Update github/gh-aw action to v0.79.9 (#28662)

tryghost-renovate[bot] · web-flow · commit 337cac437bb1 · 2026-06-17T03:29:20.000Z
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/gh-aw](https://redirect.github.com/github/gh-aw) | action | patch | `v0.79.4` → `v0.79.9` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/28155) for more information. --- ### Release Notes <details> <summary>github/gh-aw (github/gh-aw)</summary> ### [`v0.79.9`](https://redirect.github.com/github/gh-aw/compare/v0.79.8...v0.79.9) [Compare Source](https://redirect.github.com/github/gh-aw/compare/v0.79.8...v0.79.9) ### [`v0.79.8`](https://redirect.github.com/github/gh-aw/releases/tag/v0.79.8) [Compare Source](https://redirect.github.com/github/gh-aw/compare/v0.79.7...v0.79.8) #### 🌟 Release Highlights v0.79.8 brings two new Go linters for code quality enforcement, a wave of targeted bug fixes improving reliability and portability, a performance boost for workflow run queries, and codemod improvements to complete the `max-effective-tokens` → `max-ai-credits` migration. ##### ✨ What's New - **`httpnoctx` linter** ([#&#8203;38888](https://redirect.github.com/github/gh-aw/pull/38888)) — Automatically flags Go HTTP calls made without a `context.Context` parameter, helping catch a common source of non-cancellable requests before they reach production. - **`hardcodedfilepath` linter** ([#&#8203;38742](https://redirect.github.com/github/gh-aw/pull/38742)) — Detects hard-coded file path string literals in Go code, surfacing brittle path assumptions that break across environments. - **Code Simplifier budget caps** ([#&#8203;38851](https://redirect.github.com/github/gh-aw/pull/38851)) — Per-run hard budgets with graceful `noop` exit prevent runaway simplification loops from consuming unbounded AI credits. - **`--gh-aw-ref` resolved to commit SHA at compile time** ([#&#8203;38689](https://redirect.github.com/github/gh-aw/pull/38689)) — Branch and tag references passed via `--gh-aw-ref` are now pinned to their commit SHA during compilation, ensuring deterministic and auditable workflow builds. - **AOAI Entra smoke workflow** ([#&#8203;38706](https://redirect.github.com/github/gh-aw/pull/38706)) — New end-to-end smoke workflow validates Azure OpenAI Entra authentication for Copilot, extending CI coverage to AOAI-backed runs. ##### 🐛 Bug Fixes & Improvements - **`environment:` propagation fixed** ([#&#8203;38918](https://redirect.github.com/github/gh-aw/pull/38918)) — Top-level `environment:` blocks are now correctly propagated to the `detection` job, resolving a compilation gap that silently dropped environment bindings. - **`set_issue_field` GraphQL fix** ([#&#8203;38882](https://redirect.github.com/github/gh-aw/pull/38882)) — Corrects an invalid GraphQL query in `fetchIssueFields` that caused `set_issue_field` calls to fail at runtime. - **String-form `create_issue.labels` handled** ([#&#8203;38738](https://redirect.github.com/github/gh-aw/pull/38738)) — Safe-output validation and schema definitions now correctly handle labels provided as a comma-separated string in addition to arrays, fixing label assignment failures. - **False-positive AI credits failures eliminated** ([#&#8203;38737](https://redirect.github.com/github/gh-aw/pull/38737)) — Prevents erroneous failure issues from being filed on successful runs that happened to trigger unknown-model detection logic. - **Copilot supports arbitrary `HOME` directories** ([#&#8203;38725](https://redirect.github.com/github/gh-aw/pull/38725)) — The Copilot engine integration no longer assumes `/home/runner` as the home directory, improving portability for non-standard runner environments. - **Designer Drift Audit permissions fix** ([#&#8203;38855](https://redirect.github.com/github/gh-aw/pull/38855)) — Added the missing `pull-requests: read` scope so the Designer Drift Audit workflow can read PR data without permission errors. ##### ⚡ Performance - **Faster workflow run queries** ([#&#8203;38779](https://redirect.github.com/github/gh-aw/pull/38779)) — `listWorkflowRuns` pagination now stops as soon as the 24-hour cutoff is reached rather than fetching all pages, significantly reducing API calls on active repositories. ##### 🔧 Migration - **`max-effective-tokens: -1` codemod completed** ([#&#8203;38850](https://redirect.github.com/github/gh-aw/pull/38850)) — The `effective-tokens-to-ai-credits` codemod (`gh aw fix --write`) now correctly rewrites the `-1` sentinel value for `max-effective-tokens`, closing the last gap in the legacy budget migration. Run `gh aw fix --write` if you still see `max-effective-tokens: -1` in your workflows. ##### 📚 Documentation - Updated docs covering features shipped through 2026-06-12 ([#&#8203;38828](https://redirect.github.com/github/gh-aw/pull/38828)) including spec audits for `fileutil`, `constants`, `timeutil`, and `tty` packages ([#&#8203;38848](https://redirect.github.com/github/gh-aw/pull/38848)). > Generated by [🚀 Release](https://redirect.github.com/github/gh-aw/actions/runs/27445707307) · 110.8 AIC · ⊞ 28.8K  *** #### What's Changed - Prevent false-positive AI credits/unknown-model failure issues on successful runs by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38737](https://redirect.github.com/github/gh-aw/pull/38737) - Scale homepage hero slides correctly on mobile by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38740](https://redirect.github.com/github/gh-aw/pull/38740) - Add hardcodedfilepath linter to detect hard-coded file path string literals by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38742](https://redirect.github.com/github/gh-aw/pull/38742) - fix(copilot): support arbitrary HOME directory, not just /home/runner by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38725](https://redirect.github.com/github/gh-aw/pull/38725) - Add AOAI Entra smoke workflow for Copilot by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38706](https://redirect.github.com/github/gh-aw/pull/38706) - Handle string-form `create_issue.labels` across safe-output validation and schema/tool definitions by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38738](https://redirect.github.com/github/gh-aw/pull/38738) - \[community] Update community contributions in README by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38771](https://redirect.github.com/github/gh-aw/pull/38771) - Resolve --gh-aw-ref branch/tag to commit SHA at compile time by [@&#8203;dsyme](https://redirect.github.com/dsyme) in [#&#8203;38689](https://redirect.github.com/github/gh-aw/pull/38689) - Fix `lint-go` CGO failure by normalizing `ResolveGhAwRef` formatting and string construction by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38778](https://redirect.github.com/github/gh-aw/pull/38778) - \[spec-enforcer] Enforce specifications for styles, syncutil, testutil by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38831](https://redirect.github.com/github/gh-aw/pull/38831) - \[docs] Update documentation for features from 2026-06-12 by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38828](https://redirect.github.com/github/gh-aw/pull/38828) - \[spec-extractor] Update package specifications for tty, types, typeutil, workflow by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38822](https://redirect.github.com/github/gh-aw/pull/38822) - optimize: stop paginating listWorkflowRuns once 24h cutoff is reached by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38779](https://redirect.github.com/github/gh-aw/pull/38779) - Add debug-scoped `/tmp/gh-aw` file inventory to setup post cleanup by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38780](https://redirect.github.com/github/gh-aw/pull/38780) - refactor: semantic function clustering — dedup, shared helpers, and generics consolidation by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38776](https://redirect.github.com/github/gh-aw/pull/38776) - deps(go): bump golang.org/x/tools to v0.46.0 by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38849](https://redirect.github.com/github/gh-aw/pull/38849) - Add SEC-004 transport-body exemption to artifact client by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38853](https://redirect.github.com/github/gh-aw/pull/38853) - docs: spec audit — add github README, update fileutil/constants/timeutil/tty specs by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38848](https://redirect.github.com/github/gh-aw/pull/38848) - Add missing `pull-requests: read` scope to Designer Drift Audit workflow by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38855](https://redirect.github.com/github/gh-aw/pull/38855) - \[aw-compat] Migrate `max-effective-tokens: -1` to `max-ai-credits: -1` in codemod by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38850](https://redirect.github.com/github/gh-aw/pull/38850) - Add SEC-005 exemption annotation for apply\_samples replay driver by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38852](https://redirect.github.com/github/gh-aw/pull/38852) - \[dead-code] chore: remove dead functions — 1 function removed by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38858](https://redirect.github.com/github/gh-aw/pull/38858) - Cap Code Simplifier runaways with hard per-run budgets and graceful noop exit by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38851](https://redirect.github.com/github/gh-aw/pull/38851) - \[jsweep] Clean validate\_context\_variables.cjs by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38785](https://redirect.github.com/github/gh-aw/pull/38785) - \[linter-miner] feat(linters): add httpnoctx linter — flag HTTP calls without context by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38888](https://redirect.github.com/github/gh-aw/pull/38888) - ctxbackground: resolve `Background()` calls by package identity, not identifier text by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38854](https://redirect.github.com/github/gh-aw/pull/38854) - Refactor engine log parsing to canonical Copilot event format by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38781](https://redirect.github.com/github/gh-aw/pull/38781) - \[caveman] Optimize instruction verbosity — serena-tool, skills, subagents (2026-06-12) by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38930](https://redirect.github.com/github/gh-aw/pull/38930) - Move auto-generated notice to first line with debugging skill URL by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38923](https://redirect.github.com/github/gh-aw/pull/38923) - fix: propagate top-level `environment:` to the `detection` job by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38918](https://redirect.github.com/github/gh-aw/pull/38918) - Correct OTLP CLI version attribution for scope/service/span fields by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38916](https://redirect.github.com/github/gh-aw/pull/38916) - fix(set\_issue\_field): fix invalid GraphQL query in fetchIssueFields by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38882](https://redirect.github.com/github/gh-aw/pull/38882) **Full Changelog**: <github/gh-aw@v0.79.7...v0.79.8> ### [`v0.79.7`](https://redirect.github.com/github/gh-aw/releases/tag/v0.79.7) [Compare Source](https://redirect.github.com/github/gh-aw/compare/v0.79.6...v0.79.7) #### 🌟 Release Highlights This release focuses on **AI credit management hardening**, **codemod reliability**, and **expanded tooling support** — with stronger guardrail enforcement and cleaner failure diagnostics throughout. ##### ⚠️ Notable Changes - **`daily_effective_workflow_*` metrics renamed to `daily_ai_credits_*`** ([#&#8203;38611](https://redirect.github.com/github/gh-aw/pull/38611)): Workflow run metrics are now standardized under the `daily_ai_credits_*` namespace. If you reference these metrics in dashboards, queries, or configurations, update them to the new names. See the [migration guide](https://github.github.com/gh-aw/blog/2026-06-08-migrating-from-effective-tokens-to-ai-credits/) for details. ##### ✨ What's New - **Codemod exclusion flags for `fix` and `upgrade`** ([#&#8203;38688](https://redirect.github.com/github/gh-aw/pull/38688)): `gh aw fix` and `gh aw upgrade` now accept exclusion flags, giving you fine-grained control over which codemods are applied during automated maintenance runs. - **Pi CLI support** ([#&#8203;38724](https://redirect.github.com/github/gh-aw/pull/38724)): The `@earendil-works/pi-coding-agent` CLI is now tracked in the cli-version-checker, expanding agent compatibility monitoring. ##### 🐛 Bug Fixes & Improvements - **Guardrail enforcement hardened** ([#&#8203;38639](https://redirect.github.com/github/gh-aw/pull/38639)): The `max_daily_ai_credits` guardrail now fails as a hard stop, preventing cost overruns while correctly preserving workflow conclusion failure handling. - **Guardrail coverage expanded** ([#&#8203;38705](https://redirect.github.com/github/gh-aw/pull/38705)): Daily AI credit guardrails now apply to label-triggered and slash-command-triggered workflows, closing a gap where these trigger paths were previously unenforced. - **Codemod shell comment handling** ([#&#8203;38682](https://redirect.github.com/github/gh-aw/pull/38682)): Shell comment lines are now correctly skipped when scanning `run:` blocks for expression hoisting, preventing false-positive codemod transformations. - **Actionable COPILOT\_GITHUB\_TOKEN error messages** ([#&#8203;38722](https://redirect.github.com/github/gh-aw/pull/38722)): When `COPILOT_GITHUB_TOKEN` is missing, agent failure issues now include a `permissions.copilot-requests: write` suggestion, making the fix immediately actionable. - **Faster OIDC api-proxy startup** ([#&#8203;38718](https://redirect.github.com/github/gh-aw/pull/38718)): The initial `awf-reflect` models probe is deferred until after startup, reducing cold-start latency for the harness. ##### 📚 Documentation - **Azure Foundry OpenAI v1 BYOK** ([#&#8203;38641](https://redirect.github.com/github/gh-aw/pull/38641)): Documentation now covers Bring Your Own Key (BYOK) configuration for Azure Foundry OpenAI v1 deployments. > Generated by [🚀 Release](https://redirect.github.com/github/gh-aw/actions/runs/27384597669) · 111.2 AIC · ⊞ 28.8K  *** #### What's Changed - \[dead-code] chore: remove dead functions — 5 functions removed by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38640](https://redirect.github.com/github/gh-aw/pull/38640) - Add codemod exclusion flags to `fix` and `upgrade` by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38688](https://redirect.github.com/github/gh-aw/pull/38688) - Fail max\_daily\_ai\_credits guardrail as a hard stop while preserving conclusion failure handling by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38639](https://redirect.github.com/github/gh-aw/pull/38639) - docs: Document Azure Foundry OpenAI v1 BYOK support by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38641](https://redirect.github.com/github/gh-aw/pull/38641) - chore: update slides and place on hero page by [@&#8203;mnkiefer](https://redirect.github.com/mnkiefer) in [#&#8203;38690](https://redirect.github.com/github/gh-aw/pull/38690) - fix: enhance slide loading and error handling in WorkflowHero by [@&#8203;mnkiefer](https://redirect.github.com/mnkiefer) in [#&#8203;38712](https://redirect.github.com/github/gh-aw/pull/38712) - fix(codemod): skip shell comment lines when scanning run blocks for expression hoisting by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38682](https://redirect.github.com/github/gh-aw/pull/38682) - fix: run daily AIC guardrail for label and slash command triggers by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38705](https://redirect.github.com/github/gh-aw/pull/38705) - Eliminate setup-time `@actions/artifact` install by inlining required artifact client features by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38684](https://redirect.github.com/github/gh-aw/pull/38684) - Remove legacy `model_multipliers.json` artifacts and file-based multiplier merge path by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38642](https://redirect.github.com/github/gh-aw/pull/38642) - \[linter-miner] feat(linters): add timesleepnocontext linter by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38704](https://redirect.github.com/github/gh-aw/pull/38704) - feat(harness): defer initial awf-reflect models probe during OIDC api-proxy startup by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38718](https://redirect.github.com/github/gh-aw/pull/38718) - Track Pi CLI ([@&#8203;earendil-works/pi-coding-agent](https://redirect.github.com/earendil-works/pi-coding-agent)) in cli-version-checker by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38724](https://redirect.github.com/github/gh-aw/pull/38724) - Fix Smoke Pi: no safe outputs due to wrong prompt order and missing gh CLI instruction by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38719](https://redirect.github.com/github/gh-aw/pull/38719) - rename daily\_effective\_workflow\_\* → daily\_ai\_credits\_\* by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38611](https://redirect.github.com/github/gh-aw/pull/38611) - Suggest `permissions.copilot-requests: write` in agent failure issue when COPILOT\_GITHUB\_TOKEN is missing by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38722](https://redirect.github.com/github/gh-aw/pull/38722) **Full Changelog**: <github/gh-aw@v0.79.6...v0.79.7> ### [`v0.79.6`](https://redirect.github.com/github/gh-aw/releases/tag/v0.79.6) [Compare Source](https://redirect.github.com/github/gh-aw/compare/v0.79.5...v0.79.6) #### 🌟 Release Highlights This release focuses on **observability improvements**, **Windows CLI reliability**, and **security hardening** for the AWF firewall runtime — keeping your agentic workflows stable and easier to debug. ##### ✨ What's New - **AI Credit Observability** — `gh-aw.aic` is now emitted as a `doubleValue` on OTLP conclusion spans, fixing Sentry EAP type inference and ensuring AI credit cap attributes appear consistently even when `INPUT_JOB_NAME` is absent. Richer data means faster cost diagnosis. ([#&#8203;38550](https://redirect.github.com/github/gh-aw/pull/38550), [#&#8203;38510](https://redirect.github.com/github/gh-aw/pull/38510), [#&#8203;38580](https://redirect.github.com/github/gh-aw/pull/38580)) - **Go MCP Server Process Guardrail** — A 4-process limit is now enforced on child `gh` invocations spawned by the Go MCP server, preventing runaway process trees and improving resource safety in constrained runners. ([#&#8203;38544](https://redirect.github.com/github/gh-aw/pull/38544)) - **Prefetch Strategy A/B Experiment** — The `weekly-blog-post-writer` workflow gains a `prefetch_strategy` experiment flag, enabling controlled rollout of prefetch optimizations across agentic runs. ([#&#8203;38622](https://redirect.github.com/github/gh-aw/pull/38622)) - **Maintenance Trigger Logging** — The first trigger reason for `agentics-maintenance` generation is now logged, giving operators clear visibility into what kicked off a maintenance cycle. ([#&#8203;38616](https://redirect.github.com/github/gh-aw/pull/38616)) ##### 🐛 Bug Fixes & Improvements - **Windows CLI Deadlock Fixed** — A process wrapper deadlock in the Windows CLI integration has been resolved, unblocking workflows that stalled when spawning child processes on Windows. ([#&#8203;38592](https://redirect.github.com/github/gh-aw/pull/38592)) - **Smarter Failure Titles** — The conclusion job now uses failure-specific issue titles and detects the `unknown_model_ai_credits` failure mode, making auto-filed failure issues more actionable. ([#&#8203;38615](https://redirect.github.com/github/gh-aw/pull/38615), [#&#8203;38610](https://redirect.github.com/github/gh-aw/pull/38610)) - **Windows Test Coverage Expanded** — The Windows CLI integration test suite is restructured into a scenario matrix covering shell, environment, path, and chaos scenarios for broader coverage. ([#&#8203;38526](https://redirect.github.com/github/gh-aw/pull/38526)) ##### 🔒 Security & Reliability - **AWF 0.27.2 Update** — Upgraded to the latest AWF firewall runtime, incorporating upstream security and stability fixes. ([#&#8203;38660](https://redirect.github.com/github/gh-aw/pull/38660)) - **Digest Pinning Restored** — Container image digest pinning for AWF 0.27.0 firewall sidecar images has been restored, and the release pipeline now gates on resolved SHA pins before pushing tags — ensuring supply chain integrity. ([#&#8203;38595](https://redirect.github.com/github/gh-aw/pull/38595), [#&#8203;38608](https://redirect.github.com/github/gh-aw/pull/38608)) ##### 📚 Documentation - **LLM/Agent Discovery** — Replaced `starlight-llms-txt` with a custom `llms.txt`/`agents.txt` that points directly to `.github/aw/*.md` workflow sources, making this repo more discoverable by LLM-based tooling. ([#&#8203;38630](https://redirect.github.com/github/gh-aw/pull/38630)) - **`copilot-requests: write` Permission Guidance** — Instruction docs now recommend the `copilot-requests: write` permission for Copilot-targeted workflows. ([#&#8203;38410](https://redirect.github.com/github/gh-aw/pull/38410)) > Generated by [🚀 Release](https://redirect.github.com/github/gh-aw/actions/runs/27362485411) · 107.7 AIC · ⊞ 28.8K  *** #### What's Changed - Replace remaining `sort.Slice` call sites with type-safe `slices.SortFunc` by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38498](https://redirect.github.com/github/gh-aw/pull/38498) - \[jsweep] Clean write\_large\_content\_to\_file.cjs by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38504](https://redirect.github.com/github/gh-aw/pull/38504) - Ensure `gh-aw.aic` is emitted on conclusion spans when `INPUT_JOB_NAME` is missing by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38510](https://redirect.github.com/github/gh-aw/pull/38510) - Restructure Windows CLI integration into scenario matrix with missing shell/env/path/chaos coverage by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38526](https://redirect.github.com/github/gh-aw/pull/38526) - Add AI credit cap observability attributes to OTLP conclusion spans by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38550](https://redirect.github.com/github/gh-aw/pull/38550) - \[instructions] Sync instruction files with release v0.79.4 by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38567](https://redirect.github.com/github/gh-aw/pull/38567) - \[docs] Update documentation for features from 2026-06-11 by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38593](https://redirect.github.com/github/gh-aw/pull/38593) - \[docs] Update glossary - daily scan by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38585](https://redirect.github.com/github/gh-aw/pull/38585) - Recommend `copilot-requests: write` for Copilot-targeted workflows in instruction docs by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38410](https://redirect.github.com/github/gh-aw/pull/38410) - Fix Windows CLI integration deadlock in process wrapper by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38592](https://redirect.github.com/github/gh-aw/pull/38592) - release: gate on resolved container SHA pins before push\_tag by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38608](https://redirect.github.com/github/gh-aw/pull/38608) - Restore digest pinning for AWF 0.27.0 firewall sidecar images by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38595](https://redirect.github.com/github/gh-aw/pull/38595) - fix: always emit gh-aw\.aic as doubleValue to fix Sentry EAP type inference by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38580](https://redirect.github.com/github/gh-aw/pull/38580) - Add a 4-process guardrail for Go MCP server child gh invocations by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38544](https://redirect.github.com/github/gh-aw/pull/38544) - Log first trigger reason for agentics-maintenance generation by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38616](https://redirect.github.com/github/gh-aw/pull/38616) - Detect unknown\_model\_ai\_credits failure in conclusion job by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38610](https://redirect.github.com/github/gh-aw/pull/38610) - Use failure-specific issue titles in conclusion job by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38615](https://redirect.github.com/github/gh-aw/pull/38615) - Add `prefetch_strategy` A/B experiment to weekly-blog-post-writer by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38622](https://redirect.github.com/github/gh-aw/pull/38622) - docs: replace starlight-llms-txt with custom llms.txt/agents.txt pointing to .github/aw/\*.md by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38630](https://redirect.github.com/github/gh-aw/pull/38630) - updated to awf 0.27.2 by [@&#8203;pelikhan](https://redirect.github.com/pelikhan) in [#&#8203;38660](https://redirect.github.com/github/gh-aw/pull/38660) **Full Changelog**: <github/gh-aw@v0.79.5...v0.79.6> ### [`v0.79.5`](https://redirect.github.com/github/gh-aw/releases/tag/v0.79.5) [Compare Source](https://redirect.github.com/github/gh-aw/compare/v0.79.4...v0.79.5) #### 🌟 Release Highlights This release focuses on **AI cost visibility and control**: the legacy “effective tokens” metric is now called **AI Credits** across all surfaces, threat detection gets a configurable cost cap, and the `add-wizard` gains smarter Copilot org billing guidance. Several reliability improvements round out the release. ##### ✨ What’s New - **AI Credits Terminology** — “Effective tokens” is now **AI Credits** (AIC) throughout the UI and workflow metrics, providing clearer cost reporting aligned with the primary billing metric. ([#&#8203;38481](https://redirect.github.com/github/gh-aw/pull/38481)) - **Threat Detection Cost Cap** — `safe-outputs.threat-detection` now supports a `max-ai-credits` field (default: 400) with runtime override, giving you independent budget control over security-scan runs. [Learn more](https://github.github.com/gh-aw/reference/threat-detection/) ([#&#8203;38456](https://redirect.github.com/github/gh-aw/pull/38456)) - **Smarter Copilot Org Billing Setup** — `gh aw add-wizard` now asks Copilot users whether they want to use `copilot-requests` (org billing via Actions token, no PAT required) or a traditional PAT, simplifying enterprise onboarding. ([#&#8203;38449](https://redirect.github.com/github/gh-aw/pull/38449)) - **AI Metrics in Failure Comments** — Agent failure issue comments now include AI credit metrics from detection jobs, making cost attribution transparent even when runs fail. ([#&#8203;38453](https://redirect.github.com/github/gh-aw/pull/38453)) ##### 🐛 Bug Fixes & Improvements - **Fixed false secret validation warnings** for Copilot org billing mode — no more spurious warnings when secrets are correctly configured. ([#&#8203;38459](https://redirect.github.com/github/gh-aw/pull/38459)) - **Improved safe-outputs error surfacing** — `comment_memory` now fails (instead of silently skipping) in non-PR contexts, and `add_comment` hard-fails on unrecognized message targets. ([#&#8203;38447](https://redirect.github.com/github/gh-aw/pull/38447)) - **Fixed Docker Hub dependency in safe-outputs** — Safe-outputs no longer pulls `node:lts-alpine` from Docker Hub, restoring reliability for environments with restricted container registries. ([#&#8203;38452](https://redirect.github.com/github/gh-aw/pull/38452)) - **Fixed `push_to_pull_request_branch`** — Branch derivation now always uses the PR’s actual head ref, resolving incorrect branch targeting. ([#&#8203;37863](https://redirect.github.com/github/gh-aw/pull/37863)) - **Fixed numeric telemetry** — `gh-aw.aic` is now always emitted as a numeric value for agent/detection spans, ensuring consistent OpenTelemetry ingestion. ([#&#8203;38432](https://redirect.github.com/github/gh-aw/pull/38432)) ##### 📚 Documentation - Automated self-healing documentation fixes applied from issue analysis. ([#&#8203;38464](https://redirect.github.com/github/gh-aw/pull/38464)) > Generated by [🚀 Release](https://redirect.github.com/github/gh-aw/actions/runs/27325174188) · 95.1 AIC · ⊞ 28.8K  *** #### What's Changed - fix: always emit gh-aw\.aic as numeric for agent/detection spans by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38432](https://redirect.github.com/github/gh-aw/pull/38432) - Update `.github/aw` guidance for frontier-model cost architecture (triage, context pull, bounded sub-agents) by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38429](https://redirect.github.com/github/gh-aw/pull/38429) - \[caveman] Optimize instruction verbosity — network, pr-reviewer, report, reuse, workflow-health (2026-06-10) by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38440](https://redirect.github.com/github/gh-aw/pull/38440) - Creating integration tests for gh aw mcp server by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38448](https://redirect.github.com/github/gh-aw/pull/38448) - Fix [#&#8203;37835](https://redirect.github.com/github/gh-aw/issues/37835): always derive push\_to\_pull\_request\_branch from PR head ref by [@&#8203;dsyme](https://redirect.github.com/dsyme) in [#&#8203;37863](https://redirect.github.com/github/gh-aw/pull/37863) - fix: safe outputs — comment\_memory fails instead of skips in non-PR context; add\_comment hard-fails on unrecognized message target by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38447](https://redirect.github.com/github/gh-aw/pull/38447) - Include detection job AI metrics in agent failure issue comment footer by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38453](https://redirect.github.com/github/gh-aw/pull/38453) - Fix secret validation false warnings for copilot org billing mode by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38459](https://redirect.github.com/github/gh-aw/pull/38459) - fix: stop pulling node:lts-alpine for safe-outputs (Docker Hub unreachable) by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38452](https://redirect.github.com/github/gh-aw/pull/38452) - feat: add-wizard prompts Copilot users to choose copilot-requests (org billing) vs PAT by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38449](https://redirect.github.com/github/gh-aw/pull/38449) - \[docs] Self-healing documentation fixes from issue analysis - 2026-06-11 by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38464](https://redirect.github.com/github/gh-aw/pull/38464) - Add threat-detection max-ai-credits with 400 default and runtime override by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38456](https://redirect.github.com/github/gh-aw/pull/38456) - Bump gh-aw-firewall to v0.27.1 by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38480](https://redirect.github.com/github/gh-aw/pull/38480) - Replace "effective tokens" with "AI Credits" in user-facing text by [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;38481](https://redirect.github.com/github/gh-aw/pull/38481) - \[community] Update community contributions in README by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;38493](https://redirect.github.com/github/gh-aw/pull/38493) **Full Changelog**: <github/gh-aw@v0.79.4...v0.79.5> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - Only on Sunday and Saturday (`* * * * 0,6`) - Between 11:00 PM and 11:59 PM, Monday through Friday (`* 23 * * 1-5`) - Between 12:00 AM and 04:59 AM, Monday through Saturday (`* 0-4 * * 1-6`) - Automerge - Only on Sunday and Saturday (`* * * * 0,6`) - Between 11:00 PM and 11:59 PM, Monday through Friday (`* 23 * * 1-5`) - Between 12:00 AM and 04:59 AM, Monday through Saturday (`* 0-4 * * 1-6`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).  Co-authored-by: tryghost-renovate[bot] <269725441+tryghost-renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
@@ -21,6 +21,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install gh-aw extension
-        uses: github/gh-aw/actions/setup-cli@3faf908f47a3822de6cc1a1c153d3eab00dfa00f # v0.79.4
+        uses: github/gh-aw/actions/setup-cli@54ad1f83a833db4de127cf278b00438e19a103a0 # v0.79.9
         with:
           version: v0.49.3
