[Feature Request] Allow GitHub Apps to mint short-lived Copilot tokens for agentic workflows with per-app budget controls #42477

Summary
We need a way for a GitHub App to mint a short-lived (≤ 6 hours) Copilot inference token so agentic workflows can consume Copilot AI Credits under a per-app budget cap, drawn from the organization's global Copilot AI Credits pool — rather than relying on the workflow-run GITHUB_TOKEN (no per-app control) or a user-owned PAT (COPILOT_GITHUB_TOKEN, seat-bound and operationally heavy).

Background
How GitHub Agentic Workflows are billed today
Running an agentic workflow (gh-aw) produces two cost streams: GitHub Actions minutes for compute, and AI inference charged by the model provider. For the default Copilot engine, there are two billing paths: [github.github.com]

Organization billing — Inference is charged as AI Credits (AIC) against the organization's Copilot tenant. Requires (1) the org policy"Allow use of Copilot CLI billed to the organization" enabled, (2) copilot-requests: write declared under permissions: in the workflow frontmatter, and (3) the compiled .lock.yml committed. [github.github.com]
Individual / seat billing — If those conditions aren't met, the workflow must be configured with a user-supplied COPILOT_GITHUB_TOKEN (fine-grained PAT). Inference is attributed to (and limited by) the PAT owner's Copilot entitlements. [github.github.com], [github.github.com]

GitHub recently removed the PAT requirement so agentic workflows can authenticate via the built-in GITHUB_TOKEN, eliminating the operational and security risks of managing long-lived PATs for automations at scale. [github.blog], [devops.com]

Current cost-control surface

gh-aw exposes runtime guardrails such as max-ai-credits and max-daily-ai-credits, enforced per workflow run. [github.github.com]
For org-level billing, GitHub's official guidance is to use cost centers (cost attribution to groups of organizations, with budgets applied to cost centers) plus the gh-aw cost-management tools to monitor and cap token usage per workflow run. The changelog explicitly notes:"User-level inference budgets are not considered when billing directly to the organization, because the cost is not attributed to a user." [github.blog]
Copilot itself moved to usage-based AI Credits billing on June 1, 2026 (1 AIC = $0.01), with included credits pooled at the billing-entity level for Business/Enterprise plans. [docs.github.com], [github.blog]

Problem
Neither billing path provides per-application budget control for agentic workflows:

GITHUB_TOKEN (org billing path) is global to the org — there is no built-in mechanism to control how many AI Credits a specific workflow or a specific GitHub App consumes from the org-wide pool. Cost centers operate at the org level, not the app level. [github.blog]
COPILOT_GITHUB_TOKEN (seat billing path) ties spend to an individual user's Copilot seat, with all the PAT lifecycle/rotation/attrition overhead, and does not represent application-level ownership. [github.github.com], [github.github.com]
max-ai-credits / max-daily-ai-credits are enforced by gh-aw at the workflow-run level, not at the GitHub App level — so a single app running many workflows across many repos can still exceed any intended app-level budget. [github.github.com]

This is a blocker for scaling agentic workflows safely across hundreds of applications/repos in a large enterprise, where we need to attribute and cap inference spend per automation system, not per user or per single run.

Proposed Solution
Allow a GitHub App to request a short-lived Copilot inference token for agentic workflow use, with the following properties:

1. Token issuance by GitHub App

• GitHub App can mint a Copilot token with a configurable TTL up to 6 hours.
• Token is ephemeral, scoped to the issuing App installation, and consumable by gh-aw (or other Copilot-CLI–based runners) in place of GITHUB_TOKEN / COPILOT_GITHUB_TOKEN.

2. Per-app AI Credits cap- Org admins can assign AIC caps (per-run, per-day, per-month) to each GitHub App.

• The cap draws from the organization's global Copilot AI Credits pool (not tied to any user seat).
• Once an app's cap is exhausted, further token issuance is denied with a clear error.

3. Cost center attribution at the App level

• Each GitHub App can be tagged with a cost center, so all inference spend is attributed at the app level in org-wide AIC reporting — extending the current cost-center model down from org → app. [github.blog]

4. Audit & observability

• Token issuance, AIC consumption, and cap breaches are logged and surfaced in the existing Copilot billing/usage reports and gh aw audit output.