A team wants Copilot-created pull requests to prove that an agent task preserved API compatibility and passed regression tests. The workflow should run on pull requests targeting main, use minimal repository permissions, and upload test evidence as an artifact for reviewers. Which option completes the workflow?

The correct answer configures the workflow to trigger on pull requests targeting the main branch, grants minimal necessary permissions, and uploads a clearly named artifact. Missing value 1 = pullrequest: The requirement states the workflow should run on "pull requests targeting main," making pullrequest the correct event. push would run on pushes to main, not pull requests. workflowdispatch is for manual triggers, and pullrequesttarget has different security implications and is typically used for external contributions, not internal team workflows where pullrequest is sufficient and safer. Missing value 2 = read: The workflow only needs to check out code and upload an artifact, which requires contents: read. write permissions are unnecessary and introduce a security risk if the workflow were compromised. Missing value 3 = agent-task-evaluation: This name clearly identifies the purpose of the artifact, making it easy for reviewers to understand its content. The other options are either too generic (production-release, repository-token-report) or imply manual intervention (manual-review-only) which isn't the primary goal of an automated artifact.