A repository uses Copilot coding agent for a Node.js service that requires private package dependencies. The team creates .github/workflows/copilot-setup-steps.yml so Copilot can prepare the environment before it starts work. The setup file must be testable when changed, must use the job name Copilot expects, and must keep repository permissions minimal. Which option completes the workflow?

The correct option ensures the workflow is triggered only when the setup file itself changes, uses the required job name for Copilot, and maintains minimal permissions. Missing value 1: .github/workflows/copilot-setup-steps.yml correctly restricts workflow execution to changes in the setup file, making it testable and efficient. Other options like src/ or .github/workflows/.yml would trigger the workflow too broadly, which is not ideal for testing this specific setup file. Missing value 2: copilot-setup-steps is the exact job name Copilot expects for its setup steps. Using validate-agent-output or setup-agent-environment would prevent Copilot from recognizing and utilizing this setup. Missing value 3: read for permissions: contents: provides the necessary access to clone the repository without granting unnecessary write permissions, adhering to the principle of least privilege. write would grant excessive permissions for a setup job that only needs to read the repository content.