v0.83.4

🌟 Release Highlights

This release brings significant security hardening, new authentication options, expanded model support, and important workflow reliability fixes across the gh-aw platform.

✨ What's New

• Google Vertex AI Workload Identity Federation — Authenticate to Google AI via Workload Identity Federation, eliminating the need for long-lived service account keys in Gemini-powered workflows. (#48185)
• Safe-output field aliases — New field aliases enable precise agent mistake detection, making it easier to catch and surface incorrect safe-output usage patterns. (#48230)
• Copilot BYOK frontmatter options — Expose extraHeaders, extraBodyFields, and sessionId in workflow frontmatter for bring-your-own-key Copilot SDK integrations. (#48096)
• stringsindexhasprefix Go linter — New analyzer detects strings.Index(...) == 0 patterns that should use strings.HasPrefix. (#48049)
• PolicyCompiler.Compile + attribution compliance tests — Formal intent-based policy compilation with a full attribution compliance test suite. (#48036)
• Model inventory update — Added claude-opus-5 to pricing catalogs and kept all model mirrors in sync. (#48294, #48279, #48303)
• AWF & MCP Gateway bumped — Default AWF v0.27.42 / MCP Gateway v0.4.6 with refreshed pinned artifacts. (#48236)

🐛 Bug Fixes & Improvements

• Secret argv exposure mitigated — Hardened remote include write boundaries to prevent accidental secret leakage via process arguments. (#48318)
• dispatch_workflow backward compatibility restored — Single-target dispatch safe outputs work again after the multi-target refactor. (#48317)
• add-wizard bootstrap ordering fixed — Pre-install bootstrap steps now run before engine selection, and call-workflow worker loading is properly initialized. (#48282, #48301)
• MCP CLI stdin mode corrected — Per-field stdin mode now correctly extracts the target JSON field value instead of passing the raw JSON string. (#48100)
• GH_AW_INPUT_* forwarded to MCP container — Dynamic safe-outputs configuration now reaches the MCP container environment as intended. (#48099)
• label_command activation guard preserved — Custom if: conditions in frontmatter no longer clobber the built-in activation guard. (#48105)
• HTTPS angle-bracket autolinks preserved — Safe-output sanitization no longer strips valid (redacted) autolinks. (#48169)
• Playwright CI sandbox flag — Chromium sandbox disabled for playwright-cli mode in CI containers, fixing test failures in rootless environments. (#48102)
• Deduplication rate-limit guard fixed — The deduplicate-by-title guard was always skipping due to a wrong bucket threshold comparison. (#48092)
• CI reliability — Resolved empty-SHA cache entries, stale action pins, and P0 CI failures. (#48291)
• Goroutine lifecycle bounded — Added join handle for StartDockerImageDownload to prevent goroutine leaks. (#47974)
• PR diff prefetch caching — Reduced redundant PR diff/file-list API reads with head-SHA-aware caching in top review workflows. (#47997)
• Repo-memory patch-size cap raised — Prevents Agent Performance Analyzer push failures on large diffs. (#48012, #48106)

📚 Documentation

• Added release workflow pattern instructions and strengthened compliance trigger guidance with non-technical persona examples.
• Consolidated developer specifications into a single instructions file (v9.22).
• Added GEO-compliant AI discovery endpoints to the docs site.
• Unbloated the artifacts and templating reference pages for easier scanning.

Generated by 🚀 Release · sonnet46 · 26 AIC · ⊞ 7.9K

---

What's Changed

• Add join handle for StartDockerImageDownload to bound goroutine lifecycle by @pelikhan with @Copilot in #47974
• fix(cgo): remove workflow .md paths from CGO PR trigger; clarify CI action_required vs agentic AR by @pelikhan with @Copilot in #47989
• Reduce duplicate issue creation between DeepReport and Code Quality task-mining workflows by @pelikhan with @Copilot in #47998
• Reduce redundant PR diff/file-list API reads with head-SHA-aware prefetch caching in top review workflows by @pelikhan with @Copilot in #47997
• Replace missing evaluator tools in Daily GitHub Docs SEO Optimizer with a Copilot SDK driver by @pelikhan with @Copilot in #47984
• Refresh update-time container digests and enforce commit-age cooldowns by @pelikhan with @Copilot in #47990
• Prevent Agent Performance Analyzer repo-memory push failures by raising patch-size cap by @pelikhan with @Copilot in #48012
• Document linters.All() in pkg/linters spec by @pelikhan with @Copilot in #48015
• [docs] Consolidate developer specifications into instructions file (v9.22) by @github-actions[bot] in #48016
• Normalize report-format instructions for security scan workflows by @pelikhan with @Copilot in #48013
• Add inline engine.driver sources for Copilot SDK workflows by @pelikhan with @Copilot in #47991
• chore: bump agentic CLI/MCP versions (Claude 2.1.220, Copilot 1.0.75, Codex 0.145.0, Pi 0.82.0) by @pelikhan with @Copilot in #47996
• Update CLI version checker for Docker image digests by @pelikhan with @Copilot in #48043
• SPDD 2026-07-25: strengthen normative specs across ADRs 27479, 27523, 27626, 27639, 27707 by @pelikhan with @Copilot in #48041
• docs: add GEO-compliant AI discovery endpoints to docs site by @pelikhan with @Copilot in #48046
• Fix TypeScript SDK driver: resolve ts-node from workspace-local node_modules/.bin by @pelikhan with @Copilot in #48018
• Add CI guard to enforce workflow container digest parity with actions-lock pins by @pelikhan with @Copilot in #48039
• feat(linters): add stringsindexhasprefix analyzer for strings.Index(... ) == 0/!= 0 by @pelikhan with @Copilot in #48049
• feat(intent): implement PolicyCompiler.Compile and formal attribution compliance test suite by @pelikhan with @Copilot in #48036
• [caveman] Optimize instruction verbosity — action-container-substitutions.md (2026-07-25) by @github-actions[bot] in #48069
• [docs] docs: unbloat templating reference by @github-actions[bot] in #48084
• docs: add release workflow pattern instructions to .github/aw/ by @pelikhan with @Copilot in #48095
• docs(aw): strengthen compliance trigger guidance and add non-technical persona examples by @pelikhan with @Copilot in #48093
• fix: deduplicate-by-title rate-limit guard always skips due to wrong bucket threshold by @pelikhan with @Copilot in #48092
• [docs] Update dictation skill instructions by @github-actions[bot] in #48140
• Fix zizmor output gap and eliminate SC2016 shellcheck violations in generated lock files by @pelikhan with @Copilot in #48094
• fix(mcp-cli): per-field stdin mode extracts JSON field instead of using raw JSON string as value by @pelikhan with @Copilot in #48100
• Align repo-memory max-patch-size pre-check with push diff semantics by @pelikhan with @Copilot in #48106
• Allow steps.*.outputs.* in github-token expressions for same-job safe-output auth by @pelikhan with @Copilot in #48101
• feat(copilot/byok): expose extraHeaders, extraBodyFields, sessionId in frontmatter by @pelikhan with @Copilot in #48096
• Preserve label_command activation guards when frontmatter defines a custom if: by @pelikhan with @Copilot in #48105
• [jsweep] Clean validate_memory_files.cjs by @github-actions[bot] in #48126
• [docs] Update documentation for features from 2026-07-26 by @github-actions[bot] in #48178
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #48176
• [code-simplifier] refactor(js): simplify ai_credits_context and action_setup_otlp by @github-actions[bot] in #48122
• Propagate models.providers pricing into AWF apiProxy (including threat-detection runs) by @pelikhan with @Copilot in #48107
• Add evidence-driven linter workflow guidance by @pelikhan with @Copilot in #48226
• fix: disable Chromium sandbox for playwright-cli mode in CI containers by @pelikhan with @Copilot in #48102
• [blog] Weekly blog post – 2026-07-27 by @github-actions[bot] in #48255
• [community] Update community contributions in README by @github-actions[bot] in #48250
• [docs] docs: unbloat artifacts reference by @github-actions[bot] in #48243
• [eslint-miner] feat(eslint): add no-caught-error-interpolation rule by @github-actions[bot] in #48175
• [compiler-threat-spec] spec: bump compiler threat detection spec to v1.0.18 (daily audit 2026-07-27) by @github-actions[bot] in #48270
• feat(gemini): add Google Vertex AI Workload Identity Federation auth by @pelikhan with @Copilot in #48185
• Add daily Go test parallelizer workflow by @pelikhan with @Copilot in #48274
• fix: add claude-opus-5 to embedded model pricing catalogs by @pelikhan with @Copilot in #48279
• Add dedicated debug loggers to 5 pkg files by @pelikhan with @Copilot in #48272
• feat: safe-output field aliases for precise agent mistake detection by @pelikhan with @Copilot in #48230
• [code-simplifier] refactor(js): simplify add_reaction.cjs payload validation and error handling by @github-actions[bot] in #48271
• [jsweep] Clean upload_assets.cjs by @github-actions[bot] in #48280
• Split CGO unit tests into parallel shards by @pelikhan with @Copilot in #48275
• [spec-review] feat: add TYPE-012 fork-backed PR conformance check for spec v1.26.0 by @github-actions[bot] in #48285
• chore: move "Verify integration build" to its own parallel job by @pelikhan with @Copilot in #48289
• Add max-tool-denials: 3 to all 67 copilot-sdk workflows by @pelikhan with @Copilot in #48293
• fix: add default-ai-credits-pricing fallback to daily-safeoutputs-git-simulator by @pelikhan with @Copilot in #48292
• Fix config step ordering and add call-workflow worker loading in gh aw add-wizard by @pelikhan with @Copilot in #48282
• feat: model inventory update 2026-07-27 by @pelikhan with @Copilot in #48294
• Refactor schedule heatmap styling to use centralized theme styles with NO_COLOR-aware degradation by @pelikhan with @Copilot in #48223
• fix: sync claude-opus-5 entry between models.json mirrors by @pelikhan with @Copilot in #48303
• [test-parallel] test: add t.Parallel() to cmd/gh-aw-wasm/compile_recovery_test.go by @github-actions[bot] in #48309
• fix: forward GH_AW_INPUT_* to MCP container env for dynamic safe-outputs config by @pelikhan with @Copilot in #48099
• Run pre-install bootstrap steps before engine selection in add-wizard by @pelikhan with @Copilot in #48301
• fix: P0 CI failures — empty-SHA cache entries and stale action pins by @pelikhan with @Copilot in #48291
• Preserve HTTPS angle-bracket autolinks in safe-output sanitization by @pelikhan with @Copilot in #48169
• [avenger] ## Fix host build of gh-aw-wasm package (main is undeclared) by @github-actions[bot] in #48320
• ci: move lint-error-messages into its own job by @pelikhan with @Copilot in #48324
• Restore backward compatibility for single-target dispatch_workflow safe outputs by @pelikhan with @Copilot in #48317
• Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pinned artifacts by @lpcox with @Copilot in #48236
• Mitigate secret argv exposure and harden remote include write boundaries by @pelikhan with @Copilot in #48318

Full Changelog: v0.83.3...v0.83.4