🐛🧑‍💻 - bugfix permission probes trigger normal automation on temporary branches #569

Is there an existing issue for this?

• I have searched the existing issues.

Which actions are affected?

Commits, Pull Request

Which platforms are affected?

Linux, macOS, Windows

Description

During real #556 setup dogfooding, temporary permission checks created copilot-permission-test-<32 hex> refs. Normal Copilot Commit and Branch Sync workflows then ran against those disposable refs. Closing the probe PR and removing its ref did not stop the triggered runs. Seven still-active/queued probe runs required explicit cleanup; two were occupying self-hosted runners while the actual setup verification waited.

Expected: Copilot-owned event automation should ignore its installer permission-probe namespace at admission. Temporary verification must not start agent analysis, branch reconciliation, or ordinary commit processing. User-owned workflows need an accurate disclosure; they should not be silently rewritten or globally disabled.

Observed: the installed/source and generated commit workflows exclude setup/copilot/**, while these probes use a separate namespace. The problem also affects Branch Sync admission. Cancellation of the seven exact, owned probe runs was verified separately from the installer PRs; no unrelated runs were cancelled.

Reproducing the issue

1. Use the setup CLI from reviewed develop merge f09d3222ffdf9ad88e869e754c6f90af522ca8eb after [#556] ✨ - feat select reusable runner profiles in setup and reconcile source workflow parity #563, against an existing Copilot-enabled organization repository.
2. Select organization reuse and batch delivery, then approve the combined plan. Permission checks create/read/delete isolated refs and PRs; a reviewed retry can run these probes again.
3. Observe push-triggered runs whose head_branch is copilot-permission-test-*, despite cleanup having removed the temporary refs.
4. In this dogfood, platform runs 39163037236 and 39163030188 were running Copilot Commit; 39163028686 was queued. Copilot had four additional queued Commit/Branch Sync runs: 39163023471, 39163023550, 39163011906, 39163012070.
5. The real generated-profile provisioning run 39163029973, with runs-on: {group: vypdev, labels: [self-hosted, codex, Linux]}, had to wait for Linux capacity.

copilot Version

CLI generated from develop f09d3222ffdf9ad88e869e754c6f90af522ca8eb (#563); source/consumer event workflows installed from v3.5.6.

Relevant Log Output

No credentials or Secret values are included. Runtime metadata confirmed the disposable branch namespace, initiating actor, exact commit and creation time before cancelling each owned run.

Additional context and comments

Real installer PRs: copilot #568 and vypdev/platform#180. Their branches and exact installation receipts are separate from the disposable probe refs. All six organization/repository Variable and Secret inventories were byte-equivalent by digest before and after Apply; no shared values changed. Dependency vulnerabilities remain out of scope for this finding.