Enable cloud-hypervisor agent runtime on eligible agentic workflows

[Copilot]

Opts a set of repository workflows into the Cloud Hypervisor preview microVM agent runtime by setting sandbox.agent.runtime: cloud-hypervisor.

sandbox:
  agent:
    runtime: cloud-hypervisor
    sudo: false

Changes

• Workflow frontmatter (11 files): added sandbox.agent.runtime: cloud-hypervisor to copilot-centralization-drilldown, copilot-centralization-optimizer, daily-github-docs-seo-optimizer, daily-go-test-parallelizer, daily-spending-forecast, daily-vulnhunter-scan, deepsec-security-scan, ponytail-reviewer, portfolio-analyst, purelock, security-review.
• Recompiled lock files: generated YAML now includes the KVM access grant, host preflight, and checksum-verified Cloud Hypervisor bundle provisioning steps, and drops the rootless AWF install and tool-cache mount.

Selection criteria

Candidates were filtered against the preview constraints in .github/aw/agent-runtime-instructions.md and pkg/workflow/sandbox_validation.go — excluded any workflow using tools.github.mode: gh-proxy, cli-proxy/integrity-reactions, enclaves:, legacy-security, allow-host-ports, runner.topology: arc-dind, self-hosted runners, or upstream-managed source: provenance. All selected workflows run on GitHub-hosted Ubuntu x86_64 with the default AWF v0.28.1, which satisfies AWFCloudHypervisorMinVersion.

Notably, most remaining workflows are ineligible because they import shared/gh.md or shared/meta-analysis-base.md, both of which enable gh-proxy mode.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[gh-aw-bot]

@copilot This branch has merge conflicts. Please run make merge-main to rebase/merge the latest base changes, resolve the conflicts cleanly, rerun the relevant validation, and then use the pr-finisher skill before handing the PR back to maintainers.

Run context: https://github.com/github/gh-aw/actions/runs/31896433106

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.01 AIC · ⌖ 5.84 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Enables the Cloud Hypervisor preview runtime for 11 eligible agentic workflows and recompiles their generated workflows.

Changes:

• Adds sandbox.agent.runtime: cloud-hypervisor.
• Adds KVM preflight and verified runtime provisioning.
• Updates AWF execution for the microVM runtime.

Show a summary per file

File	Description
.github/workflows/security-review.md	Enables Cloud Hypervisor.
.github/workflows/security-review.lock.yml	Recompiles runtime setup.
.github/workflows/purelock.md	Enables Cloud Hypervisor.
.github/workflows/purelock.lock.yml	Recompiles runtime setup.
.github/workflows/portfolio-analyst.md	Enables Cloud Hypervisor.
.github/workflows/ponytail-reviewer.md	Enables Cloud Hypervisor.
.github/workflows/ponytail-reviewer.lock.yml	Recompiles runtime setup.
.github/workflows/deepsec-security-scan.md	Enables Cloud Hypervisor.
.github/workflows/deepsec-security-scan.lock.yml	Recompiles runtime and Claude CLI setup.
.github/workflows/daily-vulnhunter-scan.md	Enables Cloud Hypervisor.
.github/workflows/daily-vulnhunter-scan.lock.yml	Recompiles runtime and Claude CLI setup.
.github/workflows/daily-spending-forecast.md	Enables Cloud Hypervisor.
.github/workflows/daily-spending-forecast.lock.yml	Recompiles runtime setup.
.github/workflows/daily-go-test-parallelizer.md	Enables Cloud Hypervisor.
.github/workflows/daily-go-test-parallelizer.lock.yml	Recompiles runtime setup.
.github/workflows/daily-github-docs-seo-optimizer.md	Enables Cloud Hypervisor.
.github/workflows/daily-github-docs-seo-optimizer.lock.yml	Recompiles runtime setup.
.github/workflows/copilot-centralization-optimizer.md	Enables Cloud Hypervisor.
.github/workflows/copilot-centralization-optimizer.lock.yml	Recompiles runtime setup.
.github/workflows/copilot-centralization-drilldown.md	Enables Cloud Hypervisor.
.github/workflows/copilot-centralization-drilldown.lock.yml	Recompiles runtime setup.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 22/22 changed files
• Comments generated: 0
• Review effort level: Balanced

[Copilot]

@copilot This branch has merge conflicts. Please run make merge-main to rebase/merge the latest base changes, resolve the conflicts cleanly, rerun the relevant validation, and then use the `pr-finis...

Ran make merge-main-equivalent steps (fetch/merge origin/main, build, recompile, fmt), resolved the single conflict in .github/workflows/portfolio-analyst.lock.yml, and verified make test-unit passes. Pushed in 44b90a6.

@copilot resolve the merge conflicts on this branch.

Merge conflicts resolved in 44b90a6 by merging origin/main and regenerating the conflicting lock file via make recompile.

[gh-aw-bot]

@copilot This branch still shows merge conflicts from GitHub's perspective. Please run make merge-main, resolve the conflicts cleanly, rerun the relevant validation, and then use the pr-finisher skill before handing the PR back to maintainers.

Run context: https://github.com/github/gh-aw/actions/runs/31897747771

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 29.8 AIC · ⌖ 7.03 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This branch still shows merge conflicts from GitHub's perspective. Please run make merge-main, resolve the conflicts cleanly, rerun the relevant validation, and then use the pr-finisher s...

The branch already contains all commits from main (merge-base equals origin/main HEAD at 6062cd2), and a local test merge against origin/main reports "Already up to date" with no conflicts. The PR's mergeable_state is blocked, not dirty, confirming there's no conflict — that's likely a required check/review gate rather than a merge conflict. No further merge action is needed.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.0