v0.83.5

🌟 Release Highlights

This release focuses on cost visibility and forecasting, security hardening, and a wave of reliability fixes across the Copilot, Gemini, and safe-outputs engines.

⚠️ Breaking Changes

• Referencing agent-job step outputs directly in a prompt body is now a compile error (#48610) — move such values into env: and interpolate from there instead.
• Declaring inputs: under a custom job is now rejected at compile time (#48607).

✨ What's New

• Daily agentic spending forecast: a new report estimates AI-credit spend trends, with parallelized artifact downloads to avoid the 45‐minute timeout and negative caching to cut repeated lock-file parsing (#48654, #48718, #48826).
• auto model alias is now a first-class builtin alias for Copilot, simplifying model selection (#48655).
• engine.version for Copilot is now honored, with matching version tests for Copilot and Gemini engines (#48519).
• commit-id config option lets you pin PR review attribution to the exact reviewed commit (#48738).
• GitHub Copilot API pricing source added to the daily model inventory pipeline, improving AI-credit pricing accuracy (#48451).
• Azure OIDC / Azure DevOps & Azure MCP support expands cloud integration options for workflows (#48599).
• Safe-outputs gained a sanitization-safe metadata channel for body-based outputs (#48363) and a cookie label for create-issue outputs in security workflows (#48597).

🐛 Bug Fixes & Improvements

• Fixed safe-outputs MCP gateway registering zero tools, and restored startup by properly staging data_schema_normalizer.cjs (#48602, #48496).
• Prevented duplicate Authorization headers (HTTP 400) during fork push sequences (#48595) and fixed cross-repo dynamic target-repo silently dropping PRs (#48598).
• Resolved imported engine.model being silently dropped when max-ai-credits is set (#48482), and stopped push-context dispatch storms in workflow health checks (#48825).
• Upgraded Go to 1.26.5 to resolve stdlib CVEs (#48453), removed vulnerable MCP images (brave-search, headroom) with unresolved CVEs (#48561, #48550), and addressed top-5 high-severity Sighthound security findings (#48824).
• Added a post-result watchdog to codex_harness and retry logic for Copilot startup no-output watchdog failures to reduce flaky CI (#48499, #48514).

📚 Documentation

• New Debugging & Logging section added to AGENTS.md (#48823) and improved search/AI-assistant discoverability across docs (#48822).

🔧 Internal

Numerous refactors (splitting oversized files, consolidating duplicate types), dependency bumps (Astro, Playwright, Copilot SDK, minimatch), and expanded test coverage were also included — see the full commit history for details.

Generated by 🚀 Release · sonnet50 · 25 AIC · ⊞ 10.7K

---

What's Changed

• [docs] Update glossary - weekly full scan by @github-actions[bot] in #48360
• [architecture] Update architecture diagram - 2026-07-27 by @github-actions[bot] in #48352
• [docs] Update documentation for features from 2026-07-27 by @github-actions[bot] in #48364
• [eslint-miner] eslint: add no-core-error-then-setfailed rule by @github-actions[bot] in #48354
• Add smoke-copilot-auto workflow: auto-post haiku on PRs by @pelikhan with @Copilot in #48423
• Handle workflow_dispatch PR targeting in deterministic safe-output sample replay by @pelikhan with @Copilot in #48398
• Default runs-on for non-reusable custom jobs when omitted by @pelikhan with @Copilot in #48397
• specs: implement SPDD daily work plan 2026-07-27 (9 tasks across 5 spec files) by @pelikhan with @Copilot in #48447
• optimize pr-code-quality-reviewer: trim prompts to cut ~34–51 AIC/run by @pelikhan with @Copilot in #48448
• [docs] docs: unbloat repo-memory reference by @github-actions[bot] in #48468
• Bump Copilot BYOK fallback model to Claude Sonnet 5 and regenerate workflow lockfiles by @pelikhan with @Copilot in #48416
• fix(cli): resolve three high-severity CLI consistency issues by @pelikhan with @Copilot in #48420
• fix: upgrade Go to 1.26.5 to resolve stdlib CVEs in gh-aw-mcpg container by @pelikhan with @Copilot in #48453
• perf: add 20 KB large-file guard to prevent MCP file read token spikes by @pelikhan with @Copilot in #48454
• Reduce redundant gh pr view polling in PR finisher skills by @pelikhan with @Copilot in #48477
• feat: add GitHub Copilot API endpoint as pricing data source in daily model inventory by @pelikhan with @Copilot in #48451
• Add sanitization-safe metadata channel for body-based safe outputs by @pelikhan with @Copilot in #48363
• Detect and report "missing model AI credits pricing" as a specialized failure by @pelikhan with @Copilot in #48422
• refactor: split pkg/cli/token_usage.go (1141 lines) into 6 focused modules by @pelikhan with @Copilot in #48455
• Log warning instead of silently skipping invalid JSON in mergeSafeJobsFromIncludedConfigs by @pelikhan with @Copilot in #48478
• refactor: replace duplicate experimentStateJSON/experimentRunRecord with exported ExperimentState/ExperimentRunRecord by @pelikhan with @Copilot in #48486
• Propagate command context through logs processing and extension upgrade release checks by @pelikhan with @Copilot in #48479
• refactor: introduce named type LLMProvider string to replace bare string threading by @pelikhan with @Copilot in #48485
• Restore safe-outputs MCP startup by staging data_schema_normalizer.cjs by @pelikhan with @Copilot in #48496
• fix: propagate download errors through StartDockerImageDownload join function by @pelikhan with @Copilot in #48487
• Fix imported engine.model silently dropped when max-ai-credits is set by @pelikhan with @Copilot in #48482
• Strengthen persona workflow guidance for path scoping, escalation dedup, and toolset selection by @pelikhan with @Copilot in #48502
• Strengthen actionpins spec tests for cache keys, fallback auditing, and container digest validation by @pelikhan with @Copilot in #48497
• Add focused unit coverage for pre-activation job compiler helpers by @pelikhan with @Copilot in #48506
• Stabilize smoke-copilot-auto lock output by skipping dynamic auto pricing injection by @pelikhan with @Copilot in #48516
• fix: update brace-expansion to 5.0.8 and upgrade Alpine base image to 3.22 by @pelikhan with @Copilot in #48521
• fix: remove ghcr.io/chopratejas/headroom due to 67 CVEs and 131 license violations by @pelikhan with @Copilot in #48550
• fix: constrain list_code_scanning_alerts with state:open and severity:critical,high in structural analysis prompt by @pelikhan with @Copilot in #48551
• fix: resolve three targeted lint-monster diagnostics (defer-in-loop, excess params, hardcoded path) by @pelikhan with @Copilot in #48520
• fix: remove docker.io/mcp/brave-search — Critical/High CVEs, no upstream fix available by @pelikhan with @Copilot in #48561
• feat: honor engine.version for copilot; add version tests for copilot and gemini by @pelikhan with @Copilot in #48519
• fix: add post-result watchdog to codex_harness to prevent CLI hang-on-exit by @pelikhan with @Copilot in #48499
• Retry Copilot startup no-output watchdog failures in scheduled/push runs by @pelikhan with @Copilot in #48514
• Refactor six non-workflow large functions via targeted helper extraction by @pelikhan with @Copilot in #48535
• [docs] Update glossary - daily scan by @github-actions[bot] in #48587
• Bump astro from 7.1.3 to 7.1.4 in /docs by @dependabot[bot] in #48582
• Bump @astrojs/starlight from 0.41.3 to 0.41.5 in /docs by @dependabot[bot] in #48581
• Bump @playwright/test from 1.61.1 to 1.62.0 in /docs by @dependabot[bot] in #48580
• fix: introduce options structs for over-parameterized CLI functions by @pelikhan with @Copilot in #48569
• Bump @primer/octicons from 19.29.2 to 19.31.0 in /docs by @dependabot[bot] in #48577
• Add cookie label to create-issue safe outputs in security/static-analysis workflows by @pelikhan with @Copilot in #48597
• [eslint-miner] feat(eslint): add prefer-get-error-message-over-string rule by @github-actions[bot] in #48575
• Split oversized engine_validation.go (521 lines) into domain-focused files by @pelikhan with @Copilot in #48568
• fix: use sonnet-level model as copilot default, not opus by @pelikhan with @Copilot in #48605
• fix: full pricing snippet and suppress engine error on missing model pricing by @pelikhan with @Copilot in #48594
• Bump minimatch from 10.2.5 to 10.2.6 in /actions/setup/js by @dependabot[bot] in #48579
• Fix cross-repo dynamic target-repo silently dropping PR (forward GH_AW_INPUT_* to agent step env) by @pelikhan with @Copilot in #48598
• compiler: error on inputs declared under custom jobs by @pelikhan with @Copilot in #48607
• [model-inventory] Refresh mirrored model catalog and add missing gemini-3.6-flash entry by @pelikhan with @Copilot in #48614
• fix: legacy-security mode installs awf non-rootless, uses plain sudo for log parsing by @pelikhan with @Copilot in #48098
• Bump @github/copilot-sdk from 1.0.7 to 1.0.8 in /actions/setup/js by @dependabot[bot] in #48578
• fix: wrap fork push sequences in withGitHubHostToken to prevent duplicate Authorization (HTTP 400) by @pelikhan with @Copilot in #48595
• Add Copilot SDK billing inventory job by @pelikhan with @Copilot in #48619
• daily-model-inventory: log raw responses in collect steps, drop copilot-api job by @pelikhan with @Copilot in #48636
• fix: suppress internal AWF sidecar hostnames from blocked-domain warnings by @pelikhan with @Copilot in #48591
• feat: shared Azure OIDC auth, Azure DevOps MCP, and Azure MCP network/docs improvements by @pelikhan with @Copilot in #48599
• Fix safeoutputs gateway registering zero tools error by @pelikhan with @Copilot in #48602
• Set explicit Claude Sonnet fallback when workflow model is unset by @pelikhan with @Copilot in #48618
• Add daily agentic spending forecast report by @pelikhan with @Copilot in #48654
• fix(workflow): restrict pr-code-quality-reviewer to COMMENT/REQUEST_CHANGES reviews by @pelikhan with @Copilot in #48663
• Add ESLint rule for duplicate constant values by @pelikhan with @Copilot in #48657
• fix: update stale cache-key fixture in BenchmarkCompileMCPWorkflow by @pelikhan with @Copilot in #48679
• fix: sync test assertion with current daily-model-inventory billing.multiplier text by @pelikhan with @Copilot in #48689
• feat: error when agent-job step outputs are referenced in the prompt body by @pelikhan with @Copilot in #48610
• refactor: consolidate deprecated bool flag helpers into pkg/cli/flags.go by @pelikhan with @Copilot in #48680
• fix: CLI consistency — secrets bootstrap engine list, ghes flag punctuation, docs description by @pelikhan with @Copilot in #48659
• fix: move sink-visibility to env var to prevent zizmor template-injection by @pelikhan with @Copilot in #48589
• SPDD sync: add formal CS/RS evidence, guard-policy docs, and intent-attribution fixtures by @pelikhan with @Copilot in #48687
• feat: add auto as a proper builtin model alias for Copilot by @pelikhan with @Copilot in #48655
• copilot/arc-dind: export writable HOME before Copilot XDG/MCP path resolution by @lpcox with @Copilot in #48658
• Remove root .github/workflows/*.md-specific Go tests from pkg/workflow by @pelikhan with @Copilot in #48693
• feat(cgo): cache repository checkout to reduce GitHub API calls per run by @pelikhan with @Copilot in #48699
• feat: parallelize forecast usage-artifact downloads to fix 45-min timeout by @pelikhan with @Copilot in #48718
• test(actionpins): improve test quality in actionpins_internal_test.go by @pelikhan with @Copilot in #48707
• Add EvoSkill-based agent skill evolution workflow by @pelikhan with @Copilot in #48722
• [caveman] Optimize instruction verbosity — action-container-substitutions.md (2026-07-28) by @github-actions[bot] in #48731
• Add evals to 20 agentic workflows by @pelikhan with @Copilot in #48740
• docs: explain why WASM builds no-op repository feature validation by @pelikhan with @Copilot in #48736
• Harden daily spending forecast against zero-sample runs by enforcing MCP fallback and authenticated forecast steps by @pelikhan with @Copilot in #48728
• Optimize Daily Rendering Scripts Verifier prompt to remove repeated sandbox probing and polling churn by @pelikhan with @Copilot in #48737
• skills(debugging-workflows): add triage guidance for cascading safe-output credential failures by @pelikhan with @Copilot in #48735
• Reduce ambient prompt duplication in daily cache analyzer + shared workflow imports by @pelikhan with @Copilot in #48733
• [log] Add debug logging to custom Go analysis linters by @github-actions[bot] in #48764
• [docs] docs: fix British spelling to American English in frontmatter reference by @github-actions[bot] in #48762
• [docs] docs: tighten code quality monitoring example by @github-actions[bot] in #48754
• [community] Update community contributions in README by @github-actions[bot] in #48758
• [test-parallel] test: add t.Parallel() to capitalization tests by @github-actions[bot] in #48792
• Wire jsonmarshalignoredeerror into filecheck and skip generated/test files by @pelikhan with @Copilot in #48776
• Surface eval outcomes in experiments analyze and align experiment workflows/docs with eval-backed metrics by @pelikhan with @Copilot in #48741
• Reduce false positives in no-duplicate-constant-values for numeric constants by @pelikhan with @Copilot in #48799
• gemini: use topology hostname for MCP_GATEWAY_HOST_DOMAIN under network isolation by @pelikhan with @Copilot in #48775
• feat: add commit-id config option to pin review attribution to the reviewed commit by @pelikhan with @Copilot in #48738
• fix(trial): fetch entire .github folder to include runtime-import dependencies by @pelikhan with @Copilot in #48787
• Label forecast output as AI Credits and cache AIC across runs by @pelikhan in #48797
• chore: bump CLI versions and pin Docker image digests (2026-07-29) by @pelikhan with @Copilot in #48794
• Propagate imported default AI-credits pricing to eliminate unknown-model pricing regressions by @pelikhan with @Copilot in #48746
• docs: add Debugging & Logging section to AGENTS.md by @pelikhan with @Copilot in #48823
• Quote workflow shell repository expansions to clear SC2086 findings by @pelikhan with @Copilot in #48798
• trial: rewrite checkout with block handling for --logical-repo without duplicate mappings by @pelikhan with @Copilot in #48788
• [rendering-scripts] Fix render_template.cjs: falsy {\{#if}} block removal merges surrounding lines by @github-actions[bot] in #48827
• Stop push-context dispatch storms in Approach Validator and Daily Syntax Error Quality Check by @pelikhan with @Copilot in #48825
• docs: improve search & AI-assistant discoverability by @pelikhan with @Copilot in #48822
• perf(forecast): drop full lock-file parsing, add negative caching, fix spinner flicker by @pelikhan in #48826
• fix: address top-5 high-severity Sighthound security findings by @pelikhan with @Copilot in #48824

Full Changelog: v0.83.4...v0.83.5