v0.89.3

🌟 Release Highlights

This release focuses on operational reliability for the gh aw logs command, tightens security around Git path validation and Actions pinning, and ships a new Go linter alongside supply-chain and documentation cleanups.

✨ What's New

• Global limits for multi-target log downloads — gh aw logs now applies --timeout and --count as a single shared budget across all concurrent workflow targets instead of per-target, so combined downloads stay bounded and results are globally capped and sorted (#60058).
• Faster cached log exploration — gh aw logs --cached-jsonl now loads its JSONL cache once per command and appends new records in place, avoiding repeated cache reloads during multi-target exploration (#60040).
• New linter: buffer-reset-before-reuse — detects bytes.Buffer/strings.Builder reuse without an intervening Reset(), catching a subtle class of stale-output bugs (#60026).
• Firewall upgrade — default gh-aw-firewall bumped to v0.28.15, with refreshed container digest pins and regenerated workflow lock files (#60020).
• Safer GitHub MCP enclaves — forcePublicRepos is now disabled for enclave-only GitHub MCP backends, preventing the gateway from silently discarding a configured allowed-repos policy (#60016).

🐛 Bug Fixes & Improvements

• Git path validation now rejects NUL bytes before they reach Git subprocesses, and validation test coverage was consolidated into table-driven tests (#60043).
• Pinned GitHub Actions uses: references in this repository to immutable commit SHAs and added a Dependabot github-actions update entry with a 7-day cooldown (#60061).
• Fixed a .github/dependabot.yml syntax error where update entries were incorrectly placed outside the updates list (#60122).

📚 Documentation

• Condensed and reorganized the GitHub MCP guide, trimming duplicated explanations and tightening troubleshooting guidance for faster scanning (#60115).

Generated by 🚀 Release · copilot · auto · 20.3 AIC · ⊞ 11.9K

---

What's Changed

• Bump gh-aw-firewall to v0.28.15 by @lpcox with @Copilot in #60020
• Disable forcePublicRepos for enclave-only GitHub MCP backends by @lpcox with @Copilot in #60016
• Load cached logs JSONL once per command by @pelikhan with @Copilot in #60040
• Reject NUL bytes in Git paths and consolidate validation tests by @pelikhan with @Copilot in #60043
• [linter-miner] Add buffer-reset-before-reuse linter by @github-actions[bot] in #60026
• Pin GitHub Actions to commit SHAs by @github-security-bot in #60061
• Apply logs timeout and count globally across concurrent targets by @pelikhan with @Copilot in #60058

New Contributors

• @github-security-bot made their first contribution in #60061

Full Changelog: v0.89.2...v0.89.3