Bump github/gh-aw/actions/setup from 0.65.5 to 0.83.4

[dependabot]

Bumps github/gh-aw/actions/setup from 0.65.5 to 0.83.4.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.83.4

🌟 Release Highlights

This release brings significant security hardening, new authentication options, expanded model support, and important workflow reliability fixes across the gh-aw platform.

✨ What's New

• Google Vertex AI Workload Identity Federation — Authenticate to Google AI via Workload Identity Federation, eliminating the need for long-lived service account keys in Gemini-powered workflows. (#48185)
• Safe-output field aliases — New field aliases enable precise agent mistake detection, making it easier to catch and surface incorrect safe-output usage patterns. (#48230)
• Copilot BYOK frontmatter options — Expose extraHeaders, extraBodyFields, and sessionId in workflow frontmatter for bring-your-own-key Copilot SDK integrations. (#48096)
• stringsindexhasprefix Go linter — New analyzer detects strings.Index(...) == 0 patterns that should use strings.HasPrefix. (#48049)
• PolicyCompiler.Compile + attribution compliance tests — Formal intent-based policy compilation with a full attribution compliance test suite. (#48036)
• Model inventory update — Added claude-opus-5 to pricing catalogs and kept all model mirrors in sync. (#48294, #48279, #48303)
• AWF & MCP Gateway bumped — Default AWF v0.27.42 / MCP Gateway v0.4.6 with refreshed pinned artifacts. (#48236)

🐛 Bug Fixes & Improvements

• Secret argv exposure mitigated — Hardened remote include write boundaries to prevent accidental secret leakage via process arguments. (#48318)
• dispatch_workflow backward compatibility restored — Single-target dispatch safe outputs work again after the multi-target refactor. (#48317)
• add-wizard bootstrap ordering fixed — Pre-install bootstrap steps now run before engine selection, and call-workflow worker loading is properly initialized. (#48282, #48301)
• MCP CLI stdin mode corrected — Per-field stdin mode now correctly extracts the target JSON field value instead of passing the raw JSON string. (#48100)
• GH_AW_INPUT_* forwarded to MCP container — Dynamic safe-outputs configuration now reaches the MCP container environment as intended. (#48099)
• label_command activation guard preserved — Custom if: conditions in frontmatter no longer clobber the built-in activation guard. (#48105)
• HTTPS angle-bracket autolinks preserved — Safe-output sanitization no longer strips valid (redacted) autolinks. (#48169)
• Playwright CI sandbox flag — Chromium sandbox disabled for playwright-cli mode in CI containers, fixing test failures in rootless environments. (#48102)
• Deduplication rate-limit guard fixed — The deduplicate-by-title guard was always skipping due to a wrong bucket threshold comparison. (#48092)
• CI reliability — Resolved empty-SHA cache entries, stale action pins, and P0 CI failures. (#48291)
• Goroutine lifecycle bounded — Added join handle for StartDockerImageDownload to prevent goroutine leaks. (#47974)
• PR diff prefetch caching — Reduced redundant PR diff/file-list API reads with head-SHA-aware caching in top review workflows. (#47997)
• Repo-memory patch-size cap raised — Prevents Agent Performance Analyzer push failures on large diffs. (#48012, #48106)

📚 Documentation

• Added release workflow pattern instructions and strengthened compliance trigger guidance with non-technical persona examples.
• Consolidated developer specifications into a single instructions file (v9.22).
• Added GEO-compliant AI discovery endpoints to the docs site.
• Unbloated the artifacts and templating reference pages for easier scanning.

Generated by 🚀 Release · sonnet46 · 26 AIC · ⊞ 7.9K

---

What's Changed

• Add join handle for StartDockerImageDownload to bound goroutine lifecycle by @​pelikhan with @​Copilot in github/gh-aw#47974
• fix(cgo): remove workflow .md paths from CGO PR trigger; clarify CI action_required vs agentic AR by @​pelikhan with @​Copilot in github/gh-aw#47989
• Reduce duplicate issue creation between DeepReport and Code Quality task-mining workflows by @​pelikhan with @​Copilot in github/gh-aw#47998
• Reduce redundant PR diff/file-list API reads with head-SHA-aware prefetch caching in top review workflows by @​pelikhan with @​Copilot in github/gh-aw#47997
• Replace missing evaluator tools in Daily GitHub Docs SEO Optimizer with a Copilot SDK driver by @​pelikhan with @​Copilot in github/gh-aw#47984

... (truncated)

Commits

• bbb8042 Mitigate secret argv exposure and harden remote include write boundaries (#48...
• deb9bf6 Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pi...
• c0d6d98 Restore backward compatibility for single-target dispatch_workflow safe out...
• 1839a97 chore: move lint error messages step into own job (#48324)
• ed25333 Fix host build of gh-aw-wasm package (#48320)
• 16b3f49 Preserve HTTPS angle-bracket autolinks in safe-output sanitization (#48169)
• fedd3fc fix: P0 CI failures — empty-SHA cache entries and stale action pins (#48291)
• fd94a39 Run pre-install bootstrap steps before engine selection in add-wizard (#48301)
• 25ea149 fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs conf...
• 5de162b test: add t.Parallel() to compile_recovery_test.go (#48309)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)