Update github/gh-aw action to v0.81.6 - #29115
Conversation
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
github-actions
Bot
added
the
dependencies
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx run @tryghost/admin-x-settings:test:acceptance |
✅ Succeeded | 10m 31s | View ↗ |
nx run ghost:test:ci:integration |
✅ Succeeded | 4s | View ↗ |
nx run ghost:test:integration |
✅ Succeeded | 2m 48s | View ↗ |
nx run ghost:test:legacy |
✅ Succeeded | 2m 37s | View ↗ |
nx run ghost:test:e2e |
✅ Succeeded | 2m 25s | View ↗ |
nx run-many --target=build --projects=tag:publi... |
✅ Succeeded | <1s | View ↗ |
nx run @tryghost/activitypub:test:acceptance |
✅ Succeeded | 45s | View ↗ |
nx run @tryghost/comments-ui:test:acceptance |
✅ Succeeded | 42s | View ↗ |
Additional runs (7) |
✅ Succeeded | ... | View ↗ |
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗
☁️ Nx Cloud last updated this comment at 2026-07-05 16:53:42 UTC
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #29115 +/- ##
==========================================
- Coverage 74.27% 74.27% -0.01%
==========================================
Files 1565 1565
Lines 135716 135716
Branches 16457 16450 -7
==========================================
- Hits 100805 100802 -3
- Misses 33885 33886 +1
- Partials 1026 1028 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This PR contains the following updates:
v0.79.9→v0.81.6Release Notes
github/gh-aw (github/gh-aw)
v0.81.6Compare Source
🌟 Release Highlights
This release focuses on stability and observability — restoring broken fleet-wide token tracking, hardening CI quality gates, and adding release traceability for merged PRs.
✨ What's New
.github/aw/loop.mdcodifies patterns from autoloop, goal, and crane into a unified reference for building robust agentic loops (#41833).benchstat, preventing silent performance regressions from merging (#41813).🐛 Bug Fixes & Improvements
TokenUsagehad been reporting0across the entire fleet since June 20 due to two co-conspirating bugs in the conclusion job. Both are fixed, restoring accurate AI credit tracking (#41823).govulnchecktogo.modversion — CI vulnerability scans now use the exact version declared ingo.modand produce reproducible SARIF reports. A localmake vuln-sariftarget is also available (#41815).🔧 Internal
pkg/workflowandpkg/cliinto focused, testable units (#41800).What's Changed
.github/aw/loop.mdplaybook synthesizing loop-engineering patterns from autoloop/goal/crane by @pelikhan with @Copilot in #41833Full Changelog: github/gh-aw@v0.81.5...v0.81.6
v0.81.5Compare Source
🌟 Release Highlights
This release focuses on org-mode maturity, performance optimizations, and sandbox hardening — making
gh aw update/upgrade --orgmore robust and production-ready while delivering meaningful speed improvements across the compiler and validator.✨ What's New
Action-pin mapping in
aw.json(#41579) — Define action-pin overrides directly in youraw.jsonconfiguration, giving you centralized control over pinned action versions.manifest-versionnow optional inaw.yml(#41687) — Reduces boilerplate in new workflow files; the field is inferred when omitted.Non-TTY fallback for
gh aw addwizard (#41717) — The interactive add wizard now gracefully falls back to text prompts in non-interactive environments (CI, scripts), unblocking automation pipelines.Org-mode improvements for
update/upgrade --org(#41617, #41627, #41719) — Workflow-targeted updates, repo prefiltering, version-tag display, unified repo discovery, and per-repo confirmation prompts (with--yesfor CI). The--orgflag is now significantly more useful for managing fleets of repositories.Sandbox hardening at 50% baseline (#41786) — Half of all eligible agentic workflows now run with
sandbox.agent.sudo: false, reducing the blast radius of runaway agent steps.Daily detection analysis report workflow (#41802) — New built-in workflow that generates automated detection analysis reports.
⚡ Performance
sync.Onceso permission data is only read when needed.applySanitizePattern(#41762) — Eliminates repeated regex compilation on hot code paths.ParseWorkflow(#41772) — Model-alias cycle detection overhead reduced.🐛 Bug Fixes & Improvements
push_to_pull_request_branch(#41654) — Fixes a regression where agent-provided branch names were rejected..github/paths are now resolved as repo-root-relative in nested bundle manifests.GH_AW_POLICY_STRICTenforced at runtime (#41682) — Non-strict compiled workflows now properly respect the strict policy flag at runtime.📚 Documentation
gh aw envgovernance guide (#41758) — New documentation covering defaults and scope inheritance for environment configuration.What's Changed
gh aw update --orgto support workflow-targeted updates and repo prefiltering by @pelikhan with @Copilot in #41617GH_AW_POLICY_STRICTat runtime for non-strict compiled workflows by @pelikhan with @Copilot in #41682messagefield with actionable guidance when no runs found by @pelikhan with @Copilot in #41693BannerStyleand standardizingShowWelcomeBannerby @pelikhan with @Copilot in #41716--yesCI bypass by @pelikhan with @Copilot in #41719gh aw envdefaults and scope inheritance by @pelikhan with @Copilot in #41758add_labelsREST payload behind feature flag by @pelikhan with @Copilot in #41725pr-finisherin Copilot nudge by @pelikhan with @Copilot in #41768deploy --orgto run through shared org runner by @pelikhan with @Copilot in #41761sync.Onceby @pelikhan with @Copilot in #41755pkg/consolehelpers across six commands by @pelikhan with @Copilot in #41773.github/paths as repo-root-relative in nested bundle manifests by @mnkiefer with @Copilot in #41790Full Changelog: github/gh-aw@v0.81.4...v0.81.5
v0.81.4Compare Source
🌟 Release Highlights
This release focuses on reliability, performance, and new operational capabilities — fixing silent failures across the compiler and agent harnesses, reducing wasted credits on hot paths, and adding important new tooling.
✨ What's New
--orgflag forupgradecommand (#41335) — Theupgradecommand now supports--organd--reposflags, matching the org-wide mode already available inupdate. Bulk-preview or open upgrade PRs across an entire organization with a single command.Daily YAML Lint Fixer workflow (#41574) — A new agentic workflow automatically fixes yamllint violations in generated
*.lock.ymlfiles, keeping CI lint checks clean without manual intervention.AWF Firewall startup failure detection (#41472) — Firewall proxy startup failures (e.g., DNS not yet resolving at probe time) are now detected and surfaced in the agent failure issue — making previously silent infra failures immediately actionable.
Spec-driven
engine.envallowlist (#41465) — The engine environment variable allowlist is now derived fromGetSupportedEnvVarKeysrather than a fragile runtime heuristic, enablingstrict: falseto be safely removed from smoke workflows.Copilot engine launched from
${GITHUB_WORKSPACE}(#41459) — The Copilot engine now starts from the workspace root, enabling APM skill discovery for context-aware agent behaviour.🐛 Bug Fixes & Improvements
Silent YAML parse errors fixed (#41577) — Five
yaml.Unmarshalcall sites inworkflow_builder.gowere silently discarding errors, producing empty step lists on malformed YAML with no diagnostic. All errors now propagate correctly.Copilot SDK hang bounded by idle watchdog (#41572) — After an agent's final tool result,
sendAndWaitcould hang indefinitely until the step timeout killed the runner. A post-completion idle watchdog now bounds this wait, preventing wasted runner minutes.Codex harness no longer drains tokens on rate-limit reconnects (#41385) — When Codex hit a TPM rate limit and exhausted reconnect retries, the harness kept retrying unnecessarily. It now recognises exhausted-reconnect exits and stops, preserving credits.
Claude harness stops retrying on
max_runs_exceeded(#41361) — Fresh-run fallbacks no longer burn the full quota when a session has already hit its 20-invocation limit.Issue Monster false-positive 429 detection eliminated (#41471) — Rate-limit false positives no longer trigger spurious failure handling.
assign_to_agentno longer posts error comments on PRs (#41475) — Error comments are now only posted to issues, matching expected behaviour.Daily schedule runs restored (#41362) — Daily schedule runs broken since June 5 are now fixed.
workflow_callpermissions use union of caller + worker (#41387) — Importedworkflow_callpermissions in generated call jobs are now correctly annotated.⚡ Performance
YAML generation is faster (#41333) — Duplicate run-script scans in the skip-validation fast path collapsed to a single pass, restoring compilation performance.
Design Decision Gate costs reduced (#41332) — Now defaults to Sonnet instead of Opus and skips issue lookups on no-op paths, meaningfully reducing AI credit consumption per run.
🔒 Security
Safe-output detection hardened (#41547) — Detection stays in warn mode on parser/agent failures, ensuring non-reviewable safe outputs are blocked rather than passed through silently.
Pi threat-detection model normalisation (#41545) — Pi threat-detection models are now normalised before Copilot fallback, preventing misclassification due to model name variance.
🔧 Internal
updateandupgradecommands (#41553)What's Changed
2026062.220.1 by @github-actions[bot] in #41373sandbox.agent.sudo: falseusage to policy target across agentic workflows by @pelikhan with @Copilot in #41463${GITHUB_WORKSPACE}to enable APM skill discovery by @pelikhan with @Copilot in #41459Full Changelog: github/gh-aw@v0.81.3...v0.81.4
v0.81.3Compare Source
🌟 Release Highlights
This release focuses on expanded automation reach with org-wide update management, greater expressiveness through GitHub Actions expression support in more places, and a round of critical fixes across Windows, rootless installs, and assignee resolution.
sandbox.agent.network-isolationrenamed tosandbox.agent.default-routeThe frontmatter key
sandbox.agent.network-isolationhas been renamed tosandbox.agent.default-route(#41302). Update any workflows using this key to use the new name.✨ What's New
gh aw update— Rungh aw updateacross an entire org with dry-run PR previews before applying changes, making fleet-wide workflow upgrades safer and more auditable (#41247).safe-outputs.stagedvalues —safe-outputs.stagednow accepts GitHub Actions expressions (${{ ... }}), enabling dynamic output values at workflow runtime (#41296).link-sub-issueaccepts GitHub expressions — Theallowed-reposfield inlink-sub-issuenow supports GitHub Actions expressions for more flexible cross-repo linking (#41237).ready_for_reviewtrigger support —pull_request_targetworkflows can now trigger on theready_for_reviewevent, enabling automation when draft PRs are marked ready (#41161).gh aw trial—gh aw trial --clone-reponow correctly honors theGH_HOSTenvironment variable for GHES environments (#41159).sudoavailable by default, unblocking common agent install patterns (#41313).sudofrom generated lock files; bundled firewall and MCP gateway updated (#41269).⚡ Performance
gh aw auditnow runs analysis tasks in parallel, significantly reducing latency for long-running workflows (#41185).🐛 Bug Fixes
gh awto crash on startup on Windows (#41235).gh awinstalls correctly into$HOME/.localwithout root and properly exports$GITHUB_PATHin rootless environments (#41310).UpdateContainerPinsno longer wipes containers — Fixed a regression wheregh aw updateerased the entirecontainerssection on every run (#41262).set_issue_typemigrated to REST API — Replaced the GraphQL-basedset_issue_typesafe output with a single REST call for better reliability (#41241).lenstringsplitfalse positives with empty separators andctxbackgroundfalse negatives in closures are resolved (#41188, #41187).📚 Documentation
What's Changed
python-datavizimports from daily reporting workflows by @pelikhan with @Copilot in #41158ready_for_reviewforpull_request_targettriggers by @pelikhan with @Copilot in #41161issue_intents.cjsfalse positive by @pelikhan with @Copilot in #41182Configuration
📅 Schedule: (in timezone Etc/UTC)
* * * * 0,6)* 23 * * 1-5)* 0-4 * * 1-6)* * * * 0,6)* 23 * * 1-5)* 0-4 * * 1-6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.