[Shawn Russ (shawnrruss)]

Description

Fixes #3623. Migrate GitHubCopilotTarget to the current session API and include the SDK upgrade removed from #4058.

• Replace remote_session with the SDK's opt-in cloud configuration while keeping conversations local and preserving native multi-turn history.
• Explicitly disable tools, skills, instruction/config discovery, memory, telemetry, and background integrations.
• Keep autospecced SDK mocks, assert the serialized isolation settings, and exercise both native completion and legacy fallback paths.
• Require github-copilot-sdk>=1.0.28,<2 in both extras and regenerate uv.lock.

Validation so far uses offline tests and mocked SDK I/O; live Copilot runtime behavior remains unverified.

[Copilot]

🔵 Needs a closer look

Session isolation relies on SDK/runtime semantics that mocked offline tests cannot establish, requiring live verification of local-only sessions, disabled integrations, and native multi-turn continuity.

No open issues 🎉

What changed in this PR

Updates PyRIT’s GitHubCopilotTarget for the current Copilot SDK session API, addressing #3623 and restoring the SDK upgrade deferred from #4058.

Changes:

• Replaces remote_session with cloud=None and explicitly disables additional integrations while preserving local, native multi-turn sessions.
• Expands offline tests to verify serialized isolation settings and exercise native completion and legacy fallback paths.
• Requires github-copilot-sdk>=1.0.28,<2 in both extras and updates the lockfile.

Live Copilot runtime behavior remains unverified.

File	Description
uv.lock	Locks Copilot SDK 1.0.28 and updates dependency constraints.
tests/​unit/​prompt_target/​target/​test_github_copilot_target.py	Verifies isolation serialization and both completion paths.
pyrit/​prompt_target/​github_copilot_target.py	Migrates session configuration and adds explicit isolation settings.
pyproject.toml	Updates the SDK range in the github-copilot and all extras.

_{Review effort: Balanced}

[Shawn Russ (shawnrruss)]

Live smoke-test results for dc879a6, using the unchanged GitHubCopilotTarget with github-copilot-sdk 1.0.28 and Copilot runtime 1.0.105:

Two real prompt calls completed. The first returned READY; the second recalled ORCHID, confirming within-session multi-turn continuity in this run.

During shutdown, the SDK logged ValueError: 'destroy' is not a valid ShutdownType. Cleanup completed and the process exited with code 0, but this was not a fully clean pass.

This was a limited smoke test of prompt execution and within-session recall. Cross-session isolation and broader runtime isolation guarantees remain unverified.