⚡ Copilot Token Optimization2026-09-23 — Auth Doctor Updater

[github-actions]

Target Workflow: auth-doctor-updater

Source report: #8901
Estimated cost per run: $72.93 (highest of all workflows in the report, excluding "Smoke OTel Tracing" which already has an open optimization issue)
Total tokens per run: ~17.5K (single run measured: 17,465)
Cache hit rate: not populated in export (n/a)
LLM turns: not populated in export (n/a); 28 invocations recorded in working_set

Current Configuration

Setting	Value
Tools loaded	github (toolsets: [default], ~22 tool schemas), web-fetch, bash: true, cache-memory: true, edit
Tools actually used (this run)	GitHub: issue_read (69 calls), search_repositories (75 calls), pull_request_read (25), list_pull_requests (10), search_issues (6), list_issues (4), search_pull_requests (1), list_dependabot_alerts (1) — 8 of ~22 default-toolset tool types; safeoutputs: create_pull_request (1), noop used elsewhere in history
Network groups	github, platform.openai.com, learn.microsoft.com, docs.aws.amazon.com, cloud.google.com, docs.anthropic.com, platform.claude.com, ai.google.dev, docs.github.com (9 explicit allowed domains)
Pre-agent steps	Yes — one trivial step to compute the scan-since date
Post-agent steps	No
Prompt size	~10.3K chars total frontmatter+body; ~8.5K chars in the markdown body alone

Analysis

The run's MCP tool-call telemetry shows 191 GitHub API calls in a single run, dominated by search_repositories (75 calls) and issue_read (69 calls). The workflow prompt (Step 2) asks the agent to search the repository for a long list of 20+ keyword combinations (authentication, api-proxy, OIDC, WIF, OpenAI, Anthropic, Copilot, BYOK, Gemini, Vertex, Azure, Entra, AWS, Bedrock, GCP, workload identity, ACTIONS_ID_TOKEN, mcpg, github-oidc, authorization header, credential isolation, health, reflect), each expanded into "several combinations." This is the primary driver of the high per-run cost — the agent is burning turns on broad, repeated GitHub searches rather than a bounded research pass.

Additionally, Step 1 has the agent cat seven full documentation files and six full source files inline via bash, rather than these being scoped or pre-fetched, adding large amounts of file content directly into the transcript on every run.

Recommendations

1. Bound and consolidate the repository research step

Estimated savings: ~6–8K tokens/run (~35–45%)

Step 2 currently invites open-ended fan-out searching ("search several combinations of" 22 keywords). Replace with a single consolidated instruction that caps search calls and uses search_issues/search_pull_requests with combined OR-queries instead of one call per term:

## Step 2 — Research Recent Repository Lessons

Read the scan date, then run **at most 3** `search_issues` calls and **at most 2** `search_pull_requests` calls covering the terms below, combined with OR syntax in a single query where possible (e.g. `authentication OR api-proxy OR OIDC OR WIF OR BYOK updated:>=<scan-date>`). Do not call `search_repositories` — the repository is already known from context; use `pull_request_read`/`issue_read` directly on relevant numbers instead of re-searching.

This also removes the accidental use of search_repositories entirely (75 calls in this run, essentially wasted since the target repository is already fixed and known from ${{ github.repository }}).

2. Restrict the GitHub toolset instead of [default]

Estimated savings: ~8–10K tokens/run (~50% of loaded tool-schema overhead)

Only issues, pull_requests, and search toolset tools were exercised (issue_read, pull_request_read, list_issues, list_pull_requests, search_issues, search_pull_requests) plus one dependabot call (list_dependabot_alerts). Replace:

tools:
  github:
    toolsets: [default]

with:

tools:
  github:
    toolsets: [issues, pull_requests, search, dependabot]

toolsets: [default] loads ~22 tool schemas per turn; restricting to the 4 toolsets actually used should remove most of the unused schema overhead (each tool schema costs roughly 500–700 tokens per turn it's kept in context).

3. Move static documentation/source reads to a pre-agent step

Estimated savings: ~2–3K tokens/run (~15%)

Step 1 has the agent cat 7 docs files + 6 source files as its very first bash actions every run — this is fully deterministic and doesn't need an LLM turn. Move it into the existing steps: pre-agent block so the content is captured once as a file the agent can cat from cache, without spending a full agentic turn issuing the bash calls itself:

steps:
  - name: Compute scan window
    run: |
      SINCE=$(date -u -d '2 days ago' +%Y-%m-%d)
      mkdir -p /tmp/gh-aw/agent /tmp/gh-aw/cache-memory /tmp/gh-aw/sandbox/agent/logs
      echo "$SINCE" > /tmp/gh-aw/agent/scan-since.txt
  - name: Snapshot docs and source for review
    run: |
      mkdir -p /tmp/gh-aw/agent/snapshot
      for f in README.md docs/auth-matrix.md docs/authentication-architecture.md \
               docs/api-proxy-sidecar.md docs/environment.md docs/awf-config-spec.md \
               docs/github_actions.md src/services/api-proxy-env-config.ts \
               src/services/api-proxy-credential-env.ts \
               src/services/agent-environment/excluded-vars.ts \
               src/services/agent-environment/env-passthrough.ts \
               containers/api-proxy/management.js containers/api-proxy/startup.js \
               containers/agent/api-proxy-health-check.sh; do
        echo "=== $f ===" >> /tmp/gh-aw/agent/snapshot/combined.txt
        cat "$f" >> /tmp/gh-aw/agent/snapshot/combined.txt
      done

Then update Step 1 of the prompt to cat /tmp/gh-aw/agent/snapshot/combined.txt instead of the 13 individual cat invocations, saving the per-call tool-invocation overhead (though the file content tokens themselves remain — the savings here are in turn/call overhead, not content size).

4. Cap web-fetch provider-doc checks per run

Estimated savings: ~1–2K tokens/run (~10%)

Step 3 lists 7 provider documentation URLs to check each run. Add an explicit cap ("fetch at most 3 of the following pages most likely to have changed, prioritizing pages not fetched successfully in the prior 7 days via cache-memory") so the agent doesn't attempt all 7 when nothing has changed — cache-memory: true is already enabled but the prompt doesn't tell the agent to check it before re-fetching.

Expected Impact

Metric	Current	Projected	Savings
Total tokens/run	~17.5K	~9–11K	~35–45%
Cost/run	$72.93	~$35–45	~40–50%
GitHub API calls/run	191	~30–40	~80%
Session time	5.9m	~3–4m (est.)	~30–40%

Implementation Checklist

• Restrict tools.github.toolsets to [issues, pull_requests, search, dependabot] in auth-doctor-updater.md
• Rewrite Step 2 to cap search calls and forbid search_repositories
• Move the docs/source cat snapshot into a pre-agent steps: block
• Add a cache-memory check + fetch cap to Step 3's provider-doc research
• Recompile: gh aw compile .github/workflows/auth-doctor-updater.md
• Post-process: npx tsx scripts/ci/postprocess-smoke-workflows.ts
• Verify CI passes on PR
• Compare token usage on new run vs baseline ($72.93 / 17,465 tokens)

Generated by Daily Copilot Token Optimization Advisor · copilot · auto · 64.7 AIC · ⊞ 10.6K · ◷