You have a GitHub repository that uses the GitHub Copilot coding agent to resolve issues...

Microsoft GH-600 Question Answer

You have a GitHub repository that uses the GitHub Copilot coding agent to resolve issues in an ephemeral GitHub Actions environment.

Builds fail unless an environment variable named NPM_TOKEN is available, because the repository depends on a private package registry.

A workflow named .github/workflows/copilot-setup-steps.yml was added but was merged into a non-default branch and does NOT run when new agent sessions start.

You need to ensure that for every new agent session, the setup steps run, and the private registry token is available as NPM_TOKEN, without hardcoding secrets in the repository.

What should you do?

Create an organization-level Actions secret named NPM_TOKEN and reference it from .github/copilot-instructions.md.

Move .github/workflows/copilot-setup-steps.yml to the repository’s default branch and store the token as a GitHub Actions environment secret named NPM_TOKEN in the Copilot environment.

Disable the agent’s integrated firewall and rename the workflow.

Add the token directly under env: npm_token: in the workflow file.