[copilot-cli-research] Copilot CLI Deep Research - 2026-10-03 #65223

Analysis Date: 2026-10-03
Repository: github/gh-aw
Scope: 302 total workflows, ~117 using the Copilot engine (24 engine: copilot, 93 id: copilot extended)

📊 Executive Summary

Key findings (quick grep-based survey; counts are approximate):

• The engine (copilot_engine_execution.go) emits --add-dir, --log-level, --log-dir, --no-custom-instructions, --no-auto-update, --no-ask-user, --autopilot, --max-autopilot-continues, --allow-all-paths, --agent, --disable-builtin-mcps, plus headless --host/--port. Most are compiler-managed.
• Only 1 workflow uses --share; custom agent: is used in ~145 workflows.
• max-turns appears in only 25 workflows, max-continuations in 10.
• 12 workflows lack timeout-minutes; 11 use strict: false.
• Engine version pinned in 25 files; model: set in many files (175 matches, includes non-engine uses).

Primary recommendation: add budget guardrails (max-turns/max-continuations + timeout-minutes) to long-running Copilot workflows.

🔴 High Priority

1. Missing timeouts – 12 workflows have no timeout-minutes; set explicit limits (grep -L timeout-minutes .github/workflows/*.md).
2. strict: false workflows (11) – review whether network/safe-output hardening can be enabled.

🟡 Medium Priority

3. Run budgets – only ~8% of Copilot workflows cap turns/continuations; add max-continuations for autopilot ones.
4. Conversation transcripts – --share used once; enable via engine.args for audit/debug-heavy workflows (e.g. audit and triage agents).
5. Pin versions consistently – 25 pinned vs. the rest floating; document policy for when pinning is required.
6. Cache/repo-memory – 81 cache-memory vs. 30 repo-memory; periodic report workflows without either could avoid redundant analysis.

🟢 Low Priority

• plugins config unused (0 in prior run); BYOK env used in few workflows; document these in engines.md.

Trends

Versus 2026-09-08 (run 34184590907): workflows 299→302; extended Copilot config 88→93; max-turns 30→25; repo-memory 38→30 (counting methods may differ); --share unchanged at 1.

Action Items

• Add timeout-minutes to the 12 workflows missing it
• Audit the 11 strict: false workflows
• Add max-continuations to autopilot workflows
• Pilot --share on 2–3 audit workflows
• Document version pinning policy

Generated by Copilot CLI Deep Research (Run: 37095020341)

Generated by 🔬 Copilot CLI Deep Research Agent · copilot · auto · 13.8 AIC · ⌖ 6.94 AIC · ⊞ 10.7K · ◷

• expires on Oct 3, 2026, 8:03 PM UTC-08:00