Migrate GH-AW reviewer to PAT pool

[vitek-karas]

Summary

• migrate the Android Tools GH-AW reviewer workflow to the Copilot PAT pool model
• add the shared PAT pool import and README under .github/workflows/shared/
• add validate-pat-pool.yml so the PAT pool can be checked independently
• recompile the generated lock workflow and update .github/aw/actions-lock.json

Validation

• gh aw compile .github/workflows/android-tools-reviewer.md --schedule-seed dotnet/android-tools --approve
• dotnet build Xamarin.Android.Tools.sln
• dotnet test tests\Microsoft.Android.Build.BaseTasks-Tests\Microsoft.Android.Build.BaseTasks-Tests.csproj
• dotnet test tests\Xamarin.Android.Tools.AndroidSdk-Tests\Xamarin.Android.Tools.AndroidSdk-Tests.csproj still has the pre-existing JdkDirectory_JavaHome("JI_JAVA_HOME") failure in both the feature worktree and the clean main checkout because JAVA_HOME is set in the local environment

Security review note

I reviewed the newly introduced secret references, action revisions, and generated workflow manifest changes from the PAT pool migration.

Secrets

Added restricted secrets:

• COPILOT_PAT_0
• COPILOT_PAT_1
• COPILOT_PAT_2
• COPILOT_PAT_3
• COPILOT_PAT_4
• COPILOT_PAT_5
• COPILOT_PAT_6
• COPILOT_PAT_7
• COPILOT_PAT_8
• COPILOT_PAT_9

These are only used to select a PAT slot number inside the isolated pat_pool job and then resolve the selected slot through a case(...) expression in engine.env, matching the documented pattern in dotnet/vitals PAT pool guidance and the example in dotnet/xharness#1626.

Actions and generated runtime updates

• github/gh-aw-actions/setup updated from v0.79.8 to v0.80.9 (8c7d04ebf1ece56cd381446125da3e0f6896294a)
• generated workflow containers updated to the compiler-selected set from gh aw v0.80.9:
  • ghcr.io/github/gh-aw-firewall/agent:0.27.7
  • ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7
  • ghcr.io/github/gh-aw-firewall/squid:0.27.7
  • ghcr.io/github/gh-aw-mcpg:v0.3.27
  • ghcr.io/github/gh-aw-node
  • ghcr.io/github/github-mcp-server:v1.4.0

I reviewed these as safe because they are generated by the official gh aw compiler during recompilation of the existing workflow, align with the PAT pool migration shape used in dotnet/runtime#129840, and do not introduce any custom third-party action beyond the standard GitHub / gh-aw generated set already used by this workflow.

Redirect changes

No redirect changes were introduced.

[jonathanpeppers]

I setup a the environment as mentioned in the README to try this out.

[Copilot]

Pull request overview

Migrates the Android Tools Agentic Workflows (GH-AW) PR reviewer workflow to the Copilot PAT pool model, adds the shared PAT pool import/docs, and introduces a scheduled workflow to validate the pool independently.

Changes:

• Added a reusable shared/pat_pool.md import plus documentation (shared/pat_pool.README.md) for selecting a random PAT slot and wiring it into COPILOT_GITHUB_TOKEN.
• Updated android-tools-reviewer.md and regenerated android-tools-reviewer.lock.yml to run agentic jobs in the copilot-pat-pool environment and source tokens from COPILOT_PAT_0..9.
• Added validate-pat-pool.yml to periodically verify the PAT pool and fail with a summary if invalid/unknown/empty.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/validate-pat-pool.yml	New workflow to validate each PAT slot and emit a step-summary plus failure signal.
.github/workflows/shared/pat_pool.README.md	Documentation for onboarding repos and securely using the PAT pool import pattern.
.github/workflows/shared/pat_pool.md	New GH-AW import defining the pat_pool job that selects an available PAT slot number.
.github/workflows/android-tools-reviewer.md	Updated reviewer workflow frontmatter to import the PAT pool and override COPILOT_GITHUB_TOKEN.
.github/workflows/android-tools-reviewer.lock.yml	Recompiled generated workflow to include pat_pool job + updated gh-aw runtime revisions.
.github/aw/actions-lock.json	Updated action lock entries used by gh-aw tooling/workflows.

[jonathanpeppers]

I will address this in another PR.

[jonathanpeppers]

PAT pool is working:

• Address #394 review: drop dead gh-aw step and stale maintenance workflow #395 (review)

[vitek-karas]

Yes: