
The secret is gone. The Copilot Actions run still needs a card.
GitHub just let Copilot CLI run in Actions without a personal access token. That closes one risk and opens a quieter one: a workflow that spends organization AI credits with no owner, no cap, and no reviewer.

















