v0.87.4

🌟 Release Highlights

This release focuses on compiler robustness, safe-output validation, and internal tooling/observability improvements across the agentic workflow pipeline.

✨ What's New

• Stricter safe-outputs validation: compilation now fails fast when a safe-outputs step-output token can't resolve in a consuming job, and generic tools are no longer duplicated for renamed dynamic safe-output tools (#54632, #54631).
• Pinned Agent Plugins support added for more reproducible workflow builds (#54288).
• Approve-workflow-run safe output now supports comments (#54504).
• Engine flexibility: engine.model can now override the top-level model per engine instance, and custom-provider models pass through verbatim for OPENAI_BASE_URL/ANTHROPIC_BASE_URL endpoints (#54366, #54363).
• gh aw update now refreshes upstream skills/plugins and package-managed assets automatically (#54417).

🐛 Bug Fixes & Improvements

• Fixed Copilot orphan-escalation assignee detection and threat-detection summary initialization (#54716, #54370).
• Corrected create_issue fields handler to use valid GraphQL fragments, and fixed no-math-minmax-array-spread/schema diff/workflow-key extraction lint checks (#54361, #54498, #54647).
• Hardened checkout/credential handling: shallow checkout for CGO/CJS/CWI jobs, and GH_TOKEN no longer persists in repo-memory clone's .git/config (#54709, #54701).
• Derived the conclusion job's issues:write permission directly from resolved safe-outputs config, and scoped deny-only blocking in signed-commit file-protection validation (#54630, #54628).
• Flipped hide-comment discussions default to opt-in for least privilege (#54380).

📚 Documentation

• Clarified frontmatter redirect behavior/missing fields and CLAUDE_CODE_OAUTH_TOKEN failure modes (#54400, #54590).
• Documented previous-result strategies for scheduled workflows and the panic() contract for embed-guarded lazy-load sites (#54568, #54599).

🔧 Internal

• Continued rollout of Working-Set Rebuild Factor (WSRF) observability across audits and step summaries (#54416, #54591, #54603).
• Broad test-parallelization and lint hardening sweep (t.Parallel(), errormessage/RGS/CodeQL fixes) across the compiler and CI packages.

No community-labeled issues were closed in this release window.> Generated by 🚀 Release · auto · 17.9 AIC · ⊞ 11.7K

---

What's Changed

• [test-parallel] test: add t.Parallel() to safe subtests in audit_expanded_test.go by @github-actions[bot] in #54694
• Add guarded continual harness experiments by @pelikhan with @Copilot in #54526
• Stop persisting GH_TOKEN in repo-memory clone's .git/config by @pelikhan with @Copilot in #54701
• Embed AgentMetadataInfo in LockMetadata instead of duplicating 7 fields by @pelikhan with @Copilot in #54670
• Use shallow checkout for CGO/CJS/CWI checkout-cache jobs by @pelikhan with @Copilot in #54709
• [log] Add debug logging to add_package_manifest files by @github-actions[bot] in #54712
• Fix error-safety and observability lint findings in actions/setup/js by @pelikhan with @Copilot in #54689
• Fix actions/setup/js regex and API-safety mechanical lint slice by @pelikhan with @Copilot in #54671
• Fix Copilot orphan-escalation assignee detection by @pelikhan with @Copilot in #54716

Full Changelog: v0.87.3...v0.87.4