chore(deps): update github/gh-aw action to v0.83.4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
github/gh-aw	action	minor	v0.67.1 → v0.83.4

---

Release Notes

github/gh-aw (github/gh-aw)

v0.83.4

Compare Source

🌟 Release Highlights

This release brings significant security hardening, new authentication options, expanded model support, and important workflow reliability fixes across the gh-aw platform.

✨ What's New

• Google Vertex AI Workload Identity Federation — Authenticate to Google AI via Workload Identity Federation, eliminating the need for long-lived service account keys in Gemini-powered workflows. (#​48185)
• Safe-output field aliases — New field aliases enable precise agent mistake detection, making it easier to catch and surface incorrect safe-output usage patterns. (#​48230)
• Copilot BYOK frontmatter options — Expose extraHeaders, extraBodyFields, and sessionId in workflow frontmatter for bring-your-own-key Copilot SDK integrations. (#​48096)
• stringsindexhasprefix Go linter — New analyzer detects strings.Index(...) == 0 patterns that should use strings.HasPrefix. (#​48049)
• PolicyCompiler.Compile + attribution compliance tests — Formal intent-based policy compilation with a full attribution compliance test suite. (#​48036)
• Model inventory update — Added claude-opus-5 to pricing catalogs and kept all model mirrors in sync. (#​48294, #​48279, #​48303)
• AWF & MCP Gateway bumped — Default AWF v0.27.42 / MCP Gateway v0.4.6 with refreshed pinned artifacts. (#​48236)

🐛 Bug Fixes & Improvements

• Secret argv exposure mitigated — Hardened remote include write boundaries to prevent accidental secret leakage via process arguments. (#​48318)
• dispatch_workflow backward compatibility restored — Single-target dispatch safe outputs work again after the multi-target refactor. (#​48317)
• add-wizard bootstrap ordering fixed — Pre-install bootstrap steps now run before engine selection, and call-workflow worker loading is properly initialized. (#​48282, #​48301)
• MCP CLI stdin mode corrected — Per-field stdin mode now correctly extracts the target JSON field value instead of passing the raw JSON string. (#​48100)
• GH_AW_INPUT_* forwarded to MCP container — Dynamic safe-outputs configuration now reaches the MCP container environment as intended. (#​48099)
• label_command activation guard preserved — Custom if: conditions in frontmatter no longer clobber the built-in activation guard. (#​48105)
• HTTPS angle-bracket autolinks preserved — Safe-output sanitization no longer strips valid (redacted) autolinks. (#​48169)
• Playwright CI sandbox flag — Chromium sandbox disabled for playwright-cli mode in CI containers, fixing test failures in rootless environments. (#​48102)
• Deduplication rate-limit guard fixed — The deduplicate-by-title guard was always skipping due to a wrong bucket threshold comparison. (#​48092)
• CI reliability — Resolved empty-SHA cache entries, stale action pins, and P0 CI failures. (#​48291)
• Goroutine lifecycle bounded — Added join handle for StartDockerImageDownload to prevent goroutine leaks. (#​47974)
• PR diff prefetch caching — Reduced redundant PR diff/file-list API reads with head-SHA-aware caching in top review workflows. (#​47997)
• Repo-memory patch-size cap raised — Prevents Agent Performance Analyzer push failures on large diffs. (#​48012, #​48106)

📚 Documentation

• Added release workflow pattern instructions and strengthened compliance trigger guidance with non-technical persona examples.
• Consolidated developer specifications into a single instructions file (v9.22).
• Added GEO-compliant AI discovery endpoints to the docs site.
• Unbloated the artifacts and templating reference pages for easier scanning.

Generated by 🚀 Release · sonnet46 · 26 AIC · ⊞ 7.9K

---

What's Changed

• Add join handle for StartDockerImageDownload to bound goroutine lifecycle by @​pelikhan with @​Copilot in #​47974
• fix(cgo): remove workflow .md paths from CGO PR trigger; clarify CI action_required vs agentic AR by @​pelikhan with @​Copilot in #​47989
• Reduce duplicate issue creation between DeepReport and Code Quality task-mining workflows by @​pelikhan with @​Copilot in #​47998
• Reduce redundant PR diff/file-list API reads with head-SHA-aware prefetch caching in top review workflows by @​pelikhan with @​Copilot in #​47997
• Replace missing evaluator tools in Daily GitHub Docs SEO Optimizer with a Copilot SDK driver by @​pelikhan with @​Copilot in #​47984
• Refresh update-time container digests and enforce commit-age cooldowns by @​pelikhan with @​Copilot in #​47990
• Prevent Agent Performance Analyzer repo-memory push failures by raising patch-size cap by @​pelikhan with @​Copilot in #​48012
• Document linters.All() in pkg/linters spec by @​pelikhan with @​Copilot in #​48015
• [docs] Consolidate developer specifications into instructions file (v9.22) by @​github-actions[bot] in #​48016
• Normalize report-format instructions for security scan workflows by @​pelikhan with @​Copilot in #​48013
• Add inline engine.driver sources for Copilot SDK workflows by @​pelikhan with @​Copilot in #​47991
• chore: bump agentic CLI/MCP versions (Claude 2.1.220, Copilot 1.0.75, Codex 0.145.0, Pi 0.82.0) by @​pelikhan with @​Copilot in #​47996
• Update CLI version checker for Docker image digests by @​pelikhan with @​Copilot in #​48043
• SPDD 2026-07-25: strengthen normative specs across ADRs 27479, 27523, 27626, 27639, 27707 by @​pelikhan with @​Copilot in #​48041
• docs: add GEO-compliant AI discovery endpoints to docs site by @​pelikhan with @​Copilot in #​48046
• Fix TypeScript SDK driver: resolve ts-node from workspace-local node_modules/.bin by @​pelikhan with @​Copilot in #​48018
• Add CI guard to enforce workflow container digest parity with actions-lock pins by @​pelikhan with @​Copilot in #​48039
• feat(linters): add stringsindexhasprefix analyzer for strings.Index(... ) == 0/!= 0 by @​pelikhan with @​Copilot in #​48049
• feat(intent): implement PolicyCompiler.Compile and formal attribution compliance test suite by @​pelikhan with @​Copilot in #​48036
• [caveman] Optimize instruction verbosity — action-container-substitutions.md (2026-07-25) by @​github-actions[bot] in #​48069
• [docs] docs: unbloat templating reference by @​github-actions[bot] in #​48084
• docs: add release workflow pattern instructions to .github/aw/ by @​pelikhan with @​Copilot in #​48095
• docs(aw): strengthen compliance trigger guidance and add non-technical persona examples by @​pelikhan with @​Copilot in #​48093
• fix: deduplicate-by-title rate-limit guard always skips due to wrong bucket threshold by @​pelikhan with @​Copilot in #​48092
• [docs] Update dictation skill instructions by @​github-actions[bot] in #​48140
• Fix zizmor output gap and eliminate SC2016 shellcheck violations in generated lock files by @​pelikhan with @​Copilot in #​48094
• fix(mcp-cli): per-field stdin mode extracts JSON field instead of using raw JSON string as value by @​pelikhan with @​Copilot in #​48100
• Align repo-memory max-patch-size pre-check with push diff semantics by @​pelikhan with @​Copilot in #​48106
• Allow steps.*.outputs.* in github-token expressions for same-job safe-output auth by @​pelikhan with @​Copilot in #​48101
• feat(copilot/byok): expose extraHeaders, extraBodyFields, sessionId in frontmatter by @​pelikhan with @​Copilot in #​48096
• Preserve label_command activation guards when frontmatter defines a custom if: by @​pelikhan with @​Copilot in #​48105
• [jsweep] Clean validate_memory_files.cjs by @​github-actions[bot] in #​48126
• [docs] Update documentation for features from 2026-07-26 by @​github-actions[bot] in #​48178
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @​github-actions[bot] in #​48176
• [code-simplifier] refactor(js): simplify ai_credits_context and action_setup_otlp by @​github-actions[bot] in #​48122
• Propagate models.providers pricing into AWF apiProxy (including threat-detection runs) by @​pelikhan with @​Copilot in #​48107
• Add evidence-driven linter workflow guidance by @​pelikhan with @​Copilot in #​48226
• fix: disable Chromium sandbox for playwright-cli mode in CI containers by @​pelikhan with @​Copilot in #​48102
• [blog] Weekly blog post – 2026-07-27 by @​github-actions[bot] in #​48255
• [community] Update community contributions in README by @​github-actions[bot] in #​48250
• [docs] docs: unbloat artifacts reference by @​github-actions[bot] in #​48243
• [eslint-miner] feat(eslint): add no-caught-error-interpolation rule by @​github-actions[bot] in #​48175
• [compiler-threat-spec] spec: bump compiler threat detection spec to v1.0.18 (daily audit 2026-07-27) by @​github-actions[bot] in #​48270
• feat(gemini): add Google Vertex AI Workload Identity Federation auth by @​pelikhan with @​Copilot in #​48185
• Add daily Go test parallelizer workflow by @​pelikhan with @​Copilot in #​48274
• fix: add claude-opus-5 to embedded model pricing catalogs by @​pelikhan with @​Copilot in #​48279
• Add dedicated debug loggers to 5 pkg files by @​pelikhan with @​Copilot in #​48272
• feat: safe-output field aliases for precise agent mistake detection by @​pelikhan with @​Copilot in #​48230
• [code-simplifier] refactor(js): simplify add_reaction.cjs payload validation and error handling by @​github-actions[bot] in #​48271
• [jsweep] Clean upload_assets.cjs by @​github-actions[bot] in #​48280
• Split CGO unit tests into parallel shards by @​pelikhan with @​Copilot in #​48275
• [spec-review] feat: add TYPE-012 fork-backed PR conformance check for spec v1.26.0 by @​github-actions[bot] in #​48285
• chore: move "Verify integration build" to its own parallel job by @​pelikhan with @​Copilot in #​48289
• Add max-tool-denials: 3 to all 67 copilot-sdk workflows by @​pelikhan with @​Copilot in #​48293
• fix: add default-ai-credits-pricing fallback to daily-safeoutputs-git-simulator by @​pelikhan with @​Copilot in #​48292
• Fix config step ordering and add call-workflow worker loading in gh aw add-wizard by @​pelikhan with @​Copilot in #​48282
• feat: model inventory update 2026-07-27 by @​pelikhan with @​Copilot in #​48294
• Refactor schedule heatmap styling to use centralized theme styles with NO_COLOR-aware degradation by @​pelikhan with @​Copilot in #​48223
• fix: sync claude-opus-5 entry between models.json mirrors by @​pelikhan with @​Copilot in #​48303
• [test-parallel] test: add t.Parallel() to cmd/gh-aw-wasm/compile_recovery_test.go by @​github-actions[bot] in #​48309
• fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config by @​pelikhan with @​Copilot in #​48099
• Run pre-install bootstrap steps before engine selection in add-wizard by @​pelikhan with @​Copilot in #​48301
• fix: P0 CI failures — empty-SHA cache entries and stale action pins by @​pelikhan with @​Copilot in #​48291
• Preserve HTTPS angle-bracket autolinks in safe-output sanitization by @​pelikhan with @​Copilot in #​48169
• [avenger] ## Fix host build of gh-aw-wasm package (main is undeclared) by @​github-actions[bot] in #​48320
• ci: move lint-error-messages into its own job by @​pelikhan with @​Copilot in #​48324
• Restore backward compatibility for single-target dispatch_workflow safe outputs by @​pelikhan with @​Copilot in #​48317
• Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pinned artifacts by @​lpcox with @​Copilot in #​48236
• Mitigate secret argv exposure and harden remote include write boundaries by @​pelikhan with @​Copilot in #​48318

Full Changelog: github/gh-aw@v0.83.3...v0.83.4

v0.83.3

Compare Source

🌟 Release Highlights

This release delivers significant security hardening, expanded linter coverage, improved tooling reliability, and key fixes across the compilation and evaluation pipeline.

✨ What's New

• Daily GitHub Docs SEO Optimizer — A new automated workflow (daily-github-docs-seo-optimizer) now continuously scans and improves documentation SEO, keeping content discoverable without manual intervention. (#​47975)
• Docker Image Update Monitoring — The cli-version-checker workflow now monitors Docker image updates, ensuring container dependencies stay current. (#​47980)
• GitHub MCP Server v1.7.0 — Updated the default GitHub MCP server to v1.7.0, bringing the latest MCP tool improvements to all workflows. (#​47923)
• stringsconcatloop Linter — New Go linter detects inefficient string += concatenation inside loops, guiding developers toward strings.Builder for better performance. (#​47894)
• Agentic Workflows Skill Enhancement — Unified design/create workflow task and added a dedicated optimize task, making the skill more actionable for common authoring scenarios. (#​47890)

🔒 Security Fixes

• Git Argument Injection (VULN-001) — Fixed a git argument injection vulnerability via unvalidated ref/path values in remote import fallbacks. Prevents potential command injection through crafted ref names. (#​47957)
• GraphQL Injection Fix — Resolved GraphQL injection in getOwnerNodeId (code scanning alerts #​651 and #​652). (#​47952)
• Firewall Container Digest Refresh — Refreshed gh-aw-firewall v0.27.41 container digest pins following a Go stdlib CVE rebuild. (#​47838)
• Post-update SHA Integrity Validation — Added SHA integrity checks for actions-lock entries after updates, preventing supply-chain tampering. (#​47959)

🐛 Bug Fixes & Improvements

• WASM Panic Recovery — Compilation panics in the browser WASM build no longer leave promises unresolved, improving playground reliability. (#​47854)
• Evals Model Alias Resolution — ModelMappings are now propagated into evals WorkflowData, unblocking model alias resolution in evaluation runs. (#​47956)
• require-fetch-try-catch False Positives — Fixed false positives for await fetch inside directly-awaited async callbacks and member-chained calls. (#​47969, #​47963)
• Goroutine Leak Guards — Added goleak-based leak detection for pkg/cli and pkg/console tests, catching resource leaks early. (#​47865, #​47891)
• Safe-Output Failure Artifacts — Process Safe Outputs stdout/stderr are now pre-bundled in failure artifacts, making debugging failed safe-output steps significantly easier. (#​47855)
• Agentic Failure Issue on Secret Validation — When engine secret validation fails, an agentic failure issue is now created automatically for better observability. (#​47893)
• Codex Threat-Detection Config Fix — Fixed config.toml incorrectly emitting model_provider under [history]. (#​47832)
• Duplicate Warning Icon Removed — Cleaned up duplicate warning icon in update output. (#​47981)

📚 Documentation

• Workflow Recompilation as Critical Invariant — Documentation now explicitly elevates workflow recompilation to a critical invariant. (#​47863)
• PR Reviewer Workflows Restricted to COMMENT-only — Updated docs to recommend COMMENT-only triggers by default for PR reviewer workflows. (#​47860)
• Codespaces Instruction Loading Clarified — Improved guidance on raw-content instruction loading in Codespaces with enforced fail-fast on download errors. (#​47825)

🔧 Internal

• Refactored mcp_setup_generator.go into 5 focused modules. (#​47839)
• Consolidated import-editing and file-lookup helpers into internal/astutil. (#​47912)
• Enforced appendoneelement, timenowsub, and stringsjoinone linters in CI. (#​47970)
• Added CI guard to assert pkg/cli and pkg/console unit tests are executed. (#​47905)

Generated by 🚀 Release · sonnet46 · 27.9 AIC · ⊞ 7.9K

---

What's Changed

• fix(smoke-copilot): fix add_comment failures for discussion targeting and workflow_dispatch PR context by @​pelikhan with @​Copilot in #​47722
• Stabilize CompileWorkflow_WithMCP benchmark to remove warning-path overhead by @​pelikhan with @​Copilot in #​47698
• fix: add actions: read to smoke-trigger and smoke-multi-caller caller permissions by @​pelikhan with @​Copilot in #​47721
• [jsweep] Clean convert_gateway_config_claude.cjs by @​github-actions[bot] in #​47706
• [instructions] Sync instruction files with release 0.83.1 by @​github-actions[bot] in #​47759
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @​github-actions[bot] in #​47767
• [docs] Update glossary - daily scan by @​github-actions[bot] in #​47769
• spec: add githubapi README + spec_test, fix workflow method signatures by @​pelikhan with @​Copilot in #​47800
• fix: join CheckForUpdatesAsync goroutine and eliminate time.After leak by @​pelikhan with @​Copilot in #​47699
• Clarify raw-content instruction loading in Codespaces and enforce fail-fast on download errors by @​pelikhan with @​Copilot in #​47825
• [eslint-miner] feat(eslint): add require-fetch-try-catch rule by @​github-actions[bot] in #​47763
• Refactor AI credits pricing to a single shared type and schema ref by @​pelikhan with @​Copilot in #​47723
• Fix Codex threat-detection config.toml emitting model_provider under [history] by @​davidslater with @​Copilot in #​47832
• docs: restrict PR reviewer workflows to COMMENT-only by default by @​pelikhan with @​Copilot in #​47860
• docs(aw): elevate workflow recompilation to a critical invariant by @​pelikhan with @​Copilot in #​47863
• Fix dangling secret_verification_result reference in conclusion condition by @​lpcox in #​47874
• [docs] docs: unbloat SpecOps pattern by @​github-actions[bot] in #​47882
• build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​47859
• Refactor pre-agent audit error extraction into focused helpers (largefunc backlog slice) by @​pelikhan with @​Copilot in #​47856
• WASM: recover panics in compile goroutine to avoid unresolved browser promises by @​pelikhan with @​Copilot in #​47854
• feat: fall back to older cooled-down release instead of skipping update by @​pelikhan with @​Copilot in #​47730
• Refactor duplicate close-older search flow into a shared helper by @​pelikhan with @​Copilot in #​47870
• eslint-factory: resolve write-once command aliases in no-child-process-interpolated-command by @​pelikhan with @​Copilot in #​47866
• [cli-consistency] Normalize trial option ordering and logs cache-before help text by @​pelikhan with @​Copilot in #​47834
• Add goleak-based package leak checks for pkg/cli and pkg/console tests by @​pelikhan with @​Copilot in #​47865
• docs(AGENTS.md): prohibit agentic workflow checks in Copilot cloud agent runs by @​pelikhan with @​Copilot in #​47892
• feat: unify design/create workflow task, add dedicated optimize task in agentic-workflows skill by @​pelikhan with @​Copilot in #​47890
• Add CI guard to assert pkg/cli and pkg/console unit tests are executed by @​pelikhan with @​Copilot in #​47905
• refactor: split mcp_setup_generator.go into 5 focused modules by @​pelikhan with @​Copilot in #​47839
• fix: create agentic failure issue when engine secret validation fails by @​pelikhan with @​Copilot in #​47893
• [log] Add debug logging to un-logged pkg files by @​github-actions[bot] in #​47909
• test-quality-sentinel: fix TestMain misclassification, add goleak detection and goroutine-leak guards by @​pelikhan with @​Copilot in #​47891
• fix: refresh gh-aw-firewall v0.27.41 container digest pins (Go stdlib CVE rebuild) by @​pelikhan with @​Copilot in #​47838
• feat(linters): add stringsconcatloop — detect string += concatenation inside loops by @​pelikhan with @​Copilot in #​47894
• [code-simplifier] simplify: extract traverseObjectTree and hasLabelIntentMetadata helpers by @​github-actions[bot] in #​47908
• Pre-bundle Process Safe Outputs stdout/stderr in safe-output failure artifacts by @​pelikhan with @​Copilot in #​47855
• fix(stringbytesroundtrip): reword []byte(string(b)) diagnostic — defensive copy, not redundant round-trip by @​pelikhan with @​Copilot in #​47926
• [jsweep] Clean issue_title_dedup.cjs by @​github-actions[bot] in #​47915
• feat(eslint): extend no-err-stack-then-string-fallback to catch instanceof Error .stack form by @​pelikhan with @​Copilot in #​47942
• Stabilize multi-device docs tester Playwright startup and separate infra preflight failures by @​pelikhan with @​Copilot in #​47941
• fix(evals): propagate ModelMappings into evals WorkflowData to unblock AWF model alias resolution by @​pelikhan with @​Copilot in #​47956
• [code-scanning-fix] Fix GraphQL injection in getOwnerNodeId (alerts #​651 and #​652) by @​github-actions[bot] in #​47952
• refactor(linters): consolidate duplicated import-editing and file-lookup helpers into internal/astutil by @​pelikhan with @​Copilot in #​47912
• Tighten workflow recompile guardrails for .github/workflows/*.md edits by @​pelikhan with @​Copilot in #​47962
• [instructions] Sync instruction files with release v0.83.1 by @​github-actions[bot] in #​47965
• Update GitHub MCP server default to v1.7.0 by @​pelikhan with @​Copilot in #​47923
• fix: git argument injection via unvalidated ref/path in remote import fallbacks (VULN-001) by @​pelikhan with @​Copilot in #​47957
• Add post-update SHA integrity validation for actions-lock entries by @​pelikhan with @​Copilot in #​47959
• Enforce appendoneelement, timenowsub, and stringsjoinone linters in CI by @​pelikhan with @​Copilot in #​47970
• chore: sweep deprecated needs.activation.outputs.* references from authoring examples by @​pelikhan with @​Copilot in #​47968
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @​github-actions[bot] in #​47971
• Add daily GitHub Docs SEO optimizer by @​pelikhan with @​Copilot in #​47975
• feat: refresh gh-aw-node digest and replace manual scanner installs with gh aw compile flags by @​pelikhan with @​Copilot in #​47958
• Handle chained awaited fetch calls in require-fetch-try-catch by @​pelikhan with @​Copilot in #​47963
• fix(require-fetch-try-catch): no-op false positive for await fetch inside directly-awaited async callback by @​pelikhan with @​Copilot in #​47969
• fix(daily-github-docs-seo-optimizer): allow bash to unblock safeoutputs and sub-agents by @​pelikhan with @​Copilot in #​47979
• feat: monitor Docker image updates in cli-version-checker workflow by @​pelikhan with @​Copilot in #​47980
• fix: remove duplicate warning icon in update output by @​pelikhan with @​Copilot in #​47981
• [eslint-miner] fix(eslint): extend require-fetch-try-catch to detect member-chained fetch calls by @​github-actions[bot] in #​47967

Full Changelog: github/gh-aw@v0.83.2...v0.83.3

v0.83.2

Compare Source

🌟 Release Highlights

This release focuses on security hardening, reliability fixes, and developer tooling improvements — with enhanced shell-injection detection, WIF auth regression fixes, and a smarter gh aw add command.

✨ What's New

• Smarter gh aw add: Local skill references are now automatically rewritten to fully-qualified specs on gh aw add, reducing configuration drift and making workflows more portable. (#​47690)
• BYOK Ollama support: Added sandbox.agent.default-ai-credits-pricing to fix HTTP 400 errors when using Bring-Your-Own-Key Ollama engines. (#​47687)
• Shell-injection linting: The ESLint factory now includes a no-child-process-interpolated-command rule to catch shell-injection command strings at authoring time. (#​47555)

🐛 Bug Fixes & Improvements

• WIF auth regression restored: Fixes a v0.82.10 regression where WIF auth mapping support was broken for imported engine definitions. (#​47572)
• ARC/DinD runtime path fix: Deferred runtime setup now always relocates generated Node.js to daemon-visible storage, preventing silent failures on ARC runners. (#​47561)
• Unnamed checkout steps: Fixed deferred runtime setup for unnamed custom checkout steps. (#​47545)
• Close-older-issues guard: Prevents close-older-issues from accidentally closing issues created in the same workflow run. (#​47585)
• CLI consistency: Addressed 14 CLI consistency issues across branding, descriptions, and docs. (#​47592)
• ESLint variable indirection: Resolved single-level variable indirection in no-exec-interpolated-command. (#​47544)
• Command execution hardening: Hardened command execution inputs in git, workflow, and CLI paths. (#​47546)

🔧 Internal

• Bumped AWF firewall to v0.27.41 and MCP gateway to v0.4.5
• Replaced gh CLI calls with native go-gh REST clients for release and ref lookups
• Added debug logging to defer-safety linters
• Removed 5 dead functions

📚 Documentation

• Streamlined the orchestration pattern guide for clarity
• Self-healing documentation fixes from automated issue analysis
• Improved spec–implementation alignment across 6 package READMEs

Generated by 🚀 Release · sonnet46 · 14.6 AIC · ⊞ 7.9K

---

What's Changed

• fix(eslint-factory): resolve single-level variable indirection in no-exec-interpolated-command by @​pelikhan with @​Copilot in #​47544
• fix: increase timeout-minutes to 30 for copilot-pr-nlp-analysis workflow by @​pelikhan with @​Copilot in #​47558
• Convert report-as-issue tip to details/progressive disclosure by @​pelikhan with @​Copilot in #​47574
• eslint-factory: add no-child-process-interpolated-command to catch shell-injection command strings by @​pelikhan with @​Copilot in #​47555
• Harden command execution inputs in flagged git, workflow, and CLI paths by @​pelikhan with @​Copilot in #​47546
• Fix 9 spec–implementation mismatches across 6 package READMEs by @​pelikhan with @​Copilot in #​47588
• Add explicit h3 formatting enforcement to 3 non-compliant reporting workflows by @​pelikhan with @​Copilot in #​47593
• fix: prevent close-older-issues from closing issues created in the same run by @​pelikhan with @​Copilot in #​47585
• fix: add generated footer to close_issue comment body by @​pelikhan with @​Copilot in #​47584
• fix: restore WIF auth mapping support for imported engine definitions (v0.82.10 regression) by @​pelikhan with @​Copilot in #​47572
• fix: add · separator between model alias and AIC value in footer by @​pelikhan with @​Copilot in #​47567
• Fix ARC/DinD deferred runtime path to always relocate generated Node.js to daemon-visible storage by @​pelikhan with @​Copilot in #​47561
• Fix deferred runtime setup for unnamed custom checkout steps by @​pelikhan with @​Copilot in #​47545
• [dead-code] chore: remove dead functions — 5 functions removed by @​github-actions[bot] in #​47598
• [ab-advisor] Add sub_agent_strategy experiment to smoke-copilot-sub-agents by @​pelikhan with @​Copilot in #​47557
• chore: bump AWF to v0.27.39 and MCP gateway to v0.4.4 by @​lpcox with @​Copilot in #​47597
• Use native go-gh REST clients for release and ref lookups by @​pelikhan with @​Copilot in #​47547
• [docs] Self-healing documentation fixes from issue analysis - 2026-07-24 by @​github-actions[bot] in #​47672
• [docs] docs: unbloat orchestration pattern by @​github-actions[bot] in #​47677
• [community] Update community contributions in README by @​github-actions[bot] in #​47689
• Close SPDD conformance gaps for ADRs 27325/27327/27387/27476/27479 by @​pelikhan with @​Copilot in #​47637
• fix: address 14 CLI consistency issues (branding, descriptions, docs) by @​pelikhan with @​Copilot in #​47592
• Targeted custom-lint remediation for non-largefunc findings in CLI/workflow paths by @​pelikhan with @​Copilot in #​47601
• Formal spec alignment for GitHub MCP access-control conformance docs and predicate mapping by @​pelikhan with @​Copilot in #​47633
• [safe-output-integrator] test: add max_bot_mentions coverage to generateSafeOutputsConfig tests by @​github-actions[bot] in #​47658
• [log] Add debug logging to defer-safety linters by @​github-actions[bot] in #​47697
• test(actionpins): improve test quality per testify-expert audit by @​pelikhan with @​Copilot in #​47686
• feat: rewrite local skill refs to qualified specs on gh aw add by @​pelikhan with @​Copilot in #​47690
• Bump AWF firewall to v0.27.41 and MCPG to v0.4.5 by @​lpcox with @​Copilot in #​47695
• feat: add sandbox.agent.default-ai-credits-pricing to fix BYOK Ollama HTTP 400 by @​pelikhan with @​Copilot in #​47687

Full Changelog: github/gh-aw@v0.83.1...v0.83.2

v0.83.1

Compare Source

🌟 Release Highlights

This release expands the gh aw compile security pipeline with container vulnerability scanning, license auditing, and YAML linting — while delivering a wave of reliability fixes across the compiler, harness, and PR review workflows.

✨ What's New

• Container vulnerability scanning with Grype — gh aw compile now runs [Grype](https://redirect.github.com/anchore/grype

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[deepsource-io]

DeepSource Code Review

We reviewed changes in a4ccdc8...53b257c on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		May 6, 2026 11:42a.m.	Review ↗
Secrets		May 6, 2026 11:42a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-10 00:53 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-11 00:54 UTC · at 962ccd6975185fe90f9ffcf7f2c85630e810ca44

This pull request spent 1 day 33 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Changes are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.81.5). No functional changes detected. This is a Renovate bot update for GitHub Actions.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous Review Summaries (6 snapshots, latest commit 3030fd6)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3030fd6)

Status: No Issues Found | Recommendation: Merge

Overview

Changes are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.80.9). No functional changes detected. This is a Renovate bot update for GitHub Actions.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit f1d3998)

Status: No Issues Found | Recommendation: Merge

Overview

Full diff review (incremental base unavailable due to history rewrite) — changes are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.80.9). No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit e352849)

Status: No Issues Found | Recommendation: Merge

Overview

Incremental changes since commit 3c9b0f5b5bc6bd47d37bcdaa50f4a6b30ff56d6e are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.80.5). No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit 3c9b0f5)

Status: No Issues Found | Recommendation: Merge

Overview

Full diff review (incremental history unavailable) - changes are routine version bumps in auto-generated workflow lock files. No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit f04c221)

Status: No Issues Found | Recommendation: Merge

Overview

Incremental changes since previous review (commit 566df554b2b2750fe192348e6e5aea10cca7db9a) are routine version bumps in auto-generated workflow lock files. No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit 566df55)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

EOF

---

_{Reviewed by laguna-m.1-20260312:free · Input: 244.4K · Output: 2.3K · Cached: 313.1K}

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-11 00:54 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-13 17:52 UTC · at 12bb3e3ff9585ab26910b80c10e5309e29b68450

This pull request spent 2 days 16 hours 57 minutes 39 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-13 17:52 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-13 20:31 UTC · at 989e44b1b5e600b4c29575debef4592dbf4a301f

This pull request spent 2 hours 39 minutes 5 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-13 20:32 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-15 01:25 UTC · at aa3aa42aa7fe2b49fe23b2ef31a7de0829aec225

This pull request spent 1 day 4 hours 53 minutes 29 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-27 01:05 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #342, #349, #372 and #369 together #424
• 🚫 Left the queue — 2026-06-27 05:57 UTC · at 8a1a5fbd6e3c400745dcc59951ab8a255825f6c2

This pull request spent 4 hours 52 minutes 3 seconds in the queue, including 50 seconds running CI.

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-27 05:58 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #349, #372, #342 and #369 together #428
• 🚫 Left the queue — 2026-06-29 17:44 UTC · at 4c7181bd82d96fcca97cb01ca8f27f1acc1b4b45

This pull request spent 2 days 11 hours 45 minutes 53 seconds in the queue, including 36 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-29 17:44 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #349, #372 and #369 together #430
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-29 17:44 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #435
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-29 17:44 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #435
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-29 17:44 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #435
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-29 17:44 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #435
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-29 17:44 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #435
• 🚫 Left the queue — 2026-07-25 19:12 UTC · at 766e5db9bbd4212dbfe564b0badee9848985f5ff

This pull request spent 26 days 1 hour 27 minutes 47 seconds in the queue, including 9 minutes 56 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-25 19:14 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #342 and #369 together #446
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-25 19:14 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #342 and #369 together #446
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-25 19:14 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #342 and #369 together #446
• 🚫 Left the queue — 2026-07-27 20:34 UTC · at b15d909358bcac949b4f09dddfb42296a8e8a831

This pull request spent 2 days 1 hour 19 minutes 41 seconds in the queue, including 2 minutes 38 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #342, #349 and #369 together #449
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #451
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #451
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge