Task-led setup guide · official GitHub Docs checked Nov 3, 2026
Make GitHub Copilot cloud agent build with private dependencies
When a GitHub Copilot cloud-agent task cannot install a private package, choose the right environment, provide a narrowly scoped Agents credential, and verify setup before asking the agent to code.
Can GitHub Copilot cloud agent install private dependencies?
Yes, if the agent environment can reach the registry and has the required credential. GitHub provides Agents secrets and variables for private resources such as internal package registries. For a GitHub Actions environment, a `copilot-setup-steps.yml` file can install dependencies before work starts. Those setup steps do not apply to cloud-sandbox sessions, so first check which environment the session uses.
Where should I store a private registry token?
Use the repository or organization Agents secrets settings and scope organization secrets to only the repositories that need them. GitHub says Agents secrets and variables are exposed to the agent environment; in a cloud sandbox, secrets are available but variables are not. Actions, Codespaces, and Dependabot secrets are not passed to Copilot cloud agent. Use a read-only token for the required package scope when your registry supports it, and do not print it in setup logs.
How do I preinstall dependencies on GitHub Actions?
Add `.github/workflows/copilot-setup-steps.yml` on the repository default branch. The workflow needs one job named `copilot-setup-steps`; put the required steps and minimum permissions there. GitHub runs the file as a normal Actions workflow when changed, so check that run before relying on it for an agent session. The supported setup options are limited, and the file has no effect when the session uses a cloud sandbox.
What if the registry is only reachable inside my network?
Consider a GitHub Actions self-hosted runner only if your organization can manage the runner and its network boundary. GitHub recommends ephemeral, single-use runners and says administrators should configure network controls rather than give the runner open access. Copilot cloud agent’s integrated firewall is not compatible with self-hosted runners and must be disabled for that repository, so plan the replacement controls before switching.
Why did the agent start without the dependencies installed?
Check the session logs and the setup workflow run. GitHub documents that if a setup step exits non-zero, the remaining steps are skipped and Copilot starts with the environment as it stands. Confirm that the workflow is on the default branch, the job has the exact required name, the selected session environment supports the setup file, the package host is reachable, and the Agents credential is available to that session.
How can I test the setup before delegating a code change?
Make a small setup-only change, run the workflow, and verify that it can authenticate and install the exact private package without exposing the credential in logs. Then start a small agent task that runs the same install and a repository check. Review the session logs and diff yourself; successful setup does not establish that later generated code is correct.
Does this guide recommend a runner or guarantee private-package security?
No. It summarizes current GitHub configuration options and their documented limits, checked November 3, 2026. Runner choice depends on your network, plan, and organization controls. Review GitHub’s current documentation and your own credential and runner policies before enabling access.