Update copilot-setup-steps.yml #228
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Copilot Setup Steps" | |
| # Automatically run the setup steps when they are changed to allow for easy validation, and | |
| # allow manual testing through the repository's "Actions" tab | |
| on: | |
| workflow_dispatch: | |
| push: | |
| paths: | |
| - .github/workflows/copilot-setup-steps.yml | |
| pull_request: | |
| paths: | |
| - .github/workflows/copilot-setup-steps.yml | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }} | |
| GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }} | |
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }} | |
| # IMF SDMX subscription keys — forwarded into the Copilot coding-agent shell so | |
| # interactive sessions can authenticate api.imf.org / sdmxcentral.imf.org / dataservices.imf.org | |
| # (WEO via www.imf.org Datamapper is unauthenticated). Primary is consumed by | |
| # scripts/imf-client.ts via Ocp-Apim-Subscription-Key; secondary is a hot-spare rotation key | |
| # (stored only, not auto-consumed). See analysis/imf/agentic-integration.md §"Pre-warm gate". | |
| IMF_SDMX_SUBSCRIPTION_KEY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY }} | |
| IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot. | |
| copilot-setup-steps: | |
| runs-on: ubuntu-26.04 | |
| # Set the permissions to the lowest permissions possible needed for your steps. | |
| # Copilot will be given its own token for its operations. | |
| permissions: | |
| contents: read | |
| actions: read | |
| attestations: read | |
| checks: read | |
| deployments: read | |
| issues: write | |
| models: read | |
| discussions: read | |
| pages: read | |
| pull-requests: write | |
| security-events: read | |
| statuses: read | |
| # Steps run before the agent starts working | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| # Forward IMF SDMX subscription keys to the Copilot coding-agent runtime. | |
| # The top-level workflow `env:` block ONLY scopes to setup-job steps — it does | |
| # NOT propagate to the agent's interactive bash sessions. The Copilot runtime | |
| # inherits env vars written to $GITHUB_ENV during setup-steps. This mirrors the | |
| # pattern used by .github/actions/news-prewarm/action.yml for news workflows. | |
| # The keys gate access to the SDMX 3.0 surface at api.imf.org/external/sdmx/3.0 | |
| # (the only IMF SDMX surface this repo targets). The Datamapper transport at | |
| # www.imf.org/external/datamapper/api/v1 is unauthenticated and unaffected. | |
| # Reference: https://docs.github.com/en/copilot/customizing-copilot/customizing-the-development-environment-for-copilot-coding-agent | |
| - name: Export IMF SDMX subscription keys to agent env | |
| env: | |
| IMF_SDMX_SUBSCRIPTION_KEY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY }} | |
| IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY }} | |
| run: | | |
| if [ -n "${IMF_SDMX_SUBSCRIPTION_KEY:-}" ]; then | |
| echo "IMF_SDMX_SUBSCRIPTION_KEY=${IMF_SDMX_SUBSCRIPTION_KEY}" >> "$GITHUB_ENV" | |
| echo "::add-mask::${IMF_SDMX_SUBSCRIPTION_KEY}" | |
| echo "✅ IMF_SDMX_SUBSCRIPTION_KEY exported to agent env" | |
| else | |
| echo "::warning::IMF_SDMX_SUBSCRIPTION_KEY secret not set — SDMX calls to api.imf.org will fail with 404 auth-mask diagnostic" | |
| fi | |
| if [ -n "${IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY:-}" ]; then | |
| echo "IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY=${IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY}" >> "$GITHUB_ENV" | |
| echo "::add-mask::${IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY}" | |
| echo "✅ IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY exported to agent env" | |
| else | |
| echo "ℹ️ IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY not set (optional rotation hot-spare)" | |
| fi | |
| # Setup environment | |
| - name: Setup Environment (resilient apt install) | |
| timeout-minutes: 10 | |
| run: | | |
| echo "🔧 Setting up environment..." | |
| # System dependencies for Web rendering. | |
| # Retry apt metadata + install to tolerate transient mirror/network failures. | |
| for attempt in 1 2 3; do | |
| if sudo apt-get update -o Acquire::Retries=5 -o Acquire::http::Timeout=30; then | |
| break | |
| fi | |
| echo "⚠️ apt-get update failed (attempt $attempt) — retrying in $((attempt * 10))s" | |
| sleep $((attempt * 10)) | |
| if [ "$attempt" -eq 3 ]; then | |
| echo "❌ apt-get update failed after 3 attempts" | |
| exit 1 | |
| fi | |
| done | |
| for attempt in 1 2 3; do | |
| if sudo apt-get install -y --no-install-recommends graphviz; then | |
| break | |
| fi | |
| echo "⚠️ apt-get install graphviz failed (attempt $attempt) — retrying in $((attempt * 10))s" | |
| sleep $((attempt * 10)) | |
| if [ "$attempt" -eq 3 ]; then | |
| echo "❌ apt-get install graphviz failed after 3 attempts" | |
| exit 1 | |
| fi | |
| done | |
| echo "✅ environment setup complete" | |
| # JavaScript/TypeScript setup | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "26" | |
| cache: 'npm' | |
| cache-dependency-path: | | |
| package-lock.json | |
| .github/workflows/copilot-setup-steps.yml | |
| - name: Install gh-aw CLI | |
| run: | | |
| GH_AW_VERSION="v0.80.4" | |
| gh extension install github/gh-aw --pin "$GH_AW_VERSION" | |
| env: | |
| GH_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }} | |
| - name: Install dependencies (resilient npm ci) | |
| timeout-minutes: 15 | |
| run: | | |
| npm config set fetch-retries 5 | |
| npm config set fetch-retry-mintimeout 20000 | |
| npm config set fetch-retry-maxtimeout 120000 | |
| for attempt in 1 2 3; do | |
| if npm ci; then | |
| echo "✅ npm ci succeeded (attempt $attempt)" | |
| break | |
| fi | |
| echo "⚠️ npm ci failed (attempt $attempt) — retrying in $((attempt * 10))s" | |
| sleep $((attempt * 10)) | |
| if [ "$attempt" -eq 3 ]; then | |
| echo "❌ npm ci failed after 3 attempts" | |
| exit 1 | |
| fi | |
| done | |
| # Pre-install MCP server packages globally | |
| - name: Install MCP server packages globally (resilient) | |
| timeout-minutes: 20 | |
| run: | | |
| echo "📦 Installing MCP server packages globally..." | |
| npm config set fetch-retries 5 | |
| npm config set fetch-retry-mintimeout 20000 | |
| npm config set fetch-retry-maxtimeout 120000 | |
| install_global_retry() { | |
| pkg="$1" | |
| for attempt in 1 2 3; do | |
| if npm install -g "$pkg"; then | |
| echo "✅ Installed $pkg (attempt $attempt)" | |
| return 0 | |
| fi | |
| echo "⚠️ Failed installing $pkg (attempt $attempt) — retrying in $((attempt * 10))s" | |
| sleep $((attempt * 10)) | |
| done | |
| echo "❌ Failed installing $pkg after 3 attempts" | |
| return 1 | |
| } | |
| # Install Node.js MCP servers that exist on npm | |
| install_global_retry @modelcontextprotocol/server-filesystem | |
| install_global_retry @modelcontextprotocol/server-memory | |
| install_global_retry @modelcontextprotocol/server-sequential-thinking | |
| # Pre-cache @playwright/mcp for faster startup | |
| install_global_retry @playwright/mcp | |
| # Do not pre-install Playwright browser binaries in setup. | |
| # Browser downloads are large and can exceed this workflow's setup budget; | |
| # agents can install browsers on demand when browser automation is required. | |
| # Install World Bank MCP server for economic data | |
| install_global_retry worldbank-mcp@1.0.1 | |
| # Install PxWeb MCP server for SCB (Statistics Sweden) data | |
| install_global_retry @jarib/pxweb-mcp@2.0.0 | |
| echo "✅ Node.js MCP server packages installed globally" | |
| # Verify all MCP server installations | |
| - name: Verify MCP server installations | |
| run: | | |
| echo "🔍 Verifying MCP server installations..." | |
| echo "=== Node.js MCP Servers ===" | |
| echo "Checking mcp-server-filesystem..." | |
| which mcp-server-filesystem && echo "✅ mcp-server-filesystem found" || echo "❌ mcp-server-filesystem NOT found" | |
| echo "Checking mcp-server-memory..." | |
| which mcp-server-memory && echo "✅ mcp-server-memory found" || echo "❌ mcp-server-memory NOT found" | |
| echo "Checking mcp-server-sequential-thinking..." | |
| which mcp-server-sequential-thinking && echo "✅ mcp-server-sequential-thinking found" || echo "❌ mcp-server-sequential-thinking NOT found" | |
| echo "Checking @playwright/mcp..." | |
| which mcp-server-playwright 2>/dev/null && echo "✅ mcp-server-playwright found" || echo "ℹ️ @playwright/mcp available via npx" | |
| echo "Checking worldbank-mcp..." | |
| which worldbank-mcp && echo "✅ worldbank-mcp found" || echo "❌ worldbank-mcp NOT found" | |
| echo "Checking @jarib/pxweb-mcp..." | |
| which pxweb-mcp && echo "✅ pxweb-mcp (SCB) found" || echo "❌ pxweb-mcp NOT found" | |
| echo "" | |
| echo "=== HTTP MCP Servers ===" | |
| echo "📍 GitHub MCP Server: Using HTTP endpoint (https://api.githubcopilot.com/mcp/insiders)" | |
| echo "📍 Riksdag-Regering MCP Server: Using HTTP endpoint (https://riksdag-regering-ai.onrender.com/mcp)" | |
| echo "=== Local stdio MCP Servers ===" | |
| echo "📍 World Bank MCP Server: worldbank-mcp (stdio)" | |
| echo "📍 SCB MCP Server: @jarib/pxweb-mcp --url https://api.scb.se/OV0104/v2beta (stdio)" | |
| echo "=== TypeScript clients (invoked via tsx, no MCP) ===" | |
| echo "📍 IMF: scripts/imf-client.ts + scripts/imf-fetch.ts — direct HTTPS to data.imf.org / www.imf.org" | |
| echo "✅ MCP server verification complete" |