GitHub Copilot CLI

These standalone exercises follow the build-your-own capability sequence using Copilot CLI. Start at setup. Each lab has its own non-secret provider.env.example; no lab reads from another lab folder.

Each lab’s preflight: install @github/copilot following the official CLI instructions; run copilot --version and copilot help providers. Create a private, temporary COPILOT_HOME (export COPILOT_HOME="$(mktemp -d)"; chmod 700 "$COPILOT_HOME"). Copy the lab’s provider.env.example to a private file outside this repository, edit non-secret endpoint and model names, and source it. Set workdir="$(mktemp -d)" for exercises that use $workdir; keep all exercise files there. For Azure OpenAI BYOK, set COPILOT_PROVIDER_API_KEY from a secret manager; an Entra bearer token is an experimental alternative only after validating your particular endpoint and CLI version. The GitHub BYOK guide documents API-key authentication, an Azure API version and explicit model selection. The example here targets a Responses-compatible deployment; validate protocol, streaming, tool calls and authentication before calling a live run Foundry-backed. Never put a credential in a file, command line, shell history or transcript. A Foundry management skill and az login do not select Foundry as the inference provider. Alternatively omit BYOK variables and authenticate with GitHub using copilot login; that tests Copilot-hosted models, not Foundry.

The CLI options below were inspected on @github/copilot 1.0.90. Verify copilot --help on your version. Use interactive mode for approval exercises; -p in noninteractive mode requires automatic tool approval and is unsuitable for the authorization drills. Do not use --allow-all, --allow-all-tools, --allow-all-paths or --yolo. Permissions and instruction files are different: instructions influence model behavior, while permission filters and external isolation enforce boundaries. Read-only prompts are not a sandbox or confidentiality boundary. Work only with synthetic data in disposable directories, inspect edits, never allow access to real secrets or live resources, and remove the temporary workspace and COPILOT_HOME after each lab. Live exercises require learner credentials and may incur charges; no comparable scorer or live Foundry test is provided here. Record missing metrics as unavailable.