Fix authenticated Course Updater checks

.github/workflows/course-updater.md

@@ -4,12 +4,40 @@ description: "Weekly check (Mondays) for new GitHub Copilot app features and upd
 on:
   schedule: weekly on monday
   workflow_dispatch:
+engine:
+  id: copilot
+  args: ["--allow-url=https://github.com"]
+permissions:
+  contents: read
+  pull-requests: read
 tools:
   bash: ["curl", "gh"]
   edit:
   web-fetch:
   github:
-    toolsets: [repos]
+    toolsets: [repos, pull_requests]
+post-steps:
+  - name: Require a complete course update check
+    if: always()
+    env:
+      GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+    run: |
+      node <<'NODE'
+      const { readFileSync } = require('node:fs');
+      const outputPath = process.env.GH_AW_SAFE_OUTPUTS;
+      if (!outputPath) {
+        throw new Error('The course update output path is missing.');
+      }
+      const outputs = readFileSync(outputPath, 'utf8')
+        .split(/\r?\n/)
+        .filter(line => line.trim())
+        .map(line => JSON.parse(line));
+      const completeTypes = new Set(['create_pull_request', 'noop']);
+      if (!outputs.length || outputs.some(output => !completeTypes.has(output.type))) {
+        const types = outputs.map(output => output.type).join(', ') || 'no output';
+        throw new Error(`Course update check is incomplete (${types}). See the agent logs.`);
+      }
+      NODE
 safe-outputs:
   allowed-domains:
     - github.com
@@ -25,11 +53,15 @@ You are a documentation maintainer for the Copilot App for Beginners repository.
 
 ## Step 1 — Gather recent Copilot app updates
 
-Use `web-fetch` to read the following pages and extract the latest entries from the past 7 days:
+Use `web-fetch` to read the following page and extract the latest entries from the past 7 days:
 
 - https://github.com/github/app/blob/main/changelog.md — GitHub Copilot app changelog
 
-Also use `gh` CLI to check the latest releases and commits in the `github/app` repo.
+Use the authenticated GitHub MCP tools `list_releases` and `list_commits` to check the latest releases and commits in `github/app`. Only include updates from the past 7 days.
+
+If `web-fetch` or a shell `gh` command is denied or cannot authenticate, continue with the GitHub MCP tools. Release notes and commits are valid alternative sources when `web-fetch` cannot read the changelog. Use `get_file_contents` if you need to read the changelog through MCP.
+
+If the authenticated MCP reads also fail, report the error with `missing_data` or `missing_tool` and stop. Do not assume that the repository is private or report that no updates are needed without source data. An incomplete check must fail the workflow.
 
 Look for:
 
@@ -39,7 +71,9 @@ Look for:
 
 ## Step 2 — Check for existing open PRs to avoid duplicates
 
-Before doing any content comparison, list all open pull requests in this repo that have the `automated-update` or `copilot-app-updates` labels. Read their titles and descriptions to understand which features or changes each PR already covers. Build a list of features that are **already addressed** by existing PRs — you must exclude those features from any updates you propose later. If every feature you found in Step 1 is already covered by an open PR, stop here and report that no new updates are needed.
+Before doing any content comparison, use the authenticated GitHub MCP `list_pull_requests` tool to list open pull requests in this repo. Select the PRs with either the `automated-update` or `copilot-app-updates` label. Read their titles and descriptions to understand which features or changes each PR already covers. Build a list of features that are **already addressed** by existing PRs — you must exclude those features from any updates you propose later. If every feature you found in Step 1 is already covered by an open PR, stop here and call `noop` to report that no new updates are needed.
+
+If the PR lookup fails, report `missing_data` or `missing_tool` and stop. Do not treat a failed lookup as an empty PR list.
 
 ## Step 3 — Compare against the current course content
 
@@ -51,7 +85,7 @@ Identify:
 - **Missing features** — new capabilities not yet documented
 - **Outdated information** — features that have been renamed, moved, or significantly changed (including UI labels, menu names, or button text shown in screenshots)
 
-If there is nothing new or everything is already up to date, stop here and report that no updates are needed.
+If there is nothing new or everything is already up to date, stop here and call `noop` to report that no updates are needed.
 
 ## Step 4 — Update the course content
 
@@ -68,3 +102,5 @@ Create a pull request with your changes, using the `main` branch as the base bra
 3. Links to the source announcements
 
 The PR should target the `main` branch and include the labels `automated-update` and `copilot-app-updates`.
+
+Match each feature to the version in its changelog heading and release record. Do not assign a feature to a different release.