TO-DROP: run Copilot CLI as a --yolo debugger on linux32 failure

Wire the in-container Copilot CLI debugger to the trimmed
`linux32` job per the `ci-failure-copilot` skill. On a failure of
the `ci/run-build-and-tests.sh` step, install Node.js and the
Copilot CLI, hand off to a `--yolo` session pointed at
`.github/copilot-prompts/debug-linux32.md` (added in the previous
commit), and upload the resulting `ci-diagnosis/` directory plus
the captured `~/.copilot` session state as a `copilot-debug`
artifact.

Two preconditions for the prompt's branch-thicket-aware
diagnosis flow:

  * The checkout step now uses `fetch-depth: 0` so the agent can
    `git log` between the old and new rebase baselines and run
    `git range-diff` against `microsoft/vfs-2.54.0`.

  * A new step adds the `microsoft` remote and pre-fetches
    `vfs-2.54.0` plus the `v2.54.0` tag so the agent does not pay
    the discovery latency in-session.

The Copilot run executes as root (the container's default user),
matching where `npm install -g` puts the binary; the prompt
itself instructs the agent to re-invoke the failing command via
`sudo --preserve-env --set-home --user=builder
ci/run-build-and-tests.sh` so its end-to-end verification
reproduces the workflow's exact conditions.

The job requires a `COPILOT_GITHUB_TOKEN` repository secret on
`dscho/git` with Copilot access for this repository; if it is not
set, the `Run Copilot CLI` step will fail authentication but the
preceding archive/upload steps still preserve whatever state was
captured.

This commit is to be dropped before the branch is merged anywhere.

Assisted-by: Claude Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

.github/workflows/main.yml

@@ -145,10 +145,80 @@ jobs:
           apt-get -q update && apt-get -q -y install git
         fi
     - uses: actions/checkout@v6
+      with:
+        # Full history so the Copilot debugger can `git log` between
+        # the rebase baselines (microsoft/vfs-2.54.0's upstream base
+        # vs this branch's upstream base) and run `git range-diff`.
+        fetch-depth: 0
     - run: ci/install-dependencies.sh
     - run: useradd builder --create-home
     - run: chown -R builder .
+    - name: Fetch baseline refs for Copilot debugger
+      # Runs as `builder` (matching the post-chown repo ownership) so
+      # we do not have to fight git's dubious-ownership check. Focal's
+      # git is too old to honour `safe.directory='*'`, so matching the
+      # owner is cleaner. Fetch all tags from microsoft/git, git/git,
+      # and git-for-windows/git, and unshallow the current branch, so
+      # the agent has every baseline ref it might want to range-diff
+      # or `git log` against without paying that discovery latency
+      # in-session. `+refs/tags/*:refs/tags/*` forces tag updates so
+      # name collisions between remotes are resolved last-fetch-wins
+      # rather than aborting the fetch.
+      run: |
+        sudo --preserve-env --set-home --user=builder bash -c '
+          set -e
+          if test -f .git/shallow; then
+            git fetch --unshallow origin
+          fi
+          git remote add microsoft       https://github.com/microsoft/git.git
+          git remote add upstream        https://github.com/git/git.git
+          git remote add git-for-windows https://github.com/git-for-windows/git.git
+          git fetch microsoft       "+refs/tags/*:refs/tags/*"
+          git fetch upstream        "+refs/tags/*:refs/tags/*"
+          git fetch git-for-windows "+refs/tags/*:refs/tags/*"
+        '
     - run: chmod a+w $GITHUB_ENV && sudo --preserve-env --set-home --user=builder ci/run-build-and-tests.sh
+    - name: Install Node.js (for Copilot CLI)
+      if: failure()
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+    - name: Set up Copilot CLI
+      if: failure()
+      run: |
+        npm install -g @github/copilot
+        mkdir -p ci-diagnosis
+        chown -R builder ci-diagnosis
+    - name: Run Copilot CLI to debug failure
+      if: failure()
+      timeout-minutes: 75
+      env:
+        GH_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+      # Use the `@file` syntax for the prompt rather than inlining the
+      # whole prose on the command line; the prompt expands to several
+      # KB and some shells truncate long argv. Run as root (the
+      # container's default user) so the install path stays simple;
+      # the prompt itself instructs the agent to re-invoke the failing
+      # command via `sudo --preserve-env --set-home --user=builder
+      # ci/run-build-and-tests.sh` so the verification reproduces the
+      # workflow's exact conditions.
+      run: |
+        copilot -p "Follow the instructions in @.github/copilot-prompts/debug-linux32.md exactly." \
+          --yolo </dev/null
+    - name: Archive Copilot session state
+      if: always()
+      run: |
+        if test -d "$HOME/.copilot"; then
+          tar czf copilot-session.tar.gz -C "$HOME" .copilot
+        fi
+    - name: Upload Copilot artifacts
+      if: always() && (hashFiles('copilot-session.tar.gz') != '' || hashFiles('ci-diagnosis/**') != '')
+      uses: actions/upload-artifact@v7
+      with:
+        name: copilot-debug
+        path: |
+          copilot-session.tar.gz
+          ci-diagnosis/
     - name: print test failures
       if: failure() && env.FAILED_TEST_ARTIFACTS != ''
       run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh