v0.89.20

🌟 Release Highlights

This release focuses on reliability fixes for cross-repo pull request handling, threat-detection infrastructure, and Linear/Jira safe-output integrations, alongside continued documentation and automation upkeep.

🐛 Bug Fixes & Improvements

• Fixed cross-org fork PR creation — create_pull_request now passes the validated head repository, so PRs from forks that share an organization with the base repo no longer fail (#62720).
• Fixed external threat detection on ARC/DinD runners — the detector binary and inputs are now staged under the shared RUNNER_TEMP directory and installed rootlessly, resolving failures where the runner and Docker daemon don't share a filesystem (#62755).
• Hardened Linear integration — create_issue now accepts a team UUID, key, or friendly name instead of requiring a UUID (#62754), and workflow activation now validates LINEAR_TEAM_ID up front to prevent silent handler load failures (#62743).
• Improved threat-detection auditing — gh aw audit now surfaces failed detection jobs and reports detected threats with stable finding codes for downstream automation (#62753).
• Fixed installer robustness — gh-aw binary downloads are now staged before replacing existing binaries, preventing partial upgrades (#62761).
• Retry logic added for transient workflows-scope timeouts when pushing branches for create_pull_request and push_to_pull_request_branch (#62486, #62668).
• Allowed line-oriented inspection tools (nl, sed) in the PR Code Quality Reviewer to prevent premature harness stops (#62770).

✨ What's New

• Jira safe outputs promoted to stable — jira-create-issue, jira-update-issue, jira-add-comment, and jira-add-label are now stable, production-ready safe outputs (#62749).

📚 Documentation

• Refreshed the repo assist example and Playwright reference for clarity (#62822, #62277).
• Routine Astro dependency and glossary updates keep the docs site current (#62853, #62610).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

Generated by 🚀 Release · copilot · auto · 20 AIC · ⊞ 11.6K

---

What's Changed

• [log] Add debug logging for silent skip/failure branches in workflow add PR path by @github-actions[bot] in #62859
• [community] Update community contributions in README by @github-actions[bot] in #62848
• [docs] Update Astro dependencies - 2026-09-23 by @github-actions[bot] in #62853
• [docs] docs: unbloat repo assist example by @github-actions[bot] in #62822

Full Changelog: v0.89.19...v0.89.20