chore(deps): update github/gh-aw action to v0.57.2#8109
Open
release-workflows[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update github/gh-aw action to v0.57.2#8109release-workflows[bot] wants to merge 1 commit intomainfrom
release-workflows[bot] wants to merge 1 commit intomainfrom
Conversation
c42b1d6 to
2e684f8
Compare
2e684f8 to
ee9d01e
Compare
ee9d01e to
ecda65f
Compare
ecda65f to
0ab8e8b
Compare
0ab8e8b to
a9fbf11
Compare
a9fbf11 to
4a778e8
Compare
4a778e8 to
e615234
Compare
e615234 to
19e5e59
Compare
19e5e59 to
7135245
Compare
7135245 to
abab8e0
Compare
abab8e0 to
be0c80f
Compare
be0c80f to
62f4b32
Compare
62f4b32 to
60ef078
Compare
60ef078 to
d35bed6
Compare
d35bed6 to
d6b5920
Compare
b2b4fe3 to
be66276
Compare
be66276 to
7bb6e08
Compare
7bb6e08 to
d345213
Compare
d345213 to
cddd18c
Compare
cddd18c to
314ac7c
Compare
314ac7c to
d8f76f8
Compare
d8f76f8 to
bac0698
Compare
bac0698 to
3b1e802
Compare
3b1e802 to
84850c5
Compare
84850c5 to
63dd3c5
Compare
63dd3c5 to
8c30f9c
Compare
8c30f9c to
e46061e
Compare
e46061e to
b2300f9
Compare
b2300f9 to
dcac731
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.43.18→v0.57.2Release Notes
github/gh-aw (github/gh-aw)
v0.57.2Compare Source
🌟 Release Highlights
This patch release improves agent self-awareness and polishes report readability in built-in reporting workflows.
✨ What's New
GITHUB_AW=truelets agents detect they're running inside a GitHub Agentic Workflow,GH_AW_PHASEidentifies whether it's the mainagentrun or adetection(threat detection) run, andGH_AW_VERSIONexposes the gh-aw compiler version. This enables agents to tag their output, adapt behavior, and integrate with observability tooling. 166 lock files have been recompiled to include these new variables. (#20382)🐛 Bug Fixes & Improvements
daily-secrets-analysisandcopilot-pr-merged-reportbuilt-in workflows now use correct header levels (no top-level#/##headings) and wrap verbose sections (e.g., Top 10 Secrets table, Merged PRs table, code generation metrics) in collapsible<details>blocks. Executive summaries and key findings remain always visible, reducing noise for readers scanning long reports. (#20376)For complete details, see CHANGELOG.
What's Changed
Full Changelog: github/gh-aw@v0.57.1...v0.57.2
v0.57.1Compare Source
🌟 Release Highlights
This release focuses on reliability and developer experience — fixing schema validation gaps, hardening the upgrade flow, improving failure diagnostics, and expanding cross-repo workflow capabilities.
✨ What's New
Cross-repo
workflow_callruntime imports — Workflows invoked viaworkflow_callfrom another repository now correctly check out the callee's.mdfiles at runtime, eliminatingERR_SYSTEM: Runtime import file not founderrors in cross-repo reuse scenarios. Includes asecrets: inheritsupport for reusable workflow call jobs. (#20301)Auto-upgrade on
gh aw upgrade—gh aw upgradenow automatically installs the latest extension version before compiling lock files, then relaunches the new binary transparently. Lock files no longer embed a stale version string after upgrading. (#20300)Richer failure issue diagnostics — Agent failure issues now include a universal copy-pasteable debug prompt for any coding agent (Copilot, Claude, Gemini, etc.), plus a new top-level
debug.mdentry point. A newreport-failure-as-issue: falsefrontmatter option lets you suppress failure issue creation per-workflow. Dedicated 📦 Patch Size Exceeded sections appear whenmax-patch-sizelimits are hit. (#20266, #20354)CLI flag consistency — Four commands gained missing flags to align with the rest of the CLI:
gh aw run --json,gh aw audit --repo,gh aw new --engine, andgh aw list --dir. (#20272)Non-agent job concurrency defaults — Non-agent job concurrency groups now default
cancel-in-progress: false, preventing accidental cancellation of setup or cleanup jobs during rapid pushes. (#20224)🐛 Bug Fixes & Improvements
max-patch-sizeschema fix — Thetools.repo-memoryJSON schema was missing themax-patch-sizeproperty, causing schema validation to reject valid frontmatter before compilation could process it. (#20309)pull_request_targetas PR context —create_pull_request_review_commentandtarget: "triggering"now correctly recognizepull_request_targetevents as valid PR context, fixingNot in pull request contexterrors. (#20268)gh aw auditno longer crashes on non-zip artifacts — Docker build artifacts and other non-zip formats are now skipped gracefully instead of aborting the entire audit report. (#20294)Improved Docker validation error messages — Docker-related validation failures now surface actionable guidance instead of opaque internal errors. (#20350)
📚 Documentation
Staged mode reference page — A dedicated
reference/staged-modepage covers enabling staged mode globally or per output type, the 🎭 preview format, per-type support table, and the recommended staged → review → enable adoption pattern. (#20269)Debugging prompts in authoring guides — Self-contained and Copilot-specific debugging prompts have been added to the authoring guides and
debug.mdto help diagnose workflow failures faster. (#20349)🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release:
@mnkieferfor [research] Overview of docs improver agents (#19836)For complete details, see CHANGELOG.
What's Changed
pull_request_targetas valid PR context increate_pull_request_review_commentby @Copilot in #20268gh aw upgradeto prevent stale version in lock files by @Copilot in #20300max-patch-sizemissing fromtools.repo-memoryJSON schema by @Copilot in #20309Full Changelog: github/gh-aw@v0.57.0...v0.57.1
v0.57.0Compare Source
🌟 Release Highlights
This release delivers a meaningful rename that clarifies the product model, a new concurrency primitive for fan-out workflows, and a focused round of reliability fixes across safe-outputs and developer tooling.
safe-inputsrenamed tomcp-scriptsThe
safe-inputsfrontmatter field has been renamed tomcp-scriptsthroughout the compiler, schema, documentation, and runtime to better reflect its purpose as a lightweight MCP Script host.Migration: Run the built-in codemod to update your workflows automatically:
All documentation, environment variables, log messages, and shared workflows have been updated accordingly. (#20115)
✨ What's New
concurrency.job-discriminatorfor fan-out workflowsA new
job-discriminatorfield in theconcurrencyfrontmatter block prevents concurrent fan-out runs from cancelling each other. When set, the expression is appended to compiler-generated job-level concurrency groups (agent,outputjobs), making each dispatch unique.This is especially useful for workflows invoked in batch — such as per-repository analysis jobs — where the default static concurrency group would cancel all-but-two concurrent runs. (#20190)
🐛 Bug Fixes & Improvements
Safe-Outputs reliability:
created_issue_*outputs now emitted correctly —created_issue_numberandcreated_issue_urlwere silently dropped after a successfulcreate-issueaction due to the handler manager never calling the emitter. Workflows gating on these outputs will now work as expected. (#20130)pull_request_targetevents now recognized as PR context — Safe-output operations usingtarget: "triggering"(e.g.,update-pull-request) were silently skipped or failed when triggered viapull_request_target. (#20198)GITHUB_TOKENto git CLI — Custom token sources are now wired into theGITHUB_TOKENenvironment variable forcreate-pull-requestandpush-to-pull-request-branchsteps involving cross-repo checkouts. (#19890)Tooling fixes:
gh aw healthnow finds workflow runs — Thepathfield was accidentally dropped from thegh run listquery, causing the.lock.ymlfilter to discard every run and always report "No workflow runs found". (#20221)::1:, domain-) were being counted as blocked requests. (#20137)/opt/gh-aw/actions/campaign_discovery.cjs, which is not a built-in module. (#20109)repo-memoryno longer fails on repos without a Wiki — The__GH_AW_WIKI_NOTE__placeholder inrepo_memory_prompt.mdis now correctly substituted whenwiki: trueis not set. (#20236)create-pull-requestintegerexpiresvalues now converted correctly — Integer values (e.g.,expires: 14) representing days were previously stored as-is instead of being converted to hours. (#20231)[aw] (workflow-name) failed. (#20146)Engine parity:
No-op runs:
safe-outputs. (#20229)📚 Documentation
gh aw logsmonitoring section and correctedskip-if-match/skip-if-no-matchYAML examples. (#20128)For complete details, see CHANGELOG.
What's Changed
safe-inputstomcp-scriptsby @Copilot in #20115pull_request_targetin PR context detection by @Copilot in #20198concurrency.job-discriminatorto prevent fan-out cancellations in job-level concurrency groups by @Copilot in #20190__GH_AW_WIKI_NOTE__placeholder not substituted when wiki is disabled by @Copilot in #20236New Contributors
Full Changelog: github/gh-aw@v0.56.2...v0.57.0
v0.56.2Compare Source
🌟 Release Highlights
This release focuses on reliability improvements across protected-file handling, setup CLI pinning, and cross-repo workflows — along with an upgrade to GitHub MCP server v0.32.0 and a new strict allowlist feature for protected-file protection.
✨ What's New
allowed-filesstrict allowlist for protected-file PR safe outputs (#20051) — You can now configure an explicit allowlist of files that are permitted in protected-file PRs. Any file outside the allowlist is blocked, giving teams tighter control over what agents can modify in sensitive branches.🐛 Bug Fixes & Improvements
workflowspermission is absent (#20106) — When an agent patch touches.github/workflows/files and the GitHub App lacksworkflowspermission,gh-awnow correctly creates a fallback review issue rather than silently failing.main(#20099) —create_pull_requestand related operations now query the repository's actual default branch, fixing failures in repos usingmaster,develop, or any non-maindefault.add-wizardcorrectly syncs working tree after PR merge (#20094) — Switching to the default branch after merging a wizard-created PR ensures workflow files are visible immediately, eliminating "workflow file not found" errors.setup-cliaction now respects pinned version input (#20081) — The action verifies the installed version matches the requested version aftergh extension install, falling back to a manual binary download if there's a mismatch.⚡ Performance
regexp.MustCompilecalls acrosspkg/cli,pkg/workflow, and the expression-validation hot path are now initialized once at startup rather than on every invocation, reducing allocation pressure in high-frequency compilation paths.🔧 Dependencies & Infrastructure
📚 Documentation
🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release:
@dsymefor Change to protected file not correctly using a fallback issue (#20103)For complete details, see CHANGELOG.
What's Changed
generateCustomJobToolDefinitiontosafe_outputs_config_generation.goby @Copilot in #20080allowed-filesstrict allowlist for protected-file protection on PR safe outputs by @Copilot in #20051Full Changelog: github/gh-aw@v0.56.1...v0.56.2
v0.56.1Compare Source
🌟 Release Highlights
This release focuses on reliability and correctness — fixing several subtle but impactful bugs in sandbox execution, bot identity matching, workflow compilation, and safe-output handling, alongside expanded documentation.
🐛 Bug Fixes & Improvements
Bot identity canonicalization —
on.botsallow-lists now correctly match GitHub App actors regardless of whether they appear asmy-appormy-app[bot]. Previously, the exact-string mismatch silently blocked activations. (#20059)AWF sandbox git identity — The first
git commitinside an AWF sandbox no longer fails with "Author identity unknown." Host Git identity environment variables are now injected into sandbox execution steps, preserving the caller's author/committer info. (#20056)dispatch-workflowcompile-order independence — Workflows that dispatch other workflows in the same compile batch no longer require a specific compilation order. Targets that exist as.mdfiles (without a pre-existing.lock.yml) are now accepted. (#20057)safe-outputs: failures now fail the workflow — When a safe-output handler returns
{success: false}, the step now callscore.setFailed()and exits non-zero. Previously, failures were only emitted as warnings and the workflow continued as successful. (#20055)Gateway log truncation fix — Log lines exceeding 64 KB in
gateway.jsonl(common with large AI tool call payloads) were silently truncated. Missingscanner.Buffer()calls have been added to prevent this. (#20074)Firewall analysis blocked domain display — The firewall log viewer now correctly shows the destination IP:port for iptables-dropped traffic instead of displaying
"-". (#20016)📚 Documentation
Docker-based MCP server configuration — The MCP server reference now covers running gh-aw as an MCP server via Docker, for environments where the
ghCLI is not installed locally. (#20053)Workflow status message style guide — A new
.github/aw/messages.mdestablishes consistent conventions for tone and emoji usage in safe-outputs status messages across all workflows. (#20052)Updated feature documentation and permissions reference cleanup. (#20020, #20003)
🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release:
@samuelkahessayfor safe-outputs: handler failures never escalated to core.setFailed() (#20035)@strawgatefor Agent sandbox git identity missing: first commit fails, then agent self-configures (#20033)@samuelkahessayfordispatch-workflowvalidation is compile-order dependent (#20031)@samuelkahessayforon.botsmatching is exact-string only and fails for(slug)vs(slug)[bot](#20030)For complete details, see CHANGELOG.
What's Changed
<slug>and<slug>[bot]match inon.botsby @Copilot in #20059Full Changelog: github/gh-aw@v0.56.0...v0.56.1
v0.56.0Compare Source
🌟 Release Highlights
This release brings meaningful quality-of-life improvements to workflow automation: smarter
add-wizardscheduling, better protection for critical files, and a proactive fix for repo-memory size failures — plus a notable security hardening for git authentication.✨ What's New
Schedule frequency picker in
add-wizard— When adding a scheduled workflow,gh aw add-wizardnow prompts you to choose a frequency (hourly, 3-hourly, daily, weekly, monthly, or custom cron). No more being locked to whatever schedule the upstream workflow shipped with. (#19709)Protected-files enforcement in safe outputs — Workflows can now declare
protected-filesto prevent agents from inadvertently modifying critical files (e.g.,AGENTS.md,.github/configs, runtime manifests). When a push attempts to touch a protected file, safe outputs surfaces a clear remediation message instead of silently failing or overwriting. (#19958)Early size validation for repo-memory — A new
push_repo_memoryMCP tool validates memory size before pushing, catching oversized payloads early and giving agents a chance to trim content rather than failing at upload time. (#19977)Remote workflow dependencies fetched on
gh aw add— When adding a workflow that usesdispatch-workflowdependencies or declaresresources,gh aw addnow automatically fetches and saves those assets locally. (#19965)🐛 Bug Fixes & Improvements
Security: git credentials no longer written to disk — Git authentication tokens are now passed as environment variables to the fetch subprocess rather than written to
.git/config. This closes a window where an attacker monitoring filesystem events (e.g., viainotify) could capture the token. (#19963)Cleaner first-run experience for repo-memory — Suppressed 5 spurious GitHub Actions error annotations that appeared on the first run of
push_repo_memory(wheregit fetch/git pullfailing is expected because the memory branch doesn't exist yet). (#19979)Clearer
compilecommand help text — Thegh aw compileshort description now explicitly states it converts.mdfiles to.lock.yml, removing a common source of confusion for new users. (#19988)📚 Documentation
permissions.mdreference (~18% shorter) by consolidating duplicate sections, fixing a broken callout, and correcting heading hierarchy — all technical content preserved. (#20003)🌍 Community Contributions
A huge thank you to the community members who reported issues resolved in this release:
@dsymefor repo-memory fails when memory exceeds allowed size (#19976)@dsymefor gh aw add-wizard for scheduled workflow should offer choice of frequencies (#19708)For complete details, see CHANGELOG.
What's Changed
Full Changelog: github/gh-aw@v0.55.0...v0.56.0
v0.55.0Compare Source
🌟 Release Highlights
This release sharpens the developer experience with smarter error messages, a more reliable
auditcommand, and automatic strict-mode enforcement for public repositories.✨ What's New
Automatic strict mode for public repositories — Lockdown validation now enforces
strict: trueautomatically for public repos, ensuring agentic workflows default to the safest configuration without requiring manual setup. (#19948)"Did you mean?" suggestions for permission typos — When a permission level is mistyped (e.g.,
riteinstead ofwrite), the compiler now surfaces a nearest-match suggestion for nested enum violations, making YAML configuration errors much faster to diagnose. (#19925)🐛 Bug Fixes & Improvements
gh aw auditnow surfaces##[error]annotations from flat log files — The audit command previously left theerrorsarray empty for failed runs when GitHub Actions stored logs in the flat per-job format (workflow-logs/{N}_{job_name}.txt). Error annotations are now correctly extracted regardless of log file layout. (#19923)CLI consistency fixes across 7 commands — A broken documentation URL in the
project newcommand and several medium/low severity inconsistencies surfaced by automated inspection have been resolved. (#19927)📚 Documentation
GITHUB_STEP_SUMMARYsupport in agent step summaries has been added. (#19928)For complete details, see CHANGELOG.
What's Changed
Full Changelog: github/gh-aw@v0.54.0...v0.55.0
v0.54.0Compare Source
🌟 Release Highlights
This release focuses on expanding workflow capabilities with Agent Package Manager support and broader temporary ID coverage, while hardening security and improving reliability for public repository workflows.
✨ What's New
Agent Package Manager (APM) support — Workflows can now declare
microsoft/apmdependencies directly in frontmatter. The compiler emits a SHA-pinnedmicrosoft/apm-actionstep to install packages before agent execution, making it easier to manage agent dependencies declaratively.Temporary IDs for all project operations —
#aw_*temporary IDs are now supported across all project-related safe outputs, enabling cross-references between operations within the same workflow run.Engines always use latest versions — Agentic engines (Copilot, Claude Code, Codex, Gemini) now bind to
"latest"instead of pinned versions, ensuring workflows automatically benefit from the newest AI capabilities without manual version bumps. CLI versions in this release: Claude Code 2.1.70, Copilot CLI 0.0.422, Codex 0.111.0.🐛 Bug Fixes & Improvements
Fixed
gh aw addauth failure for public repos — ThedownloadFileFromGitHubWithDepthfunction now falls back to git/raw-URL when REST client creation fails with an auth error, resolving failures when adding workflows from public repositories in agentic contexts.Security: Go module cache disabled in agentic setup — The
actions/setup-gostep now runs withcache: falsein agentic workflows, closing a potential cache poisoning vector via prompt injection. This mirrors the existing mitigation already in place for Node.js.📚 Documentation
For complete details, see CHANGELOG.
What's Changed
gh aw addauth failure for public repos in agentic workflows by @Copilot in #19853Full Changelog: github/gh-aw@v0.53.6...v0.54.0
v0.53.6Compare Source
🌟 Release Highlights
This is a focused patch release that resolves a long-standing step summary truncation issue affecting all AI engines, alongside a documentation improvement and an internal test reliability fix.
🐛 Bug Fixes & Improvements
GITHUB_STEP_SUMMARYinto the sandbox for all engines (Copilot, Codex, Claude, Gemini), ensuring agents can write meaningful summaries without silent data loss. (#19821)📚 Documentation
🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release:
@danielmeppielfor Step summary truncates agent output at 500 chars with no visible warning (#19810)For complete details, see CHANGELOG.
What's Changed
namesfield by @Copilot in #19843Full Changelog: github/gh-aw@v0.53.5...v0.53.6
v0.53.5Compare Source
🌟 Release Highlights
This release focuses on reliability improvements for label-trigger workflows and GitHub App token handling, plus new capabilities for repo memory and the
add_commentsafe output tool.✨ What's New
GitHub Wiki backing for
repo-memory— Therepo-memoryfrontmatter now supports awiki: trueflag to use a repository's GitHub Wiki git backend as persistent memory storage, following GitHub Wiki markdown conventions. (#19800)Temporary ID support in
add_comment— Theadd_commentsafe output tool now acceptstemporary_id, enabling cross-referencing of not-yet-created comments within the same workflow run. (#19737)/aceslash command workflow — A new built-in workflow responds to/acein PR comments, generates ACE editor session URLs, and posts a reply linking teammates to a collaborative editing session. (#19741)🐛 Bug Fixes & Improvements
Label trigger shorthand now correctly filters by label name — Workflows using
on: pull_request labeled my-labelwere firing on anylabeledevent due to a Go type mismatch ([]stringvs[]any). The activation job'sif:clause now correctly includes thegithub.event.label.namecondition. (#19824)Label trigger shorthand wires
item_numberfor manual dispatch — The compileConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.