Skip to content

chore(deps): update github/gh-aw action to v0.88.7 - #8109

Open
release-workflows[bot] wants to merge 1 commit into
mainfrom
renovate/github-gh-aw-0.x
Open

chore(deps): update github/gh-aw action to v0.88.7#8109
release-workflows[bot] wants to merge 1 commit into
mainfrom
renovate/github-gh-aw-0.x

Conversation

@release-workflows

@release-workflows release-workflows Bot commented Feb 13, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
github/gh-aw action minor v0.43.18v0.88.7

Release Notes

github/gh-aw (github/gh-aw)

v0.88.7

Compare Source

🌟 Release Highlights

This release focuses on hardening logs tooling, tightening security around agent outputs and secrets, and polishing documentation.

✨ What's New
  • Smarter logs downloads: workflow logs can now be pruned with an oldest-run mode, remote workflow names are resolved automatically, and cache size diagnostics/pruning have been improved for concurrent downloads (#​59453, #​59454, #​59338, #​59336).
  • Safer agent workflows: workflows now fail fast when agents report incomplete work, keeping runs honest instead of silently succeeding (#​59316). Agent artifact packaging is now restricted to known files to reduce accidental data exposure (#​59334).
  • Repo-memory validation: disallowed files are now filtered out before validation/upload rather than failing the push downstream, making the repo-memory workflow more resilient (#​58120).
  • Flexible output mapping: aw.yml now supports wildcard mapping destination folders (#​59317).
  • Hardened OTLP handling: OTLP endpoints are now guarded against scheme-only authorization headers to prevent malformed configs from leaking credentials (#​59315).
  • More reliable provisioning: Node.js is now provisioned for external Copilot threat detection, and transient slash-command provenance checks are retried instead of failing outright (#​59314, #​59313).
  • Claude debug logs have been relocated outside the agent data directory to avoid interfering with agent output packaging (#​59450).
🐛 Bug Fixes & Improvements
  • Fixed Archie's nested Mermaid fences rendering incorrectly (#​59311).
📚 Documentation
  • Updated the glossary via the daily documentation scan (#​59429).
  • Corrected a claim about delegation control listener reachability in the enclaves docs (#​59310).
  • Clarified fallback issue paths for manual PR creation (#​56572).
  • Documented the Copilot org-billing tip opt-out (#​56564).

Generated by 🚀 Release · copilot · auto · 17 AIC · ⊞ 11.8K


What's Changed

Full Changelog: github/gh-aw@v0.88.6...v0.88.7

v0.88.6

Compare Source

🌟 Release Highlights

This release strengthens enclave TTL handling, expands gh aw logs with caching and audit capabilities, and lets teams enforce workspace-wide strict compilation.

⚠️ Breaking Changes
  • Workspace-wide strict mode (#​59253): repositories can now set strict: true at the top level of .github/workflows/aw.json to force strict compilation across all workflows — per-workflow strict: false opt-outs are rejected. Existing workflows relying on relaxed validation should confirm they pass strict checks before enabling this.
✨ What's New
  • Cached audit reports for gh aw logs (#​59270): gh aw logs --audit now generates per-run audit reports from already-downloaded data with no extra GitHub API calls, writing/reusing audit.json per run cache.
  • Full workflow-run metadata caching (#​59257): gh aw logs now fetches and caches the complete GitHub Actions run response (workflow path, repository, actor, run attempt, event, commit) as run.json, removing the need for separate gh api calls.
  • Selective log cache pruning (#​59049): gh aw logs --max-storage now reports cache usage per folder and selectively prunes the largest non-essential data from completed runs while preserving summaries, job metadata, and usage data.
🐛 Bug Fixes & Improvements
  • Fixed dynamic enclave TTL units (#​59290, #​59292): max_identity_ttl in the MCP gateway delegation envelope is now correctly emitted in seconds (matching the mcpg v0.4.17 wire contract), fixing an accidental encoding as nanoseconds. Fixes #​59258.
📚 Documentation
  • Weekly glossary scan added entries for the new logs storage budget and dynamic enclave delegation controller (#​59192).

Generated by 🚀 Release · copilot · auto · 19.5 AIC · ⊞ 11.8K


What's Changed

Full Changelog: github/gh-aw@v0.88.5...v0.88.6

v0.88.5

Compare Source

🌟 Release Highlights

This release brings new compiler capabilities for dynamic repository access control, expanded safe-output integrations, and better observability for workflow runs.

✨ What's New
  • Dynamic repository enclave policies — the compiler now supports dynamic enclave delegation, letting workflows request repository access policies at runtime instead of only at compile time (#​58880, #​59046).
  • Repository labels in aw.yml — extend your aw.yml configuration with repository labels for finer-grained workflow targeting (#​58796).
  • Trailing wildcards in aw.yml includes — include patterns now support trailing wildcards for more flexible file matching (#​58545).
  • Linear and Jira tools in safe-output prompts — safe-output prompts now expose Linear and Jira tooling directly (#​58599), and Azure DevOps work item status is now supported in the safe-output schema (#​58410).
  • Deterministic safe-output footers — safe outputs now include deterministic body footer templates for more consistent, auditable output (#​58841).
📊 Observability Improvements
  • GitHub Actions job metadata is now cached in logs output for faster log analysis (#​59039).
  • GitHub API rate limits are now reported in logs output (#​58793).
  • Privacy-preserving MCP call metrics are now included in usage artifacts (#​58834).
  • Truncated patch previews now report the emitted line count for clearer diagnostics (#​58408).
🐛 Bug Fixes & Improvements
  • Hardened Git revision argument handling against malformed input (#​58412).
  • Fixed IMP-004 $ref schema resolution (#​58411).
  • Fixed MCP Gateway routing in sandbox host-access mode (#​58595).
  • Preserved explicit HTTP schemes in AWF API proxy targets (#​58608).
  • Preserved setup-action PATH across privileged AWF startup (#​58625).
  • Restored the sandbox.agent: false opt-out (#​58693).
  • Handled GitHub reaction rate limits gracefully (#​58610).
🔧 Internal

The bulk of this release also includes extensive internal CI, model-configuration, and workflow-reliability maintenance across gh-aw's own agentic workflows (Codex model compatibility fixes, safe-output conformance hardening, and dead-code cleanups) — not covered in detail here as they don't affect end users of the gh aw CLI.

Generated by 🚀 Release · copilot · auto · 20.2 AIC · ⊞ 11.8K


What's Changed

Full Changelog: github/gh-aw@v0.88.4...v0.88.5

v0.88.4

Compare Source

🌟 Release Highlights

This release focuses on hardening the agentic firewall/network layer, improving CI reliability, and expanding project tooling support.

✨ What's New
  • Trusted enclave sensitivity support (#​58328) — adds finer-grained sensitivity controls for trusted enclave workflows.
  • DIFC policy generation for GitHub App workflows (#​58302) — automatically generates data-flow integrity/confidentiality policies for workflows authenticated via a GitHub App.
  • aw.json project support in the add command (#​58267) — makes it easier to add workflows into existing aw.json-based projects.
  • Daily Linear and Jira smoke issues workflow (#​58320) — adds scheduled smoke-testing coverage for Linear and Jira integrations.
🐛 Bug Fixes & Improvements
  • Fixed root-relative workflow paths in imported local manifests (#​58317).
  • Fixed Pi Anthropic routing through the firewall (#​58313).
  • Disabled OTLP export when authorization secrets are empty, avoiding noisy failed exports (#​58312).
  • Preserved setup-ruby PATH precedence inside the Agentic Workflow Firewall (AWF) (#​58311).
  • Prevented custom agent propagation to evals jobs (#​58314).
  • Fixed a zizmor 1.29 finding related to path parsing (#​58339).
  • Refreshed the CI Doctor upstream source revision (#​58341).
📚 Documentation
  • Updated quick-start references to point to repo-status (#​58309).
🔧 Internal
  • Various CI stability fixes for workflow markdown/lock drift and impacted Go tests (#​58385, #​58325).

Generated by 🚀 Release · copilot · auto · 16.8 AIC · ⊞ 11.8K


What's Changed

Full Changelog: github/gh-aw@v0.88.3...v0.88.4

v0.88.3

Compare Source

🌟 Release Highlights

This release focuses on package manifest composability, safer scheduled upgrades, and hardened release-time security scanning.

✨ What's New
  • Recursive package manifest importsaw.yml manifests can now compose subpackages via an imports field instead of duplicating file declarations, with cycle detection and unified install resolution across local and remote packages (#​58233). See the package manifest reference.
  • Pre-release auto-upgrades from aw.json — scheduled auto-upgrade workflows can now opt into pre-release gh-aw versions by passing validated CLI options (e.g. --pre-releases) declared in aw.json, with malformed or unsupported options rejected at generation time (#​58266).
🐛 Bug Fixes & Improvements
  • Fixed zero-valued input defaults being dropped — numeric safe-output input defaults of 0 were incorrectly treated as missing due to truthiness checks; defaults are now preserved with a nullish fallback, restoring correct behavior for type: number inputs with default: 0 (#​58291).
  • Hardened Windows Defender release scans — release binaries are now verified against the generated checksum manifest before scanning, the recurring Defender workflow can target an explicit release tag, scan reports are preserved on both success and failure, and checksum-valid detections are routed to a deduplicated security tracking issue instead of assuming a source fix (#​58115).
  • Bumped Agentic Workflow Firewall to v0.28.13 (#​58103).
  • Fixed the Codex JSONL parser dropping error/warning log items in step summaries (#​58195).
  • Fixed unsafe quoting in an import cycle error message (#​58189).
📚 Documentation
  • Updated package specifications for parser, repoutil, semverutil, and sliceutil (#​58209).

Generated by 🚀 Release · copilot · auto · 18.3 AIC · ⊞ 11.8K


What's Changed

Full Changelog: github/gh-aw@v0.88.2...v0.88.3

v0.88.2

Compare Source

🌟 Release Highlights

A focused patch release improving safe-output reliability and CI hygiene: call_workflow inputs no longer get dropped during samples replay, sample-coverage gaps are now surfaced as warnings, and AI credit budgets are validated more safely to close a CodeQL alert.

🐛 Bug Fixes & Improvements
  • Fixed call_workflow samples replay dropping workflow_name — ingestion previously stripped workflow_name/inputs for call_workflow safe outputs, causing the apply job to fail with "Workflow name is empty" (#​58113).
  • Added warnings for uncovered samples--use-samples compilation now warns when an enabled safe output has no samples: entries, so silent no-op replay runs are easier to catch (#​58112).
  • Hardened AI credit budget handling — the max AI credits expression moved from inline shell interpolation to step env:, with strict integer validation before configuring the AWF firewall budget, resolving a CodeQL code-injection alert (#​58116).

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

Generated by 🚀 Release · copilot · auto · 16.4 AIC · ⊞ 11.8K


What's Changed

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

v0.88.1

Compare Source

v0.88.0

Compare Source

🌟 Release Highlights

This release focuses on hardening the sandbox runtime, simplifying browser automation with a new Playwright CLI approach, and fixing dependency resolution for nested workflow imports.

⚠️ Breaking Changes
  • Removed built-in Playwright MCP support (#​57521). Browser automation now goes through the new Playwright CLI guidance instead of the bundled MCP server — update workflows that relied on the built-in Playwright MCP tool.
✨ What's New
  • Sandbox security settings replaced with runtime profiles (#​57692) — legacy sandbox security flags are now expressed as declarative runtime profiles, making sandbox configuration easier to reason about. See the sandbox reference.
  • Playwright CLI guidance and browser provisioning (#​57731, #​57691, #​57594) — new AWF-aware policy prompts, configuration, and a shared smoke test make it easier to provision and use Playwright safely from agentic workflows.
  • gh-aw-firewall v0.28.12 integration (#​57514) — pulls in attested Cloud Hypervisor artifacts for stronger supply-chain guarantees on the firewall image.
  • Operational value report evaluator and history (#​57503) — new tooling to evaluate and track the operational value of agentic workflow runs over time.
🐛 Bug Fixes & Improvements
  • Fixed dependency ordering and cycle detection for nested imports (#​57746) — resolves incorrect ordering and undetected cycles when shared workflow files import each other transitively. See the imports reference.
  • Codex custom tools now classified as invalid-model failures (#​57578) — clearer error reporting when Codex is configured with unsupported custom tools.
  • Fixed stale skill docs and repo-path guard (#​57579) for the action-based JS architecture.
  • Super-Linter restricted to Go modules (#​57465), reducing noise from linting unrelated file types.
  • Added a daily Windows Defender release scan (#​57768) to catch malware false positives early.

Generated by 🚀 Release · copilot · auto · 20.7 AIC · ⊞ 11.8K


What's Changed

Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from c42b1d6 to 2e684f8 Compare February 13, 2026 20:11
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.43.20 chore(deps): update github/gh-aw action to v0.43.21 Feb 13, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 2e684f8 to ee9d01e Compare February 13, 2026 22:10
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.43.21 chore(deps): update github/gh-aw action to v0.43.22 Feb 13, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from ee9d01e to ecda65f Compare February 14, 2026 02:59
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.43.22 chore(deps): update github/gh-aw action to v0.43.23 Feb 14, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from ecda65f to 0ab8e8b Compare February 14, 2026 22:06
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.43.23 chore(deps): update github/gh-aw action to v0.44.0 Feb 14, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 0ab8e8b to a9fbf11 Compare February 16, 2026 01:36
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.44.0 chore(deps): update github/gh-aw action to v0.45.0 Feb 16, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from a9fbf11 to 4a778e8 Compare February 16, 2026 22:08
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.0 chore(deps): update github/gh-aw action to v0.45.1 Feb 16, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 4a778e8 to e615234 Compare February 17, 2026 01:36
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.1 chore(deps): update github/gh-aw action to v0.45.2 Feb 17, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from e615234 to 19e5e59 Compare February 17, 2026 04:39
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.2 chore(deps): update github/gh-aw action to v0.45.3 Feb 17, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 19e5e59 to 7135245 Compare February 17, 2026 08:17
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.3 chore(deps): update github/gh-aw action to v0.45.4 Feb 17, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 7135245 to abab8e0 Compare February 17, 2026 18:21
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.4 chore(deps): update github/gh-aw action to v0.45.5 Feb 17, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from abab8e0 to be0c80f Compare February 17, 2026 23:09
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.5 chore(deps): update github/gh-aw action to v0.45.6 Feb 17, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from be0c80f to 62f4b32 Compare February 18, 2026 01:36
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.6 chore(deps): update github/gh-aw action to v0.45.7 Feb 18, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 62f4b32 to 60ef078 Compare February 18, 2026 06:26
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.45.7 chore(deps): update github/gh-aw action to v0.46.0 Feb 18, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 60ef078 to d35bed6 Compare February 18, 2026 20:14
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.46.0 chore(deps): update github/gh-aw action to v0.46.1 Feb 18, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from d35bed6 to d6b5920 Compare February 19, 2026 04:39
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.46.1 chore(deps): update github/gh-aw action to v0.46.2 Feb 19, 2026
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.47.1 chore(deps): update github/gh-aw action to v0.47.2 Feb 20, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from b2b4fe3 to be66276 Compare February 20, 2026 16:13
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.47.2 chore(deps): update github/gh-aw action to v0.47.3 Feb 20, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from be66276 to 7bb6e08 Compare February 20, 2026 21:06
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.47.3 chore(deps): update github/gh-aw action to v0.47.4 Feb 20, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 7bb6e08 to d345213 Compare February 21, 2026 00:27
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.47.4 chore(deps): update github/gh-aw action to v0.47.5 Feb 21, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from d345213 to cddd18c Compare February 21, 2026 02:57
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.47.5 chore(deps): update github/gh-aw action to v0.47.6 Feb 21, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from cddd18c to 314ac7c Compare February 21, 2026 03:48
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.47.6 chore(deps): update github/gh-aw action to v0.48.0 Feb 21, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 314ac7c to d8f76f8 Compare February 21, 2026 05:21
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.48.0 chore(deps): update github/gh-aw action to v0.48.1 Feb 21, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from d8f76f8 to bac0698 Compare February 21, 2026 18:09
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.48.1 chore(deps): update github/gh-aw action to v0.48.2 Feb 21, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from bac0698 to 3b1e802 Compare February 21, 2026 20:06
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.48.2 chore(deps): update github/gh-aw action to v0.48.3 Feb 21, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 3b1e802 to 84850c5 Compare February 22, 2026 06:18
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.48.3 chore(deps): update github/gh-aw action to v0.48.4 Feb 22, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 84850c5 to 63dd3c5 Compare February 22, 2026 16:08
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.48.4 chore(deps): update github/gh-aw action to v0.49.0 Feb 22, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 63dd3c5 to 8c30f9c Compare February 23, 2026 00:29
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.49.0 chore(deps): update github/gh-aw action to v0.49.1 Feb 23, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from 8c30f9c to e46061e Compare February 23, 2026 03:05
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.49.1 chore(deps): update github/gh-aw action to v0.49.2 Feb 23, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from e46061e to b2300f9 Compare February 23, 2026 07:27
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.49.2 chore(deps): update github/gh-aw action to v0.49.3 Feb 23, 2026
@release-workflows
release-workflows Bot force-pushed the renovate/github-gh-aw-0.x branch from b2300f9 to dcac731 Compare February 23, 2026 12:16
@release-workflows release-workflows Bot changed the title chore(deps): update github/gh-aw action to v0.49.3 chore(deps): update github/gh-aw action to v0.49.4 Feb 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants