feat(connect): support Workday simplified 2-connection install - #111
Merged
Conversation
saengland
requested review from
Graham McMynn (GrahamMcMynn),
nehaoss,
Qazi Zaahirah (qazizaahirah) and
Srikanth Deshpande (srideshpande)
May 29, 2026 13:57
nehaoss
reviewed
Jun 3, 2026
nehaoss
left a comment
Contributor
There was a problem hiding this comment.
Overall the branching logic (simplified vs. legacy) is well-structured and consistent across step2/step3.
nehaoss
reviewed
Jun 3, 2026
nehaoss
left a comment
Contributor
There was a problem hiding this comment.
Well-structured feature branch — the simplified vs legacy path detection is cleanly implemented. Comments:
-
Detection logic in step1.md (section 1.7a): The 3-way classification (3 refs → legacy, 1 ref → simplified, 0 refs → fresh/simplified) is clear. Edge case question: what happens if there are 2 Workday connection references (e.g., a partial/failed previous install)? The current logic doesn't explicitly handle that case — might be worth adding a fallback or warning.
-
REST base URL derivation (step1.md section 1.7d): Building \WD_REST_BASE_URL\ as \https://{WD_TOKEN_HOST}/ccx/api\ — is this always the correct REST endpoint pattern across all Workday clouds (impl, sandbox, preview)? If the host differs between REST and SOAP for some environments, this could silently fail.
-
Step2.md simplified path skip: Clean implementation — Task 1 only, then skip to 2.7. The completion summary table for simplified (showing 3 rows: Environment/Entra SSO/Connection) is a nice touch for user confidence.
-
Step3.md — OAuthUser REST base URL field: The simplified path adds a new field requirement for the OAuthUser connection. Is this field already supported in the extension pack manifest, or does it require a specific extension pack version? If version-dependent, consider adding a version check.
-
copilot-instructions.md change: The two-line edit accurately updates the global context. Good that it's minimal and references the detailed docs.
saengland
pushed a commit
that referenced
this pull request
Jun 4, 2026
Handle partial legacy installs and older extension pack versions surfaced in PR #111 review: - step1.md 1.7a: classify the 2-connection case (only d6081 and/or 0786a present) as a partial legacy install rather than falling through to simplified. Persist partialInstall flag in config so step3 can branch on it. - step3.md 3.4: read partialInstall and tell the model to finish the missing legacy connection(s) instead of starting a fresh simplified install on top. - step3.md 3.4 simplified: add a one-line escape hatch for older Workday extension pack versions that don't expose the 'Workday REST base URL' field on the OAuthUser connection. User types 'legacy' to switch paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
saengland
force-pushed
the
feat/workday-simplified-connect
branch
from
June 4, 2026 19:05
bcb74a1 to
ae00618
Compare
Collaborator
Author
Copilot started reviewing on behalf of
Srikanth Deshpande (srideshpande)
June 8, 2026 18:56
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Workday /connect skill documentation/runbook to support Microsoft’s new simplified Workday install (OAuthUser ff0df + Dataverse, using REST /workers/me) while preserving the legacy install flow.
Changes:
- Add install-path detection (simplified vs legacy, including partial legacy) and branch the connect steps accordingly.
- Update step2/step3 guidance to gate legacy-only admin setup and verification steps.
- Refresh repo documentation/instructions to describe both supported Workday install paths.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
solutions/ess-maker-skills/src/skills/connect/workday/step1.md |
Detect install path and derive new restBaseUrl; gate legacy-only RaaS detection. |
solutions/ess-maker-skills/src/skills/connect/workday/step2.md |
Introduce simplified-vs-legacy branching for admin setup. |
solutions/ess-maker-skills/src/skills/connect/workday/step3.md |
Add 2-connection simplified install guidance and path-aware verification/redirect wiring. |
solutions/ess-maker-skills/src/skills/connect/workday/tasks.md |
Update checklist wording to cover both paths. |
solutions/ess-maker-skills/src/skills/connect/SKILL.md |
Update Workday routing/principles to reflect both install paths. |
solutions/ess-maker-skills/README.md |
Document both install paths and updated setup expectations. |
solutions/ess-maker-skills/.github/copilot-instructions.md |
Update Workday guidance to reflect two supported install paths. |
saengland
pushed a commit
that referenced
this pull request
Jun 9, 2026
Handle partial legacy installs and older extension pack versions surfaced in PR #111 review: - step1.md 1.7a: classify the 2-connection case (only d6081 and/or 0786a present) as a partial legacy install rather than falling through to simplified. Persist partialInstall flag in config so step3 can branch on it. - step3.md 3.4: read partialInstall and tell the model to finish the missing legacy connection(s) instead of starting a fresh simplified install on top. - step3.md 3.4 simplified: add a one-line escape hatch for older Workday extension pack versions that don't expose the 'Workday REST base URL' field on the OAuthUser connection. User types 'legacy' to switch paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
saengland
force-pushed
the
feat/workday-simplified-connect
branch
from
June 9, 2026 13:30
a7ebbab to
01fe50b
Compare
amilandi
approved these changes
Jun 9, 2026
The /connect workday skill assumed the legacy 3-connection install (ISU accounts, security groups, RaaS report). Microsoft now ships a simplified install needing only the OAuthUser connection (ff0df) plus Dataverse, using the REST /workers/me endpoint for user context. step1 now classifies the install path (simplified vs legacy; fresh installs default to simplified) and derives the Workday REST base URL. step2 gates the ISU/security-group/auth-policy/API-client/domain-permission/RaaS tasks to the legacy path; Entra SSO stays mandatory on both. step3 adds a 2-connection install table with the REST base URL field, path-aware verification, and routes the user-context topic redirect to the V2 (REST) topic on simplified installs. SKILL.md, copilot-instructions.md, and README.md updated to describe both paths. Flightcheck and doc vendoring intentionally out of scope. Refs #93
Handle partial legacy installs and older extension pack versions surfaced in PR #111 review: - step1.md 1.7a: classify the 2-connection case (only d6081 and/or 0786a present) as a partial legacy install rather than falling through to simplified. Persist partialInstall flag in config so step3 can branch on it. - step3.md 3.4: read partialInstall and tell the model to finish the missing legacy connection(s) instead of starting a fresh simplified install on top. - step3.md 3.4 simplified: add a one-line escape hatch for older Workday extension pack versions that don't expose the 'Workday REST base URL' field on the OAuthUser connection. User types 'legacy' to switch paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The simplified (2-connection) install routes admin setup through Task 1
only and lists 'API client' as not-needed, but step3's ff0df OAuthUser
connection requires {oauthClientId}, which is captured only in Task 4.
As written, simplified leaves oauthClientId unresolved.
The ff0df connection signs in via a customer-registered Workday API
client (Assertion Verification = Use Configured IdPs, backed by the
Task 1 Entra IdP), per the canonical workday.md integration doc and the
WORKDAY_OAUTH_CLIENT_ID runtime env var. So the API client is required
on both paths.
- Route simplified through Task 1 AND Task 4 (skip only 2, 3, 5, 6),
with explicit installPath branches at every Task 1 exit
- Stop listing 'API client' as not-needed for simplified in step2/SKILL
- Add oauthClientId to the step2 config-read list and tasks.md checklist
- Clarify Dataverse verification in step3 (platform connector, not
%workday%, so confirm from the install green-check not the query)
- Name connection counts by the 3 Workday SOAP refs (Dataverse common
to both paths) in step1
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PR #68 (now merged) moved kit bookkeeping from my/ to .local/. This PR added new install-path detection lines that still referenced my/connect/workday/config.json. Point them at .local/ so the runbook is consistent with merged main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
saengland
force-pushed
the
feat/workday-simplified-connect
branch
from
June 9, 2026 19:12
3686c31 to
7682361
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
/connect workdayskill assumed the legacy 3-connection install (ISU service accounts, security groups, auth policies, API client, domain permissions, and theWD_User_ContextRaaS report). Microsoft now ships a simplified install that needs only the OAuthUser connection (ff0df, Microsoft Entra ID Integrated) plus Dataverse, using the Workday REST/workers/meendpoint for user context.This PR teaches the connect skill to detect which path a tenant is on and branch accordingly. Fresh installs default to simplified; existing legacy installs keep working unchanged.
Fixes #93.
Changes
src/skills/connect/workday/step1.mdsrc/skills/connect/workday/step2.mdff0dfneeds itsrc/skills/connect/workday/step3.mdsrc/skills/connect/workday/tasks.mdsrc/skills/connect/SKILL.md.github/copilot-instructions.mdREADME.mdKey behavior preserved
ff0dfruntimeSource: invokerconnection authenticates as the employee).Out of scope (intentionally)
scripts/flightcheck/) — owned by another team.src/reference/ess-docs/.Note on the V2 redirect target
For the simplified path, step3 resolves the user-context topic dialog id by discovering the installed Workday "Set User Context" system topic from the extracted agent (rather than hardcoding an unverified schema name), defaulting to
WorkdaySystemGetUserContextV2. A reviewer with a simplified-install tenant should confirm the exact topic name.Testing
These are agent instruction (Markdown) files — no automated tests. Reviewed for internal consistency across the branch points (step1 → step2 → step3) and against the existing legacy flow.