Upgrade gh-aw to v0.87.2 and drop the copilot CLI toolcache workarounds

Both bugs this repo was working around are fixed upstream in v0.87.1, so the
local shims added in #571 are no longer needed.

github/gh-aw#53481 (toolcache ENOENT) - install_copilot_cli.sh now always
materializes ${INSTALL_DIR}/copilot with a wrapper instead of returning early
when GITHUB_PATH is set, and hard-fails if the path is still missing, so the
failure can never again be a silent ENOENT. Verified present in the pinned
action SHA b304200a (gh-aw-actions v0.87.2).

github/gh-aw#52777 (unpinned dispatcher action) - the centralized
slash-command dispatcher now wires a real SHAResolver instead of nil, so
agentic_commands.yml pins the setup action by SHA like every other generated
workflow.

Removed from all three workflows:
  - the `pre-agent-steps` wrapper (agent job)
  - the `safe-outputs.threat-detection.steps` shim (detection job)

Also in this upgrade:

  - v0.87.x enables strict mode by default ("workflows default to strict mode
    unless frontmatter sets strict: false"). That surfaced two schema changes,
    both applied via `gh aw fix` rather than by hand:
      * daily-issue-triage needs an explicit `tools.bash: false` +
        `cli-proxy: false`, because upstream agentics sets
        `github.min-integrity: none` and strict mode requires shell access to
        be intentional. Triage needs no shell, so both are disabled.
      * `expires: 60` -> `expires: 60d` (integer to day-string migration).
  - The dispatcher skill/agent moved to the v0.87 layout:
    .github/agents/agentic-workflows.agent.md is now
    .github/agents/agentic-workflows.md, plus a new
    .github/skills/agentic-workflows/SKILL.md.

.gitattributes: extend the LF rules from #558 to the generated files they
missed - agentic_commands.yml, agentics-maintenance.yml,
copilot-setup-steps.yml, .github/agents/** and .github/skills/**. Those were
still being checked out as CRLF, which is exactly what makes `gh aw update`
conflict on whole files. Listed individually rather than via *.yml so the
hand-written CI workflows keep the repo default.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: addb9717-56f3-4aa7-a1ed-9d4dd7b43f83

Author: Shazwazza

.gitattributes

@@ -8,3 +8,11 @@
 .github/workflows/*.lock.yml text eol=lf
 .github/workflows/aw.json text eol=lf
 .github/aw/** text eol=lf
+
+# The remaining gh-aw generated files. These are listed individually rather than
+# via *.yml so the hand-written CI workflows keep the repo default.
+.github/workflows/agentic_commands.yml text eol=lf
+.github/workflows/agentics-maintenance.yml text eol=lf
+.github/workflows/copilot-setup-steps.yml text eol=lf
+.github/agents/** text eol=lf
+.github/skills/** text eol=lf

.github/agents/agentic-workflows.agent.md .github/agents/agentic-workflows.md.github/agents/agentic-workflows.agent.md renamed to .github/agents/agentic-workflows.md

@@ -1,19 +1,27 @@
 ---
-description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing
+name: Agentic Workflows
+description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing.
 disable-model-invocation: true
 ---
 
 # GitHub Agentic Workflows Agent
 
 This agent helps you work with **GitHub Agentic Workflows (gh-aw)**, a CLI extension for creating AI-powered workflows in natural language using markdown files.
 
+## Repository Instructions Overlay
+
+If `.github/aw/instructions.md` exists, load it with:
+@.github/aw/instructions.md
+
+Precedence: repository overlay instructions override defaults in this agent when they conflict.
+
 ## What This Agent Does
 
 This is a **dispatcher agent** that routes your request to the appropriate specialized prompt based on your task:
 
 - **Creating new workflows**: Routes to `create` prompt
 - **Updating existing workflows**: Routes to `update` prompt
-- **Debugging workflows**: Routes to `debug` prompt  
+- **Debugging workflows**: Routes to `debug` prompt
 - **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
 - **Creating report-generating workflows**: Routes to `report` prompt — consult this whenever the workflow posts status updates, audits, analyses, or any structured output as issues, discussions, or comments
 - **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
@@ -24,9 +32,6 @@ This is a **dispatcher agent** that routes your request to the appropriate speci
 - **Reducing token consumption / cost optimization**: Routes to `token-optimization` guide — consult this whenever the user asks how to reduce token usage, lower costs, speed up workflows, or measure the impact of prompt changes with experiments
 - **Choosing workflow architectures and design patterns**: Routes to `patterns` guide — consult this whenever the user asks for strategy, architecture, operating models, or pattern selection for agentic workflows
 
-> [!IMPORTANT]
-> For architecture/pattern-selection requests, load `https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/patterns.md` first.
-
 Workflows may optionally include:
 
 - **Project tracking / monitoring** (GitHub Projects updates, status reporting)
@@ -37,7 +42,7 @@ Workflows may optionally include:
 - Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
 - Workflow lock files: `.github/workflows/*.lock.yml`
 - Shared components: `.github/workflows/shared/*.md`
-- Configuration: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/github-agentic-workflows.md
+- Configuration: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md`
 
 ## Problems This Solves
 
@@ -56,30 +61,32 @@ When you interact with this agent, it will:
 
 ## Available Prompts
 
+> **Note**: The prompt and reference files listed below are located in the [`github/gh-aw`](https://github.com/github/gh-aw) repository and are **not available locally** in this repository. Load them from their public URLs.
+
 ### Create New Workflow
 **Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/create-agentic-workflow.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-agentic-workflow.md`
 
 **Use cases**:
 - "Create a workflow that triages issues"
 - "I need a workflow to label pull requests"
 - "Design a weekly research automation"
 
-### Update Existing Workflow  
+### Update Existing Workflow
 **Load when**: User wants to modify, improve, or refactor an existing workflow
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/update-agentic-workflow.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/update-agentic-workflow.md`
 
 **Use cases**:
 - "Add web-fetch tool to the issue-classifier workflow"
 - "Update the PR reviewer to use discussions instead of issues"
 - "Improve the prompt for the weekly-research workflow"
 
-### Debug Workflow  
+### Debug Workflow
 **Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/debug-agentic-workflow.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/debug-agentic-workflow.md`
 
 **Use cases**:
 - "Why is this workflow failing?"
@@ -89,7 +96,7 @@ When you interact with this agent, it will:
 ### Upgrade Agentic Workflows
 **Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/upgrade-agentic-workflows.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/upgrade-agentic-workflows.md`
 
 **Use cases**:
 - "Upgrade all workflows to the latest version"
@@ -99,7 +106,7 @@ When you interact with this agent, it will:
 ### Create a Report-Generating Workflow
 **Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/report.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/report.md`
 
 **Use cases**:
 - "Create a weekly CI health report"
@@ -109,7 +116,7 @@ When you interact with this agent, it will:
 ### Create Shared Agentic Workflow
 **Load when**: User wants to create a reusable workflow component or wrap an MCP server
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/create-shared-agentic-workflow.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-shared-agentic-workflow.md`
 
 **Use cases**:
 - "Create a shared component for Notion integration"
@@ -119,7 +126,7 @@ When you interact with this agent, it will:
 ### Fix Dependabot PRs
 **Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/dependabot.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/dependabot.md`
 
 **Use cases**:
 - "Fix the open Dependabot PRs for npm dependencies"
@@ -129,27 +136,17 @@ When you interact with this agent, it will:
 ### Analyze Test Coverage
 **Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
 
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/test-coverage.md
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/test-coverage.md`
 
 **Use cases**:
 - "Create a workflow that comments coverage on PRs"
 - "Analyze coverage trends over time"
 - "Add a coverage gate that blocks PRs below a threshold"
 
-### Render ASCII Charts in Markdown
-**Load when**: The workflow needs in-markdown charts (sparklines, bars, table+trend views) that must align cleanly and render reliably across GitHub surfaces, including mobile.
-
-**Reference file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/asciicharts.md
-
-**Use cases**:
-- "Show a compact trend chart in an issue comment"
-- "Render a dashboard table with sparkline trends"
-- "Generate aligned ASCII bars for service metrics"
-
 ### CLI Commands Reference
 **Load when**: The user asks how to run, compile, debug, or manage workflows from the command line; needs the MCP tool equivalent of a `gh aw` command; or is in a restricted environment (e.g., Copilot Cloud) without direct CLI access.
 
-**Reference file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/cli-commands.md
+**Reference file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/cli-commands.md`
 
 **Use cases**:
 - "How do I trigger workflow X on the main branch?"
@@ -160,7 +157,7 @@ When you interact with this agent, it will:
 ### Token Consumption Optimization
 **Load when**: The user asks how to reduce token usage, lower workflow costs, make a workflow faster or cheaper, or measure the impact of prompt or configuration changes.
 
-**Reference file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/token-optimization.md
+**Reference file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/token-optimization.md`
 
 **Use cases**:
 - "How do I reduce the token cost of this workflow?"
@@ -173,7 +170,7 @@ When you interact with this agent, it will:
 ### Workflow Pattern Selection
 **Load when**: The user asks for architecture, strategy, operating model selection, or pattern recommendations for building agentic workflows.
 
-**Reference file**: https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/patterns.md
+**Reference file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/patterns.md`
 
 **Use cases**:
 - "Which pattern should I use for multi-repo rollout?"
@@ -186,7 +183,7 @@ When you interact with this agent, it will:
 When a user interacts with you:
 
 1. **Identify the task type** from the user's request
-2. **Load the appropriate prompt** from the GitHub repository URLs listed above
+2. **Load the appropriate prompt** from the URLs listed above
 3. **Follow the loaded prompt's instructions** exactly
 4. **If uncertain**, ask clarifying questions to determine the right prompt
 
@@ -225,12 +222,12 @@ gh aw compile --validate
 
 ## Important Notes
 
-- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/github-agentic-workflows.md for complete documentation
+- Always reference the instructions file at `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md` for complete documentation
 - Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
 - Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
 - **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
 - Follow security best practices: minimal permissions, explicit network access, no template injection
-- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/network.md for the full list of valid ecosystem identifiers and domain patterns.
+- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/network.md` for the full list of valid ecosystem identifiers and domain patterns.
 - **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.
 - **Triggering runs**: Always use `gh aw run <workflow-name>` to trigger a workflow on demand — not `gh workflow run <file>.lock.yml`. `gh aw run` handles workflow resolution by short name, input parsing and validation, and correct run-tracking for agentic workflows. Use `--ref <branch>` to run on a specific branch.
-- **CLI commands reference**: For a complete guide on all `gh aw` commands and their MCP tool equivalents (for restricted environments), see https://github.com/github/gh-aw/blob/v0.76.1/.github/aw/cli-commands.md
+- **CLI commands reference**: For a complete guide on all `gh aw` commands and their MCP tool equivalents (for restricted environments), see `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/cli-commands.md`

.github/aw/actions-lock.json

@@ -5,15 +5,15 @@
       "version": "v9.0.0",
       "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
-    "github/gh-aw-actions/setup-cli@v0.85.4": {
+    "github/gh-aw-actions/setup-cli@v0.87.2": {
       "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.85.4",
-      "sha": "2709137ea6c5b0e19aa621454dc643ea8dc526b1"
+      "version": "v0.87.2",
+      "sha": "b304200a0ef4b3998673bfc7945acb08ab8c88b7"
     },
-    "github/gh-aw-actions/setup@v0.85.4": {
+    "github/gh-aw-actions/setup@v0.87.2": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.85.4",
-      "sha": "2709137ea6c5b0e19aa621454dc643ea8dc526b1"
+      "version": "v0.87.2",
+      "sha": "b304200a0ef4b3998673bfc7945acb08ab8c88b7"
     }
   },
   "containers": {
@@ -47,25 +47,15 @@
       "digest": "sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.7@sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96"
     },
-    "ghcr.io/github/gh-aw-mcpg:v0.3.27": {
-      "image": "ghcr.io/github/gh-aw-mcpg:v0.3.27",
-      "digest": "sha256:fe984bddde4ec05d756d9043edb0a32912e6b7b72f6a121b1082f29221421cc7",
-      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.27@sha256:fe984bddde4ec05d756d9043edb0a32912e6b7b72f6a121b1082f29221421cc7"
-    },
     "ghcr.io/github/gh-aw-mcpg:v0.4.8": {
       "image": "ghcr.io/github/gh-aw-mcpg:v0.4.8",
       "digest": "sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8",
       "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8"
     },
     "ghcr.io/github/gh-aw-node": {
       "image": "ghcr.io/github/gh-aw-node",
-      "digest": "sha256:33e1ec1d967ac1f28c2cedc24ce103dea3226840626de345d3fe579e96cf5c7d",
-      "pinned_image": "ghcr.io/github/gh-aw-node@sha256:33e1ec1d967ac1f28c2cedc24ce103dea3226840626de345d3fe579e96cf5c7d"
-    },
-    "ghcr.io/github/github-mcp-server:v1.4.0": {
-      "image": "ghcr.io/github/github-mcp-server:v1.4.0",
-      "digest": "sha256:2afb26356481d1a350e14544a6e160f7f7ec1561a1ea309b823665abf0309036",
-      "pinned_image": "ghcr.io/github/github-mcp-server:v1.4.0@sha256:2afb26356481d1a350e14544a6e160f7f7ec1561a1ea309b823665abf0309036"
+      "digest": "sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e",
+      "pinned_image": "ghcr.io/github/gh-aw-node@sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e"
     },
     "ghcr.io/github/github-mcp-server:v1.8.0": {
       "image": "ghcr.io/github/github-mcp-server:v1.8.0",

.github/skills/agentic-workflows/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: agentic-workflows
+description: Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.
+---
+
+# Agentic Workflows Router
+
+Use this skill when a user asks to design, create, update, debug, or upgrade GitHub Agentic Workflows in this repository.
+
+This skill is a dispatcher: identify the task type, load the matching workflow prompt/skill file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
+
+Repository overlay (optional):
+- If `.github/aw/instructions.md` exists, load it with `@.github/aw/instructions.md` after loading the matched prompt/skill.
+- Precedence: repository overlay instructions override upstream defaults when they conflict.
+
+Read only the files you need:
+Load these files from `github/gh-aw` (they are not available locally).
+- `.github/aw/action-container-substitutions.md`
+- `.github/aw/agent-runtime-instructions.md`
+- `.github/aw/agentic-chat.md`
+- `.github/aw/agentic-workflows-mcp.md`
+- `.github/aw/asciicharts.md`
+- `.github/aw/campaign.md`
+- `.github/aw/charts-trending.md`
+- `.github/aw/charts.md`
+- `.github/aw/cli-commands.md`
+- `.github/aw/configure-agentic-engine.md`
+- `.github/aw/context.md`
+- `.github/aw/create-agentic-workflow-trigger-details.md`
+- `.github/aw/create-agentic-workflow.md`
+- `.github/aw/create-shared-agentic-workflow.md`
+- `.github/aw/debug-agentic-workflow.md`
+- `.github/aw/dependabot.md`
+- `.github/aw/deployment-status.md`
+- `.github/aw/designer-mappings.md`
+- `.github/aw/designer.md`
+- `.github/aw/enclaves.md`
+- `.github/aw/evals.md`
+- `.github/aw/experiments.md`
+- `.github/aw/github-agentic-workflows.md`
+- `.github/aw/github-mcp-server-pagination.md`
+- `.github/aw/github-mcp-server-tools.md`
+- `.github/aw/github-mcp-server.md`
+- `.github/aw/instructions.md`
+- `.github/aw/jobs.md`
+- `.github/aw/linter-workflows.md`
+- `.github/aw/llms.md`
+- `.github/aw/loop.md`
+- `.github/aw/lsp.md`
+- `.github/aw/maintainer.md`
+- `.github/aw/mcp-clis.md`
+- `.github/aw/memory-stateful-patterns.md`
+- `.github/aw/memory.md`
+- `.github/aw/messages.md`
+- `.github/aw/multi-agent-research.md`
+- `.github/aw/network.md`
+- `.github/aw/optimize-agentic-workflow.md`
+- `.github/aw/patterns.md`
+- `.github/aw/pr-reviewer.md`
+- `.github/aw/release-workflow.md`
+- `.github/aw/report.md`
+- `.github/aw/reuse.md`
+- `.github/aw/safe-outputs-automation.md`
+- `.github/aw/safe-outputs-content.md`
+- `.github/aw/safe-outputs-management.md`
+- `.github/aw/safe-outputs-runtime.md`
+- `.github/aw/safe-outputs.md`
+- `.github/aw/serena-tool.md`
+- `.github/aw/shared-safe-jobs.md`
+- `.github/aw/skills.md`
+- `.github/aw/subagents.md`
+- `.github/aw/syntax-agentic.md`
+- `.github/aw/syntax-core.md`
+- `.github/aw/syntax-engine.md`
+- `.github/aw/syntax-tools-imports.md`
+- `.github/aw/syntax.md`
+- `.github/aw/test-coverage.md`
+- `.github/aw/test-expression.md`
+- `.github/aw/token-optimization-caching-budgets.md`
+- `.github/aw/token-optimization-observability.md`
+- `.github/aw/token-optimization.md`
+- `.github/aw/triggers.md`
+- `.github/aw/update-agentic-workflow.md`
+- `.github/aw/upgrade-agentic-workflows.md`
+- `.github/aw/visual-regression.md`
+- `.github/aw/workflow-constraints.md`
+- `.github/aw/workflow-editing.md`
+- `.github/aw/workflow-patterns.md`
+
+After loading the matching workflow prompt or skill, follow it directly:
+- Design workflows from scratch via interview: `.github/aw/designer.md`
+- Create new workflows: `.github/aw/create-agentic-workflow.md`
+- Configure or add declarative engines: `.github/aw/configure-agentic-engine.md`
+- Update existing workflows: `.github/aw/update-agentic-workflow.md`
+- Debug, audit, or investigate workflows: `.github/aw/debug-agentic-workflow.md`
+- Upgrade workflows and fix deprecations: `.github/aw/upgrade-agentic-workflows.md`
+- Create shared components or MCP wrappers: `.github/aw/create-shared-agentic-workflow.md`
+- Create report-generating workflows: `.github/aw/report.md`
+- Fix Dependabot manifest PRs: `.github/aw/dependabot.md`
+- Analyze coverage workflows: `.github/aw/test-coverage.md`
+- Render compact markdown charts: `.github/aw/asciicharts.md`
+- Map CLI commands to MCP usage: `.github/aw/cli-commands.md`
+- Choose workflow architecture and patterns: `.github/aw/patterns.md`
+- Optimize token usage and cost: `.github/aw/token-optimization.md`
+- Design long-running multi-agent research workflows: `.github/aw/multi-agent-research.md`
+
+When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.