Use Copilot CLI releases for Node runtime by devm33 · Pull Request #2463 · github/copilot-sdk

devm33 · 2026-09-01T17:44:58Z

Summary

remove the Node.js SDK dependency on @github/copilot
pin the github/copilot-cli release version in nodejs/package.json
build eight platform packages named @github/copilot-sdk-<platform> during publication
download SHA256SUMS.txt from the pinned CLI release and verify every downloaded release asset against it
keep the main @github/copilot-sdk package small by using exact optional dependencies so npm installs only the host platform runtime
resolve the installed platform package locally with no GitHub download during application startup
preserve internal-only canaries through an explicit @github/copilot-<platform> fallback without public release lookups
update cross-SDK test and packaging compatibility for the shared version pin; Java and Rust continue using release assets, while Go and .NET retain their existing npm-based packaging
preserve explicit cliPath, COPILOT_CLI_PATH, and packaging-time release mirror overrides

Package shape

main @github/copilot-sdk tarball: approximately 440 KB compressed
platform runtime tarballs: approximately 38–46 MB compressed each
publication produces the main package plus eight platform packages; a consumer installs only the matching optional package

Testing

Node.js format, lint, typecheck, build, and runtime artifact tests
full Node.js suite: 905 passed, 11 skipped; one replay timing test passed on isolated rerun
built and inspected all nine npm tarballs
rebuilt a platform package from an empty cache using the release SHA256SUMS.txt
installed the main and Darwin ARM64 tarballs together and resolved the runtime with network access disabled
Python Ruff checks and E2E harness CLI-path tests
Go E2E harness compilation and bundler tests
.NET SDK test-project build
Java native packaging script tests: 48 passed
Rust nightly format check, Clippy with all features/targets, and all-feature test suite
Rust publish snapshots and contributor builds verified against release SHA256SUMS.txt
prepared and executed the pinned 1.0.83-1 release runtime

The targeted Java SDK test requires JDK 25; this local environment only has JDK 17, so Java SDK execution coverage is left to CI.

Copilot

Copilot review overview

🟡 Changes recommended

Internal canary resolution, Windows verification, and checksum trust-boundary issues must be addressed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 4

New issues introduced by this change (4)

Severity	Finding
	`.github/workflows/sdk-canary.yml` — The `internal` source path no longer consumes the authenticated Azure feed. `set-cli-version.js`…
	`.github/workflows/sdk-canary.yml` — On the Windows matrix runner, `prepare:runtime` prints a native path such as…
	`java/copilot-native/scripts/fetch-native.mjs` — The Java native build now downloads both the archive and its expected checksum from the same live…
	`rust/build/in_process.rs` — The in-process contributor build fetches its expected hash live instead of consuming the checked-in…

What changed in this PR

Replaces the Node SDK’s npm-packaged CLI runtime with pinned, checksum-verified GitHub Release artifacts and propagates the shared version pin across SDK tooling.

Changes:

Adds on-demand runtime download, verification, caching, and mirror support.
Migrates code generation and cross-language consumers to copilotCliVersion.
Updates tests, packaging scripts, and CI workflows for release artifacts.

File	Description
`test/harness/package.json`	Removes CLI npm dependency.
`test/harness/package-lock.json`	Updates harness lockfile.
`scripts/codegen/utils.ts`	Sources schemas from release runtime.
`rust/tests/cli_resolution_test.rs`	Updates version-source documentation.
`rust/scripts/snapshot-bundled-in-process-version.sh`	Snapshots release tarball hashes.
`rust/scripts/snapshot-bundled-cli-version.sh`	Reads the shared version pin.
`rust/README.md`	Documents the new pin source.
`rust/Cargo.toml`	Removes obsolete Base64 dependency.
`rust/build/out_of_process.rs`	Resolves release version from package metadata.
`rust/build/in_process.rs`	Downloads and verifies release runtime archives.
`python/scripts/inject-cli-version.mjs`	Injects the shared version pin.
`python/e2e/conftest.py`	Uses package metadata for E2E versioning.
`nodejs/test/runtimeArtifacts.test.ts`	Tests release selection and verification.
`nodejs/test/e2e/ui_elicitation.e2e.test.ts`	Awaits legacy runtime preparation.
`nodejs/test/e2e/harness/sdkTestContext.ts`	Resolves legacy CLI from release cache.
`nodejs/test/e2e/factory.e2e.test.ts`	Awaits legacy runtime preparation.
`nodejs/test/e2e/extension_env_access.e2e.test.ts`	Migrates legacy CLI test setup.
`nodejs/src/runtimeArtifacts.ts`	Implements runtime download, verification, and caching.
`nodejs/src/cliVersion.ts`	Stores the pinned version and hashes.
`nodejs/src/client.ts`	Lazily prepares the default runtime.
`nodejs/scripts/set-cli-version.js`	Updates release pins and hashes.
`nodejs/scripts/prepare-runtime.ts`	Exposes runtime preparation commands.
`nodejs/samples/package-lock.json`	Updates sample transitive dependencies.
`nodejs/README.md`	Documents runtime downloads and overrides.
`nodejs/package.json`	Adds release metadata and runtime tooling.
`nodejs/package-lock.json`	Replaces CLI packages with tar support.
`java/sdk/src/test/java/com/github/copilot/TestUtil.java`	Prepares the pinned test runtime.
`java/sdk/src/test/java/com/github/copilot/E2ETestContext.java`	Uses release runtime fallback.
`java/sdk/pom.xml`	Removes the fixed npm CLI path.
`java/docs/adr/adr-007-native-bundling-strategy.md`	Documents release-based native bundling.
`java/copilot-native/scripts/validate-native-artifact.test.mjs`	Updates shared-version fixtures.
`java/copilot-native/scripts/validate-native-artifact.mjs`	Reads the shared version pin.
`java/copilot-native/scripts/fetch-native.test.mjs`	Tests release archive staging.
`java/copilot-native/scripts/fetch-native.mjs`	Downloads Java native release assets.
`java/copilot-native/pom.xml`	Documents release-native packaging.
`go/cmd/bundler/main.go`	Reads CLI version from package metadata.
`dotnet/src/GitHub.Copilot.SDK.csproj`	Reads CLI version from package metadata.
`.github/workflows/update-copilot-dependency.yml`	Updates release pins through automation.
`.github/workflows/sdk-canary.yml`	Migrates canary testing and publishing.
`.github/workflows/rust-sdk-tests.yml`	Reads the shared Rust test version.
`.github/workflows/publish.yml`	Removes unnecessary Node installation.
`.github/workflows/java-sdk-tests.yml`	Prepares release runtimes in Java CI.
`.github/copilot-instructions.md`	Updates repository development guidance.
`.github/actions/setup-copilot/action.yml`	Prepares the pinned runtime in CI.

Files not reviewed (3)

nodejs/package-lock.json: Generated file
nodejs/samples/package-lock.json: Generated file
test/harness/package-lock.json: Generated file

Suppressed comments (1)

.github/workflows/sdk-canary.yml:309

This also makes publish-force unusable for an internal-only runtime canary: even when the failed E2E gate is intentionally bypassed, set-cli-version.js attempts to read a GitHub Release that does not exist instead of the internal feed and aborts before publishing. The publish job needs the same internal artifact-resolution path as the test job.

          node scripts/set-cli-version.js "$RUNTIME_VERSION"

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

roji · 2026-09-01T18:26:20Z

One unrelated/unexpected good thing here is that it removes the caret/floating dependency on the npm package; this floating dependency means that changing the npm package could break old SDK packages (I'm not sure, but the planned removal of the CLI SEA binary from the npm package could constitute such a change). Unfortunately the old SDK packages are still out there in any case, I think we'd need to bump major version to get rid of this problem (floating dependencies are just always evil).

Copilot

Copilot review overview

🟡 Changes recommended

Windows packaging is broken, and Go and .NET still acquire unchecked npm artifacts rather than the stated release assets.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 2

New issues introduced by this change (3)

Severity	Finding
	`nodejs/scripts/package-sdk.ts` — `execFileSync` cannot launch the `npm.cmd` shim directly on Windows, so `pack:release` fails before…
	`dotnet/src/GitHub.Copilot.SDK.csproj` — Reading the shared release pin here does not migrate .NET runtime acquisition:…
	`go/cmd/bundler/main.go` — This switches Go to the shared release version pin, but the bundler still downloads…

Issues resolved since last review (4)

Severity	Finding
	`rust/build/in_process.rs` — The in-process contributor build fetches its expected hash live instead of consuming the checked-in… View resolved comment
	`java/copilot-native/scripts/fetch-native.mjs` — The Java native build now downloads both the archive and its expected checksum from the same live… View resolved comment
	`.github/workflows/sdk-canary.yml` — On the Windows matrix runner, `prepare:runtime` prints a native path such as… View resolved comment
	`.github/workflows/sdk-canary.yml` — The `internal` source path no longer consumes the authenticated Azure feed. `set-cli-version.js`… View resolved comment

Files not reviewed (3)

nodejs/package-lock.json: Generated file
nodejs/samples/package-lock.json: Generated file
test/harness/package-lock.json: Generated file

Suppressed comments (1)

nodejs/scripts/package-sdk.ts:61

The main-package pack has the same Windows failure: execFileSync cannot execute the npm.cmd shim without a shell. Use the platform-specific executable here too.

Copilot

Copilot review overview

🟡 Changes recommended

The Rust build currently consumes local_expected_hash and then reuses it, causing compiler error E0382.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 2

New issues introduced by this change (3)

Severity	Finding
	`rust/build/in_process.rs` — `unwrap_or_else` consumes this `Option<String>`, but `local_expected_hash` is borrowed again when…
	`.github/workflows/sdk-canary.yml` — For `RUNTIME_SOURCE=public`, this workflow no longer consumes `@&ZeroWidthSpace;github/copilot`; it packages the…
	`nodejs/src/cliVersion.ts` — The code pins `1.0.83-1`, while the PR's Testing section says the prepared and executed pinned…

Issues resolved since last review (3)

Severity	Finding
	`go/cmd/bundler/main.go` — This switches Go to the shared release version pin, but the bundler still downloads… View resolved comment
	`dotnet/src/GitHub.Copilot.SDK.csproj` — Reading the shared release pin here does not migrate .NET runtime acquisition:… View resolved comment
	`nodejs/scripts/package-sdk.ts` — `execFileSync` cannot launch the `npm.cmd` shim directly on Windows, so `pack:release` fails before… View resolved comment

Files not reviewed (3)

nodejs/package-lock.json: Generated file
nodejs/samples/package-lock.json: Generated file
test/harness/package-lock.json: Generated file

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3043824d-becf-4b5d-b62b-4754511894f7

Stream Java release archives directly into tar and document generated canary condition branches for CodeQL. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3043824d-becf-4b5d-b62b-4754511894f7

Preserve the npm runtime layout, use the legacy CLI for standalone extension tests, align the Python account test with current auth behavior, and remove a Go shutdown race. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3043824d-becf-4b5d-b62b-4754511894f7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3043824d-becf-4b5d-b62b-4754511894f7

Copilot AI balanced review requested due to automatic review settings September 1, 2026 17:44

devm33 requested a review from a team as a code owner September 1, 2026 17:44

Copilot started reviewing on behalf of devm33 September 1, 2026 17:45 View session