Skip to content

Update github/gh-aw action to v0.80.9#73

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-minor-patch
Open

Update github/gh-aw action to v0.80.9#73
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
github/gh-aw action minor v0.77.5 → v0.80.9 v0.82.0 (+1)

Release Notes

github/gh-aw (github/gh-aw)

v0.80.9

Compare Source

🌟 Release Highlights

This release focuses on reliability and correctness — squashing noisy error conditions in the MCP server and agentic workflows, hardening security, and keeping the observability pipeline complete.

🐛 Bug Fixes & Improvements

  • MCP stdio error handling — handleMessage now correctly serialises plain-object throws (not just Error instances), eliminating the cryptic -32603 [object Object] failures that blocked submit_pull_request_review on the stdio transport path. (#​40715)

  • Issue Monster noise reduction — Agent-availability errors ("copilot coding agent is not available for this repository") are now treated as transient and silently skipped, so the issue tracker is no longer spammed with failure issues on every 30-minute poll cycle. (#​40716)

  • Observability report completeness — The daily observability report now explicitly requests agent and detection artifact sets alongside usage metrics, preventing incomplete/noop outcomes caused by missing telemetry inputs. (#​40705)

  • Task session data fetch — Fixed a failing agent GitHub Actions job caused by a stale data-fetch pattern in task session handling. (#​40728)

🔒 Security
  • Atomic temp-file writes — Replaced direct fs.writeFileSync calls in the safe-output evaluations script with an atomic write helper, closing a CWE-377 insecure-temporary-file vulnerability flagged by CodeQL. (#​40721)
🔧 Internal

  • Safe Outputs conformance checker — Added MCE-006 check verifying that mcp_server_core.cjs enforces valid JSON-RPC 2.0 error codes (spec §8.2); split spec/script version comments for clarity. (#​40737)

  • Maintenance workflow header — agentics-maintenance.yml now carries an explicit, purpose-specific header describing the maintenance schedule and how to disable it, replacing the generic compiled-workflow boilerplate. (#​40706)

Generated by 🚀 Release · 31.3 AIC · ⊞ 8.2K

What's Changed

Full Changelog: github/gh-aw@v0.80.8...v0.80.9

v0.80.8

Compare Source

🌟 Release Highlights

This release brings a meaningful performance win, improved slash-command UX, a new Go linter, and a wave of reliability and documentation improvements.

⚡ Performance
  • Fixed a +320% regression in CompileComplexWorkflow by eliminating a redundant yaml.Unmarshal call — complex workflows now compile as fast as expected (#​40662).
✨ What's New
  • Slash-command status comments are now created in the central router and reused downstream, giving users consistent, real-time feedback on slash-command progress (#​40644).
  • New deferinloop Go linter flags defer statements inside for-loop bodies — a common source of resource-leak bugs — catching issues earlier in the development cycle (#​40679).
  • gh-aw-detection rolled out to 50% of agentic workflows, expanding coverage of automated workflow health checks (#​40698).
  • Daily Safe Output Integrator can now inspect compiler safe-output tests, broadening daily CI coverage (#​40697).
  • Codex experiment models are now available in the Daily Cache Strategy Analyzer (#​40682).
🐛 Bug Fixes
  • Prevented tool-denial cascade in daily-formal-spec-verifier, avoiding runaway failures when individual tools are unavailable (#​40655).
  • Fixed sparse checkout path typing in the Skillet pre-activation skills checkout, resolving failures in sparse-repo workflows (#​40684).
  • Migrated assignAgentToIssue to REST, retaining GraphQL fallbacks in lookup helpers for resilience (#​40669).
  • Replaced SHA-256 with FNV-1a for heredoc delimiter generation, eliminating crypto-library overhead in hot compilation paths (#​40696).
  • Reduced ambient prompt surface in high-traffic workflows, improving token efficiency and reducing unintended context bleed (#​40695).
📚 Documentation
  • Leaner model-tables intro in the docs (#​40658).
  • Fixed broken outbound links in the README (#​40675).
  • Tightened authoring guidance for incident prefetch/dedup and visual baseline sourcing (#​40660).
  • Extended JSON-LD schema to blog posts and inner pages for improved SEO (#​40678).

Generated by 🚀 Release · 31.7 AIC · ⊞ 8.2K

What's Changed

Full Changelog: github/gh-aw@v0.80.7...v0.80.8

v0.80.7

Compare Source

🌟 Release Highlights

v0.80.7 brings powerful new automation options, compiler safety guardrails, and a set of targeted bug fixes that improve reliability across workflows, CLI tools, and the safe-outputs system.

⚠️ Breaking Changes
  • allow-team-members renamed to allowed-collaborators in safe-outputs.mentions (#​40394)
    Run gh aw fix --write with codemod add-allow-team-members-collaborators to migrate automatically.
✨ What's New
  • Auto-upgrade workflow generation: Set auto_upgrade: true in aw.json to automatically generate a weekly agentic-auto-upgrade.yml workflow that keeps your setup current (#​40414).
  • Auto-pin unversioned action refs: The compiler now auto-pins unversioned uses: references and fails compilation when no pin is resolvable — preventing silent runtime failures (#​40475).
  • allowed-teams in mentions config: Authorize entire GitHub teams to trigger agentic mentions without enumerating every user (#​40368).
  • Wildcard suffix for slash_command: Use a trailing * to match a family of related commands with a single workflow (#​40369).
  • max-turn-cache-misses top-level field: Configure cache-miss guardrail thresholds directly in workflow frontmatter (#​40388).
  • code_quality MCP toolset: The code_quality toolset is now mapped in GitHub MCP toolsets configuration (#​40625).
🐛 Bug Fixes & Improvements
  • Call-workflow permissions: Job permissions are now correctly derived from the caller, not the worker (#​40175 — thanks @dsyme!).
  • gh aw logs reliability: Fixed context-deadline cancellation for --timeout (#​40498) and added a --report-file flag to avoid shell redirect failures (#​40425).
  • Idle-timeout resolved as success: When output has been collected and all tools are complete, idle-timeout no longer marks a run as failed (#​40419).
  • set_issue_field temporary ID resolution: set_issue_field can now resolve temporary_id values from a create_issue in the same batch (#​40615).
  • Firewall-mode LLM routing: All LLM traffic in firewall mode is now correctly routed through the AWF gateway (#​40616).
  • Improved error guidance: Empty-arguments errors now include schema guidance to prevent missing-tool reports (#​40542); hide_comment validation surfaced GraphQL node ID guidance (#​40361).
  • Template-injection scanner: Fixed false positive that rejected the compiler's own generated Configure Git credentials step (#​40613).
  • /help command: Fixed routing fallthrough, error handling, reactions, and mention sanitization (#​40476).
📚 Documentation
  • CLI setup guide streamlined for clarity (#​40484, view docs).
  • allowed-teams option surfaced in the agentic mentions configuration docs (#​40421).
  • /help now uses structured headings and links commands to their source workflows (#​40500).

Generated by 🚀 Release · 41.4 AIC · ⊞ 8.2K

What's Changed

Full Changelog: github/gh-aw@v0.80.6...v0.80.7

v0.80.6

Compare Source

🌟 Release Highlights

v0.80.6 focuses on safe-outputs reliability, GHES host support, and new agentic workflow capabilities — with dozens of targeted fixes that make credential handling, asset uploads, and compilation more robust.

✨ What's New
  • Headroom context compression — A new shared agentic workflow compresses agent context when headroom is low, reducing token burn for long-running workflows. (#​40223)
  • Tool output previews in Copilot CLI — The conversation renderer now shows inline previews of tool outputs, making it easier to follow what an agent did at a glance. (#​40116)
  • AWF reflect summary surfaced to GitHub Actions — awf reflect output is now written to core.info, making reflection results visible in the Actions run log without extra steps. (#​40069)
  • Auto-detect GHES host in compile — gh aw compile now automatically detects GitHub Enterprise Server hosts, so GHES users no longer need manual host configuration for correct repo validation. (#​40030)
  • Cached owner-type API call — The compiler now caches the repository owner-type lookup once per compilation run, eliminating redundant API calls on large workflows. (#​40258)
  • gh aw init aligned to Copilot MCP schema — The MCP suggestion emitted by gh aw init now matches the official .github/mcp.json schema used by GitHub Copilot. (#​40327)
  • External threat-detect binary — Threat detection has migrated to an external threat-detect binary behind a feature flag, improving isolation and upgrade flexibility. (#​40166)
🐛 Bug Fixes & Improvements

Safe-outputs & credential handling:

  • Fixed git credential loss in safe_outputs job checkouts — credentials are now reliably preserved throughout the job. (#​40161, #​40147)
  • Fixed duplicate Authorization header (HTTP 400) on git operations in push_to_pull_request_branch. (#​40281)
  • Checkout manifest relocated into safeoutputs/ so the containerized safe-outputs MCP server can read it. (#​40025)
  • Cross-repo checkout directories from the manifest are now trusted, resolving dubious-ownership errors. (#​40080)
  • Base branch is now validated with git check-ref-format before use in safe-outputs jobs. (#​40001)
  • Corrected stale 1 MB default for safe-outputs max-patch-size in schema and derived files. (#​39999)
  • Added configurable URL sanitization policy for code-region-safe suggestion handling. (#​39927)

Compilation & workflow correctness:

  • Fixed compiler incorrectly passing undeclared payload inputs for call-workflow steps. (#​40154)
  • Fixed invalid YAML generated for GitHub App token checkout steps in safe_outputs jobs. (#​40301)
  • Fixed actions-lock.json accumulating orphaned entries on full compile. (#​39905)
  • Added regression guard to ensure deterministic actions-lock.json key ordering. (#​40324)
  • Enforced non-empty dispatch_workflow names across safe-output schema and MCP registration. (#​40315)

Asset uploads & authentication:

  • upload_assets now resolves staged assets via a single GH_AW_ASSETS_DIR, fixing a path mismatch between RUNNER_TEMP and /tmp. (#​40122, #​40062)
  • Added fallback to unauthenticated GitHub API when a SAML-enforced token blocks requests. (#​40250)
  • push_repo_memory now seeds new memory branches via the GitHub API to satisfy signed-commit requirements. (#​40188)

Observability & reliability:

  • Fixed stdout/stderr interleaving in mcp_cli_bridge for large outputs. (#​40037)
  • Token usage table is now rendered to core.info in the parse_token_usage step for better visibility. (#​40227)
  • Improved Copilot harness classification for opaque exitCode=1 failures. (#​39959)
  • Improved Copilot 403 auth guidance for copilot-requests mode. (#​40052)
⚡ Performance
  • Memory efficiency — Replaced 187 map[string]bool sets with map[string]struct{} across the codebase, reducing allocations throughout the compiler and runtime. (#​39954)
🔍 Code Quality & Linting
  • errstringmatch linter extended to cover HasPrefix, HasSuffix, EqualFold, Index, LastIndex, and Compare — catching more brittle error-string comparisons. (#​40248)
  • New linter detects bare discarded json.Marshal/json.Unmarshal calls. (#​39993)
  • Hardened OpenTelemetry compatibility contract. (#​40006)

Generated by 🚀 Release · 40.8 AIC · ⊞ 8.2K

What's Changed

Full Changelog: github/gh-aw@v0.80.5...v0.80.6

v0.80.5

Compare Source

v0.80.4

Compare Source

🌟 Release Highlights

This release delivers a focused wave of reliability improvements, infrastructure hardening, and safe-outputs enhancements — making your agentic workflows more robust and predictable.

✨ What's New
  • merge-pull-request schema parity (#​39767) — The merge-pull-request safe-output now supports samples and cross-repo targeting, bringing it to full feature parity with other safe-output operations.
  • GHES-friendly action pinning (#​39908) — gh aw no longer applies its hardcoded action-pin fallback when GH_HOST targets a non-github.com host, removing friction for GitHub Enterprise Server users.
  • Cleaner UX for personal repos (#​39923) — The copilot-requests onboarding tip is now suppressed for individual (non-org) repository owners, reducing noise where it doesn't apply.
🐛 Bug Fixes & Improvements
  • Fixed phantom asset failures (#​39900) — Aligned the safe-outputs staging path with RUNNER_TEMP to eliminate spurious asset-not-found errors.
  • Fixed MCP container tmp access (#​39950) — Added the /tmp/gh-aw bind mount to the safeoutputs MCP container so tools that write there during workflow runs work correctly.
  • Fixed assign-to-agent mutations (#​39941) — Corrected the GraphQL mutations used to assign issues to agents, following the official API docs.
  • Fixed silent add_comment skips (#​39926) — add_comment no longer silently no-ops when the integration token lacks discussion write permissions; the error is now surfaced clearly.
  • Fixed SDK driver timeouts (#​39933) — Increased sendAndWait timeout in sample SDK drivers from 60 s to 10 min, preventing premature failures on longer agent tasks.
  • Fixed null-byte corruption in step summaries (#​39910) — Stripped null bytes from gateway.md before writing to the step summary to prevent rendering errors.
  • Fixed unintended dependabot.yml writes (#​39909) — gh aw no longer modifies dependabot.yml unless the --dependabot flag is explicitly passed.
  • Hardened PR Sous Chef emission path (#​39951) — Reinforced the safe-output emission path for PR Sous Chef to prevent dropped outputs under edge-case conditions.
  • Isolated SDK driver test state (#​39940) — copilot_sdk_driver tests now write session state in isolation, eliminating false-positive tool-denial failures.
📚 Documentation
  • Terminology update (#​39913) — Renamed "Copilot Skills" → "Skills" throughout the custom-agent-for-aw reference to align with current product naming.

Generated by 🚀 Release

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/github-actions-minor-patch branch from 99cfdb9 to 1edcb8f Compare June 22, 2026 03:55
@renovate renovate Bot changed the title Update github-actions non-major dependencies to v0.79.9 Update github-actions non-major dependencies to v0.80.5 Jun 22, 2026
@renovate renovate Bot changed the title Update github-actions non-major dependencies to v0.80.5 Update github-actions non-major dependencies Jun 22, 2026
@renovate renovate Bot force-pushed the renovate/github-actions-minor-patch branch from 1edcb8f to b33317f Compare June 25, 2026 07:34
@renovate renovate Bot changed the title Update github-actions non-major dependencies Update github/gh-aw action to v0.80.9 Jun 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants