From a3a4be3161fd3f9610dbb5a7f149cc350cce09f4 Mon Sep 17 00:00:00 2001 From: Pimcore Deployments Date: Mon, 20 Jul 2026 10:03:52 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=84=20synced=20file(s)=20with=20pimcor?= =?UTF-8?q?e/workflows-collection-public?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/copilot-setup-steps.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index e06ecbc..5c00e07 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -31,13 +31,18 @@ jobs: with: php-version: "8.4" - - name: "Add authentication for private pimcore packages" + - name: "Configure private pimcore package repository" run: | composer config repositories.private-packagist '{"type": "composer", "url": "https://repo.pimcore.com/github-actions/", "canonical": true}' - composer config --global --auth http-basic.repo.pimcore.com github-actions ${{ secrets.COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN }} - name: "Install dependencies with Composer" uses: "ramsey/composer-install@v3" + # Pass the private-Packagist token via a step-scoped env var instead of + # writing it to Composer's global auth.json. A global credential would + # persist on the runner filesystem and remain readable by the Copilot + # coding agent after setup; COMPOSER_AUTH lives only for this step. + env: + COMPOSER_AUTH: '{"http-basic":{"repo.pimcore.com":{"username":"github-actions","password":"${{ secrets.COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN }}"}}}' with: composer-options: "--no-scripts --ignore-platform-reqs"