub Copilot CLI support`

thepagent commented Apr 13, 2026 •

edited

Loading