fix(07d): reduce cognitive load by extracting billing paths to side quest (#2667)

Author: github-actions[bot]

workshop/07d-confirm-model-access.md

@@ -6,157 +6,54 @@
 
 This step has two entry points:
 
-- **Arriving from the step 07 access check (error recovery):** You have completed [Install the gh-aw CLI Extension](06-install-gh-aw.md) and pushed `.github/skills/agentic-workflows/`. Workflow files do not need to exist yet — fix model access first, then return to [Write Your First Agentic Workflow](07-your-first-workflow.md) to continue.
+- **Arriving from step 07 (error recovery):** Workflow files do not need to exist yet — fix model access first, then return to [Write Your First Agentic Workflow](07-your-first-workflow.md).
 - **Arriving as the next step after step 07 (normal flow):** `daily-report-status.md` and `daily-report-status.lock.yml` are committed to your practice repository.
 
 ## :dart: What You'll Do
 
-You'll verify Copilot model access with a quick test that uses the `agentic-workflows` skill, then choose the [billing](https://github.github.com/gh-aw/reference/billing/) and [authentication](https://github.github.com/gh-aw/reference/auth/) method for the first workflow, configure it, and confirm the source and lock files agree before you continue to [Step 8](08-run-your-workflow.md).
+You'll run a one-sentence test prompt, confirm Copilot is reachable, choose your [billing](https://github.github.com/gh-aw/reference/billing/) path, and configure the workflow before continuing to [Step 8](08-run-your-workflow.md).
 
-## Verify model access with a test prompt
+## Verify model access
 
-Before configuring billing, confirm Copilot is reachable from this repository.
-Catching an access problem here saves debugging time in the billing steps and in Step 8.
-
-1. In the terminal that is already open in your Codespace, run:
+1. In the terminal already open in your Codespace, run:
 
 ```bash
 gh copilot
 ```
 
-1. Send the following prompt in Copilot CLI:
+1. Send this prompt:
 
 ```prompt
 /agentic-workflows what trigger does a scheduled workflow use?
 ```
 
-1. Confirm you receive a reply. Any response means the model and skill are accessible.
-2. If you see an error, check [github.com/settings/copilot](https://github.com/settings/copilot) to confirm Copilot is enabled on your account, then return here.
+1. Any reply confirms the model and skill are accessible. Continue to **Choose a billing path**.
 
 > [!IMPORTANT]
-> Do not continue if you received an error instead of a response. Fix the access issue now — model-access errors will cause Step 8 to fail and are much harder to diagnose mid-run. Check [github.com/settings/copilot](https://github.com/settings/copilot) first, then see [Side Quest: Configure GitHub Copilot for Agentic Workflows](side-quest-06-03-copilot-token.md) if the problem persists.
-
-## Pre-flight troubleshooting decision tree
-
-Use this quick check before you choose a billing path:
+> If you see an error instead of a reply, check [github.com/settings/copilot](https://github.com/settings/copilot) to confirm Copilot is enabled. If the problem persists, see [Side Quest: Configure GitHub Copilot for Agentic Workflows](side-quest-06-03-copilot-token.md), then return here.
 
-- **You receive a normal reply in Copilot CLI**
-  - If you arrived here from the step 07 access check (before creating workflow files), return to [Write Your First Agentic Workflow](07-your-first-workflow.md) and continue from where you left off.
-  - Otherwise, continue to **Choose one Copilot billing path**.
-- **You receive an access or entitlement error**
-  - Confirm Copilot is enabled for your account at [github.com/settings/copilot](https://github.com/settings/copilot).
-  - If your repository is in an organization, ask your org admin to confirm your Copilot seat and policy access.
-  - Retry the same one-sentence prompt in Copilot CLI.
-- **You still cannot get a reply after account checks**
-  - Pause here and complete [Side Quest: Configure GitHub Copilot for Agentic Workflows](side-quest-06-03-copilot-token.md), then return to this step.
+If you arrived from the step 07 access check and the test prompt succeeded, return to [Write Your First Agentic Workflow](07-your-first-workflow.md) now.
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="images/07d-preflight-troubleshoot-dark.svg">
   <source media="(prefers-color-scheme: light)" srcset="images/07d-preflight-troubleshoot-light.svg">
   <img alt="Pre-flight troubleshooting decision tree: send a test prompt, then follow YES or NO branches to either continue the workshop or fix model access" src="images/07d-preflight-troubleshoot-light.svg">
 </picture>
 
-## Confirm the workflow engine
-
-Open `.github/workflows/daily-report-status.md`. The Step 7 workflow has no `engine:` line, so it uses GitHub Copilot.
-
-Claude and Codex are optional [engines](https://github.github.com/gh-aw/reference/engines/) introduced in later side quests. You do not need an Anthropic or OpenAI API key for this first run.
-
-If you are working in Claude Code or OpenAI Codex, keep this first workflow on Copilot and switch later if you want:
-
-- **Claude Code:** use [Side Quest: Configure an Anthropic API Key](side-quest-11-06-anthropic-key.md).
-- **OpenAI Codex:** use [Side Quest: Configure an OpenAI API Key](side-quest-11-07-openai-key.md).
-
-## Choose one Copilot billing path
-
-Choose exactly one method. The diagram below shows both paths and the key configuration difference between them.
-
-<details>
-<summary><b>Plain-language billing summary</b></summary>
-
-- **Choose organization centralized billing** when the repository's organization already pays for Copilot in GitHub Actions. Keep `copilot-requests: write`. Do not add a `COPILOT_GITHUB_TOKEN` secret.
-- **Choose personal billing** when this is your personal repository, or when the organization does not pay for Copilot in GitHub Actions. Remove `copilot-requests: write`, then add a `COPILOT_GITHUB_TOKEN` secret in the repository's **Settings** → **Secrets and variables** → **Actions** page.
-- **If you are not sure which path applies, ask one question:** "Is centralized Copilot billing for GitHub Actions enabled for this repository?" If the answer is "no" or "I don't know," follow the personal billing path until an admin confirms otherwise.
-
-</details>
-
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="images/07d-billing-path-decision-dark.svg">
-  <source media="(prefers-color-scheme: light)" srcset="images/07d-billing-path-decision-light.svg">
-  <img alt="Decision flow for choosing Copilot billing path: organization centralized billing or personal billing" src="images/07d-billing-path-decision-light.svg">
-</picture>
-
-### Billing quick-reference
-
-Use this table first, then follow the detailed steps for your selected path below.
-
-| If this is true | Choose this path | Key setting |
-|---|---|---|
-| Your organization provides centralized Copilot billing for Actions | **Organization with centralized Copilot billing** | Keep `copilot-requests: write`; no `COPILOT_GITHUB_TOKEN` secret |
-| You are in a personal repo, or your org does not provide centralized billing | **Personal billing** | Remove `copilot-requests: write`; configure `COPILOT_GITHUB_TOKEN` |
-
-### Organization with centralized Copilot billing
-
-Use this path when the organization that owns the repository has centralized Copilot billing enabled for Actions.
-
-1. Ask your organization administrator to confirm centralized billing is enabled.
-2. Open `daily-report-status.md` and confirm the `permissions:` block includes `copilot-requests: write`:
-
-```markdown .github/workflows/daily-report-status.md
----
-permissions:
-  contents: read
-  copilot-requests: write
----
-```
-
-   This line is already present in the workflow template. Do not remove it.
-3. No repository secret is needed for this path.
-4. Recompile and commit the lock file from your terminal so it reflects the confirmed configuration:
-
-```bash
-gh aw compile
-git add .
-git commit -m "chore: confirm lock file is current" && git push
-```
-
-The workflow uses the organization subscription. If you see `401 Unauthorized` in the run log, see [Method 1: Copilot Requests Permission](side-quest-06-03a-copilot-requests-permission.md) for troubleshooting.
-
-### Personal billing
-
-Use this path for a personal repository, or when the owning organization does not provide centralized Copilot billing.
-
-> [!IMPORTANT]
-> When `copilot-requests: write` is present, the workflow ignores `COPILOT_GITHUB_TOKEN` for inference. Remove the permission before you set up the secret, then recompile.
-
-1. Remove `copilot-requests: write` from `daily-report-status.md`.
-2. Generate a fine-grained PAT with **Copilot requests: Read-only** in [github.com/settings/tokens](https://github.com/settings/tokens).
-3. In your repository, open **Settings** → **Secrets and variables** → **Actions**.
-4. Add a new repository secret named `COPILOT_GITHUB_TOKEN` and paste the PAT value.
-5. Recompile and commit `daily-report-status.lock.yml`.
-
-For the full browser walkthrough, see [Method 2 (UI-only): `COPILOT_GITHUB_TOKEN`](side-quest-06-03c-copilot-github-token-ui-only.md). If you prefer terminal setup, use [Method 2: `COPILOT_GITHUB_TOKEN` secret](side-quest-06-03b-copilot-github-token.md).
-
-## Check the final configuration
+## Choose a billing path
 
-Open `daily-report-status.md` and confirm it matches the method you selected:
+> [!NOTE]
+> For golden-ticket workshops, billing is pre-provisioned by your org. Use the **Organization centralized billing** path unless your instructor says otherwise.
 
-| Billing path | `copilot-requests: write` | Required secret |
-|---|---|---|
-| Organization centralized billing | Present | None |
-| Personal billing | Removed | `COPILOT_GITHUB_TOKEN` |
+Follow the full setup steps in [Side Quest: Copilot Billing Paths](side-quest-07d-billing-paths.md), then return here once your workflow file and lock file are committed.
 
-## ✅ Checkpoint
+## :white_check_mark: Checkpoint
 
-- [ ] I opened Copilot CLI in the terminal and sent a test prompt
-- [ ] I received a response from the model and the `agentic-workflows` skill
+- [ ] I sent the test prompt in Copilot CLI and received a reply
 - [ ] I confirmed no access errors appeared
-- [ ] I confirmed the first workflow uses GitHub Copilot
-- [ ] I used the agent + `agentic-workflows` guidance to improve workflow design decisions
-- [ ] I chose organization centralized billing or personal billing
-- [ ] I completed all configuration steps for my chosen billing path (inline above — no side-quest visit required)
-- [ ] My source and compiled lock file use the selected method
-- [ ] Both workflow files are committed to `main`
+- [ ] I chose a billing path and completed all configuration steps
+- [ ] My source file and compiled lock file reflect the chosen method
+- [ ] Both files are committed to `main`
 - [ ] I am ready for [Run and Watch Your Workflow](08-run-your-workflow.md)
 
 <!-- journey: all -->

workshop/side-quest-07d-billing-paths.md

@@ -0,0 +1,84 @@
+# Side Quest: Copilot Billing Paths
+
+Choose exactly one billing path for your first workflow, configure it, and commit the updated lock file.
+
+## Quick reference
+
+| Situation | Path | Key setting |
+|---|---|---|
+| Organization provides centralized Copilot billing for Actions | **Organization centralized billing** | Keep `copilot-requests: write`; no secret needed |
+| Personal repo, or org does not provide centralized billing | **Personal billing** | Remove `copilot-requests: write`; add `COPILOT_GITHUB_TOKEN` secret |
+
+If you are not sure which applies, ask: "Is centralized Copilot billing for GitHub Actions enabled for this repository?" If the answer is "no" or "I don't know," follow **Personal billing**.
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="images/07d-billing-path-decision-dark.svg">
+  <source media="(prefers-color-scheme: light)" srcset="images/07d-billing-path-decision-light.svg">
+  <img alt="Decision flow for choosing Copilot billing path: organization centralized billing or personal billing" src="images/07d-billing-path-decision-light.svg">
+</picture>
+
+## Path A: Organization centralized billing
+
+Use this path when the organization that owns the repository has centralized Copilot billing enabled for GitHub Actions.
+
+1. Ask your org admin to confirm centralized billing is enabled.
+2. Open `daily-report-status.md` and confirm the `permissions:` block includes `copilot-requests: write`:
+
+```markdown
+---
+permissions:
+  contents: read
+  copilot-requests: write
+---
+```
+
+   This line is already present in the Step 7 template. Do not remove it.
+
+1. No repository secret is needed.
+1. Recompile and commit:
+
+```bash
+gh aw compile
+git add .
+git commit -m "chore: confirm lock file is current" && git push
+```
+
+If you see `401 Unauthorized` in the run log, see [Method 1: Copilot Requests Permission](side-quest-06-03a-copilot-requests-permission.md).
+
+## Path B: Personal billing
+
+Use this path for a personal repository, or when the owning organization does not provide centralized Copilot billing.
+
+> [!IMPORTANT]
+> When `copilot-requests: write` is present, the workflow ignores `COPILOT_GITHUB_TOKEN`. Remove that permission line before adding the secret.
+
+1. Open `daily-report-status.md` and remove `copilot-requests: write`.
+2. Generate a fine-grained PAT with **Copilot requests: Read-only** at [github.com/settings/tokens](https://github.com/settings/tokens).
+3. In your repository go to **Settings** → **Secrets and variables** → **Actions**.
+4. Add a repository secret named `COPILOT_GITHUB_TOKEN` and paste the PAT.
+5. Recompile and commit:
+
+```bash
+gh aw compile
+git add .
+git commit -m "chore: configure personal billing path" && git push
+```
+
+For a browser-only walkthrough, see [Method 2 (UI-only): COPILOT_GITHUB_TOKEN](side-quest-06-03c-copilot-github-token-ui-only.md). For terminal setup, see [Method 2: COPILOT_GITHUB_TOKEN secret](side-quest-06-03b-copilot-github-token.md).
+
+## Confirm engine
+
+Open `daily-report-status.md` and verify there is no `engine:` line. The workflow defaults to GitHub Copilot — no Anthropic or OpenAI key is needed for this first run.
+
+To switch engines later, see:
+- [Side Quest: Configure an Anthropic API Key](side-quest-11-06-anthropic-key.md)
+- [Side Quest: Configure an OpenAI API Key](side-quest-11-07-openai-key.md)
+
+## :white_check_mark: Checkpoint
+
+- [ ] I chose a billing path and completed all configuration steps
+- [ ] `daily-report-status.md` reflects the chosen method
+- [ ] `daily-report-status.lock.yml` is recompiled and committed to `main`
+- [ ] I am ready to return to [Confirm Model Access](07d-confirm-model-access.md)
+
+**Return to:** [Confirm Model Access](07d-confirm-model-access.md)