v0.89.0

🌟 Release Highlights

This release focuses on hardening agentic engine model selection, improving gh aw logs observability, and tightening safe-output guardrails across internal automation workflows.

✨ What's New

• Identifiable MCP tool calls in logs — gh aw logs --json now records the timestamp, server name, and tool name for every MCP call, making it much easier to trace which server and tool produced a given usage entry (#59579).
• --ignore-workflow-runs for gh aw logs — exclude specific workflow runs (by numeric ID or slug/ID) from log collection without shrinking your requested result count. Supports comma-separated and repeated flags (#59697).
• Refreshed cached logs JSON — gh aw logs --cached-json now replaces the cache file with up-to-date results after each successful collection, instead of leaving it stale (#59690).
• GPT-6 Astra model support — gpt-6-astra is now recognized in model alias resolution and pricing catalogs for GitHub Copilot and OpenAI (#59711).
• Bundled MCP gateway upgraded to v0.4.20 — includes a safe-outputs sink-visibility exemption fix, plus refreshed pinned workflow image references (#59602).

🐛 Bug Fixes & Improvements

• Fixed threat detection reporting config_error for workflows using custom engines, so custom-engine workflows now get proper threat analysis instead of silently skipping it (#59636).
• Fixed Copilot SDK model inventory collection that was broken by an incompatible CLI platform package after a dependency bump (#59703).
• Corrected invalid or unsupported model configurations across several internal workflows (daily-arxiv-researcher, CLI Version Checker, Codex-engine workflows), preventing scheduled run failures (#59685, #59689, #59684).
• Guarded PR Sous Chef workflow-run approvals to avoid repeated failed tool calls when the safe-output policy would deterministically reject them (#59686).
• Normalized PR protected-file policy defaults and changelog handling, aligning create-pull-request and push-to-pull-request-branch naming and relaxing overly strict changelog-only PR restrictions (#56562).
• PR Sous Chef now ignores Dependabot pull requests entirely (#59698).

🔧 Internal

• Migrated 19 of 23 eligible Codex workflows (82.6%) to the Pi engine with automatic model selection (#59695).
• Refreshed agentic engine and MCP toolchain default versions (Claude Code, Copilot CLI/SDK, Codex, Gemini, Pi, GitHub MCP Server, Playwright CLI) (#59694).
• Routine dependency bumps (js-yaml, vitest, go-gh, golang.org/x/crypto, nanoid, sharp, bubbles, starlight, mermaid, astro, @github/copilot-sdk, and others).

Generated by 🚀 Release · copilot · auto · 23.8 AIC · ⊞ 11.9K

---

What's Changed

• [WIP] Fix failing GitHub Actions job Integration: CLI Completion & Other by @pelikhan with @Copilot in #59539
• Expose identifiable MCP tool calls in logs JSON by @pelikhan with @Copilot in #59579
• Bump bundled MCP gateway to v0.4.20 and refresh pinned workflow image references by @lpcox with @Copilot in #59602
• Fix invalid model configuration in daily-arxiv-researcher workflow by @pelikhan with @Copilot in #59685
• Guard PR Sous Chef workflow-run approvals by @pelikhan with @Copilot in #59686
• Use Codex-compatible models in Codex workflows by @pelikhan with @Copilot in #59684
• [compiler-threat-spec] Daily threat spec optimizer: audit cycle 2026-09-09 (v1.0.31) by @github-actions[bot] in #59613
• [eslint-miner] fix(eslint-factory): recognize .addListener alias and req.on("response", cb) idiom in require-http-response-error-listener by @github-actions[bot] in #59679
• Fix CLI Version Checker: switch to pi agentic engine by @pelikhan with @Copilot in #59689
• Migrate 80% of Codex workflows to Pi by @pelikhan with @Copilot in #59695
• Fix threat detection config_error for workflows using custom engines by @pelikhan with @Copilot in #59636
• build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 in /eslint-factory in the npm_and_yarn group across 1 directory by @dependabot[bot] in #59629
• build(deps-dev): Bump vitest from 4.1.11 to 5.0.0 in /actions/setup/js by @dependabot[bot] in #59425
• build(deps): Bump github.com/cli/go-gh/v2 from 2.13.0 to 2.16.0 by @dependabot[bot] in #59424
• build(deps): Bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #59423
• [eslint-miner] ESLint Miner: add require-fs-chmod-try-catch rule by @github-actions[bot] in #59408
• Bump nanoid from 3.3.16 to 3.3.18 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #59099
• Bump sharp from 0.35.3 to 0.35.4 in /docs by @dependabot[bot] in #57670
• Bump astro from 7.2.4 to 7.2.9 in /docs by @dependabot[bot] in #57666
• Bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 by @dependabot[bot] in #57669
• Bump @astrojs/starlight from 0.41.7 to 0.41.10 in /docs by @dependabot[bot] in #57668
• Bump mermaid from 11.17.0 to 11.17.2 in /docs by @dependabot[bot] in #57667
• Update agentic engine CLI versions by @pelikhan with @Copilot in #59694
• build(deps-dev): Bump @github/copilot-sdk from 1.0.11 to 1.0.13 in /actions/setup/js by @dependabot[bot] in #59426
• Refresh cached logs JSON in place by @pelikhan with @Copilot in #59690
• build(deps-dev): Bump @vitest/coverage-v8 from 4.1.11 to 5.0.0 in /actions/setup/js by @dependabot[bot] in #59428
• Ignore Dependabot PRs in PR Sous Chef by @pelikhan with @Copilot in #59698
• Fix Copilot SDK model inventory collection by @pelikhan with @Copilot in #59703
• build(deps-dev): Bump @vitest/ui from 4.1.11 to 5.0.0 in /actions/setup/js by @dependabot[bot] in #59427
• Add workflow run ignore list to logs by @pelikhan with @Copilot in #59697
• Update token audit log collection cap to 2,000 by @pelikhan with @Copilot in #59710
• Add GPT-6 Astra model inventory support by @pelikhan with @Copilot in #59711
• Normalize PR protected-file policy defaults and changelog handling by @dsyme with @Copilot in #56562

Full Changelog: v0.88.8...v0.89.0