v0.82.8

🌟 Release Highlights

This release brings substantial quality and reliability improvements across the compiler, linters, CLI tooling, security architecture, and documentation — with particular focus on ARC/DinD self-hosted runner support and safe-outputs robustness.

✨ What's New

• gVisor container runtime support — Workflows can now opt into the gVisor runtime via sandbox.agent.runtime: gvisor for stronger sandbox isolation. (#44796)
• Shared partials can declare sandbox.agent.mounts — Partial workflow files can now define mount configurations that are merged into the parent workflow, enabling reusable sandbox setups. (#44500)
• AI authorship disclosure header — A new disclosure-header safe-output message type allows agents to declare AI authorship inline in PR comments and issues. (#44497)
• gh aw add resolves transitive uses: references — Importing a workflow partial now automatically resolves and includes any nested imports, eliminating manual dependency management. (#44763)
• OAuth token failure propagated to conclusion job — When an OAuth or missing-token failure occurs, it is now surfaced in the conclusion job so failures are never silently swallowed. (#44777, #44756)
• New stringscountcontains linter — Detects strings.Count(s, sub) > 0 patterns that should be written as strings.Contains. (#44820)
• ARC DinD how-to guide — New documentation covering how to run the GitHub Copilot coding agent on self-hosted ARC runners with Docker-in-Docker. (Learn more) (#44561, #44586)

🐛 Bug Fixes & Improvements

• Compiler performance — CompileSimpleWorkflow no longer scans heredoc content for run-block expressions, recovering a measurable regression. (#44454)
• GHE SSH remote URL parsing — Fixed fuzzy schedule scattering for GHE SSH remotes with non-standard usernames. (#44502)
• Stale lock guard — A base-ref-aware guard now prevents stale lock files from being introduced when workflow markdown edits occur on branches. (#44912)
• Confused deputy fix — The confused deputy check is now correctly scoped to bot actors on pull_request:synchronize events only. (#44494)
• Docker socket GID resolution — Robust GID resolution for ARC/DinD and split-daemon topologies ensures correct socket permissions. (#44446)
• Playwright-based model pricing scraper — Replaced the fragile static HTML scraper with a Playwright-driven extractor that stays reliable as pricing pages evolve. (#44453)
• pull_request_review event handling — Fixed add_workflow_run_comment.cjs to correctly handle the pull_request_review event type. (#44503)
• CI token authentication — Extra-empty-commit CI triggers now correctly authenticate using the CI token rather than persisted checkout credentials. (#44180)
• linter self-contained fixes — sprintfint, writebytestring, and bytescomparestring suggested fixes are now fully self-contained, including all required import edits. (#44911, #44665, #44488)
• Copilot harness idle termination — The Copilot harness now terminates idle processes after a terminal safe output, preventing lingering background jobs. (#44440)

📚 Documentation

• Cost management page — Reorganized and expanded the cost management reference for clarity. (#44685)
• Imports reference tightened — Redundant content pruned and accuracy improved in the imports reference. (#44804)
• CLI reference aligned — The CLI reference now matches the current gh aw --help output and exposes the experiments command. (#44603, #44794)
• Sandbox reference — Updated sandbox reference reflects new sandbox.agent.runtime and sandbox.agent.mounts fields.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🚀 Release · 25.3 AIC · ⊞ 7.6K

---

What's Changed

• fix: replace allocating string comparison with bytes.Equal in virtual_fs.go by @pelikhan with @Copilot in #44463
• fix(daily-model-inventory): replace static HTML pricing scraper with playwright-based extraction by @pelikhan with @Copilot in #44453
• [community] Update community contributions in README by @github-actions[bot] in #44457
• docs: expand dispatch-repository nested fields in frontmatter-full.md by @pelikhan with @Copilot in #44456
• Copilot harness: terminate idle process after terminal safe output by @pelikhan with @Copilot in #44440
• Ensure extra-empty-commit CI trigger push authenticates as CI token, not persisted checkout credentials by @pelikhan with @Copilot in #44180
• perf: fix CompileSimpleWorkflow regression — skip heredoc content in run-block expression scan by @pelikhan with @Copilot in #44454
• pkg/agentdrain: add nil-guard to Analyze and improve anomaly test quality by @pelikhan with @Copilot in #44455
• chore: bump gh-aw-firewall to v0.27.28 by @pelikhan with @Copilot in #44467
• [instructions] Sync instruction files with release v0.82.7 by @github-actions[bot] in #44541
• fix: remove double-normalization in overridePersistedExtraheader by @pelikhan with @Copilot in #44492
• fix: resolve all non-largefunc custom linter findings by @pelikhan with @Copilot in #44461
• Fix yamllint violations in generated lock files by @pelikhan with @Copilot in #44491
• fix: handle pull_request_review event in add_workflow_run_comment.cjs by @pelikhan with @Copilot in #44503
• Use specific failure categories before agent_failure in failure-issue routing by @pelikhan with @Copilot in #44498
• Document and pin no-github-request-interpolated-route boundary behavior by @pelikhan with @Copilot in #44550
• Add ARC DinD how-to guide for running GitHub Copilot coding agent on self-hosted runners by @lpcox with @Copilot in #44561
• docs: DinD is required for ARC (not optional), fix NET_ADMIN misinformation, clarify sudo scope by @lpcox with @Copilot in #44586
• fix: scope confused deputy check to bot actors on pull_request:synchronize by @pelikhan with @Copilot in #44494
• Track compiled lock files for the new test workflows by @pelikhan with @Copilot in #44551
• [docs] docs: unbloat workflow structure reference by @github-actions[bot] in #44596
• Align CLI reference with current gh aw --help output by @pelikhan with @Copilot in #44603
• [safe-output-integrator] fix: use canonical dispatch-repository key in test fixture by @github-actions[bot] in #44614
• fix: parse GHE SSH remote URLs with non-standard usernames for fuzzy schedule scattering by @pelikhan with @Copilot in #44502
• Always compile after any workflow .md change to keep .lock.yml in sync by @pelikhan with @Copilot in #44565
• Reframe bytescomparestring as style/intent lint and fix single-import autofix output by @pelikhan with @Copilot in #44488
• Refresh package specs for spec-audit mismatches and stale README coverage by @pelikhan with @Copilot in #44564
• Reduce ExtractWorkflowNameFromFile overhead in CLI workflow title parsing by @pelikhan with @Copilot in #44604
• Surface external threat-detection engine failures in warn-mode fallback by @pelikhan with @Copilot in #44605
• [model-inventory] Add missing Copilot pricing entries for gpt-5.6 variants by @pelikhan with @Copilot in #44648
• feat: formal model + 15-test suite for security architecture SG invariants by @pelikhan with @Copilot in #44590
• [jsweep] Clean workflow_metadata_helpers.cjs by @github-actions[bot] in #44655
• Add init command regression coverage for custom agent creation by @pelikhan with @Copilot in #44656
• Consolidate copilot-requests: write permission checks on Permissions by @pelikhan with @Copilot in #44650
• [yamllint-fixer] Reduce yamllint noise in generated lock files (services indentation + on-section trailing spaces) by @github-actions[bot] in #44645
• chore: bump gh-aw-firewall to v0.27.29 by @pelikhan with @Copilot in #44659
• Allow shared workflow partials to define and merge sandbox.agent.mounts by @pelikhan with @Copilot in #44500
• refactor(workflow): split compiler_yaml_main_job.go into focused modules by @pelikhan with @Copilot in #44651
• refactor: move agentic-workflow-designer skill to static instruction file by @pelikhan with @Copilot in #44658
• Make writebytestring SuggestedFix self-contained by adding missing io import edits by @pelikhan with @Copilot in #44665
• Add disclosure-header message for AI authorship disclosure in safe-outputs by @pelikhan with @Copilot in #44497
• fix: readable text in public preview callout for light mode by @pelikhan with @Copilot in #44680
• docs: add hidden agent prompt to README for agentic workflow setup by @pelikhan with @Copilot in #44679
• Add CLI integration test for init command by @pelikhan with @Copilot in #44678
• docs: review and organize cost-management page by @pelikhan with @Copilot in #44685
• docs(parser): remove phantom function from README Public API table by @pelikhan with @Copilot in #44739
• [docs] Update glossary - daily scan by @github-actions[bot] in #44712
• [eslint-miner] eslint: add require-return-after-core-setfailed rule by @github-actions[bot] in #44697
• [instructions] Sync instruction files with release v0.81.6 by @github-actions[bot] in #44694
• Add step shell script validator: gh CLI without GH_TOKEN heuristic by @pelikhan with @Copilot in #44661
• Reduce standalone gosec exclusions to restore actionable detection of new findings by @pelikhan with @Copilot in #44705
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #44704
• fix: robust Docker socket GID resolution for ARC/DinD and split-daemon topologies by @pelikhan with @Copilot in #44446
• feat: propagate OAuth token check failure to conclusion job failure issue by @pelikhan with @Copilot in #44756
• feat(console): handle huh.ErrUserAborted as graceful exit (exit code 130) by @pelikhan with @Copilot in #44698
• refactor: migrate deprecated RequiredSubcommand and GetGeminiAPITarget callsites to canonical forms by @pelikhan with @Copilot in #44717
• Fix Daily Elixir Credo Snippet Audit bootstrap step for Mix compatibility by @pelikhan with @Copilot in #44762
• eslint-factory: scope-aware Octokit client detection in no-github-request-interpolated-route by @pelikhan with @Copilot in #44706
• feat: propagate missing token failure to conclusion job by @pelikhan with @Copilot in #44777
• fix: gh aw add resolves uses: references transitively in imported files by @pelikhan with @Copilot in #44763
• Tighten PR sous-chef nudge heuristics: 4-per-run cap, deterministic prioritization, and safe review-thread resolution by @pelikhan with @Copilot in #44805
• [docs] docs: tighten imports reference by @github-actions[bot] in #44804
• Add explicit Googlebot allow rule to docs site robots.txt by @pelikhan with @Copilot in #44803
• Update govulncheck dependency to golang.org/x/vuln v1.6.0 by @pelikhan with @Copilot in #44793
• feat: add sandbox.agent.runtime: gvisor for gVisor container runtime support by @lpcox with @Copilot in #44796
• Consolidate pr-sous-chef run reports into a daily rolling issue thread by @pelikhan with @Copilot in #44830
• Add formal GitHub MCP access-control conformance model and predicate-mapped test suite by @pelikhan with @Copilot in #44790
• [log] Add debug logging to custom linter analyzers by @github-actions[bot] in #44860
• Strip Copilot-only MCP tools field from Claude gateway config by @pelikhan with @Copilot in #44868
• [review] Strip Copilot-only MCP tools field from Claude gateway config by @github-actions[bot] in #44897
• refactor: consolidate hasCopilotRequestsWritePermission frontmatter adapter into workflow package by @pelikhan with @Copilot in #44886
• [file-diet] Split activation job builder into focused compiler modules by @pelikhan with @Copilot in #44792
• Add dedicated outcome evaluators for replace_label and close operations; fill spec/compliance gaps by @pelikhan with @Copilot in #44798
• feat(linters): add stringscountcontains linter by @pelikhan with @Copilot in #44820
• Deduplicate sub-issue linking across create_issue and link_sub_issue by @pelikhan with @Copilot in #44874
• [community] Update community contributions in README by @github-actions[bot] in #44859
• fix(tolowerequalfold): reject case-mismatched literals and mixed ToLower/ToUpper comparisons by @pelikhan with @Copilot in #44888
• fix(sprintfint): make suggested fix self-contained — add strconv import, remove orphaned fmt import by @pelikhan with @Copilot in #44911
• [docs] Update editor preview screenshots – 2026-07-11 by @github-actions[bot] in #44914
• fix(copilot-session-insights): restore transcript fetch after 42-day gap by @pelikhan with @Copilot in #44822
• Add base-ref-aware stale lock guard for workflow markdown edits by @pelikhan with @Copilot in #44912
• Unify gh aw help/docs wording and expose experiments command in CLI reference by @pelikhan with @Copilot in #44794

Full Changelog: v0.82.7...v0.82.8