feat: run integration tests via agentic workflow with copilot-requests:write

[Copilot]

Replaces the COPILOT_GITHUB_TOKEN-gated CI job with an agentic workflow that uses the built-in copilot-requests: write permission, eliminating the dependency on a repository secret.

Changes

• .github/workflows/rig-integration.md — new agentic workflow; triggers on push to main and workflow_dispatch; uses engine: copilot + copilot-requests: write; runs npm ci && npm run test:integration via bash
• .github/workflows/rig-integration.lock.yml — compiled output from gh aw compile
• scripts/haiku.integration.test.ts — tests now activate when COPILOT_SDK_URI is set (agentic engine context) in addition to COPILOT_GITHUB_TOKEN; skips --server flag when COPILOT_SDK_URI is present, using URI-based connection instead of stdio transport
• .github/workflows/ci.yml — removed integration-test job

Connection mode logic

// COPILOT_SDK_URI set (agentic engine) → URI connection, no --server
// COPILOT_GITHUB_TOKEN set (local/dev) → stdio transport via --server
const args = sdkUri ? [launcherPath, samplePath] : [launcherPath, samplePath, "--server"];

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[github-actions]

Skills-Based Review 🧠

Applied /codebase-design — approving with one minor suggestion.

📋 Key Themes & Highlights

Key Themes

• Implicit coupling: The args and env construction in runIntegrationSample both branch on sdkUri, but independently. When sdkUri is present, COPILOT_GITHUB_TOKEN is still forwarded into the child process env even though the stdio transport is not used. This is harmless today but silently couples two decisions.

Positive Highlights

• ✅ Clean, minimal change to the integration test — only the transport selection and condition are touched
• ✅ Removing the secret-gated job in favor of copilot-requests: write is the right architectural move
• ✅ The agentic workflow source (rig-integration.md) is well-scoped: minimal tools allowlist, explicit network allow-list, sensible timeout
• ✅ The PR description clearly explains the connection-mode logic, which is exactly the kind of context future readers need

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 39.8 AIC · ⌖ 7 AIC · ⊞ 6.3K
_{Comment /matt to run again}

[github-actions]

[/codebase-design] When both COPILOT_SDK_URI and COPILOT_GITHUB_TOKEN are set simultaneously, COPILOT_GITHUB_TOKEN is still spread into the child env even though --server (stdio transport) is skipped — the two decisions (args, env) are driven by the same condition but handled separately.

💡 Consider aligning env selection with transport selection

Making the credential exclusion explicit alongside the args decision removes the implicit coupling:

const useUriTransport = !!sdkUri;
const args = useUriTransport
  ? [launcherPath, samplePath]
  : [launcherPath, samplePath, "--server"];
const env = useUriTransport
  ? { ...process.env }
  : { ...process.env, COPILOT_GITHUB_TOKEN: token! };

This makes it obvious that when running via URI transport, COPILOT_GITHUB_TOKEN is intentionally omitted rather than being forwarded silently.