v0.89.4

🌟 Release Highlights

This release strengthens observability and reliability of the AI development platform, restoring critical Copilot usage telemetry, tightening checkout permission handling, and expanding audit data caching — alongside a routine batch of dependency updates.

🐛 Bug Fixes & Improvements

• Restored Copilot usage accounting without the agent sandbox — Workflows configured with sandbox.agent: false now correctly report token usage and AI Credit consumption by reading the latest usage checkpoint from Copilot session-state logs (#60134).
• Preserved contents permission for built-in job setup checkouts — Recompiling workflows no longer silently drops contents: read/write permissions when actions/checkout is declared in job-level setup steps, preventing private-repository checkout failures (#60137).
• Suppressed a zizmor false positive for generated runtime path steps, keeping static analysis output clean without weakening the underlying trust boundary (#60138).
• Corrected Grok 4.5 and 4.6 model routing so both models are dispatched through the Responses API instead of the incompatible chat completions endpoint (#60139).

🔧 Internal

• Enriched cached logs JSONL with job, session, and event evidence to power CAO dashboard ingestion, while preserving the privacy boundary around tool errors, arguments, and artifact bodies (#60146).
• Extended gh aw logs --cached-jsonl --audit to persist generated audit results and supporting workflow metadata directly in the JSONL cache (#60183).
• Dismissed a false-positive threat-spec finding from the daily compiler threat spec audit (#60160).
• Reverted an in-progress GitHub App token minting change for the release workflow after discovering the configured App is not installed on this repository; release tagging continues to use the existing GITHUB_TOKEN-backed flow while a longer-term credential is investigated (#60214, #60218).

📦 Dependency Updates

Routine updates to keep the toolchain current, including actions/checkout, actions/setup-go, actions/setup-node, actions/cache, actions/upload-artifact, actions/deploy-pages, docker/setup-buildx-action, golang.org/x/sync, golang.org/x/mod, and @playwright/test.

No community-labeled issues were closed in this release window.

Generated by 🚀 Release · copilot · auto · 22.2 AIC · ⊞ 11.9K

---

What's Changed

• [docs] docs: unbloat MCP guide by @github-actions[bot] in #60115
• Fix Dependabot configuration syntax by @pelikhan with @Copilot in #60122
• build(deps): Bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #60140
• build(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.3.0 by @dependabot[bot] in #60142
• Route Grok 4.5 and 4.6 through the Responses API by @pelikhan with @Copilot in #60139
• Enrich cached logs JSONL for dashboard ingestion by @pelikhan with @Copilot in #60146
• Suppress zizmor false positive for generated runtime paths by @pelikhan with @Copilot in #60138
• [compiler-threat-spec] Daily threat spec audit: dismiss false-positive sighthound close_issue.cjs finding by @github-actions[bot] in #60160
• build(deps): Bump actions/setup-go from 5.2.0 to 7.0.0 by @dependabot[bot] in #60145
• build(deps): Bump actions/setup-node from 4.1.0 to 7.0.0 by @dependabot[bot] in #60144
• Preserve contents permission for built-in job setup checkouts by @pelikhan with @Copilot in #60137
• build(deps): Bump actions/cache from 5.0.4 to 6.1.0 by @dependabot[bot] in #60133
• build(deps): Bump actions/checkout from 4.2.2 to 7.0.1 by @dependabot[bot] in #60132
• build(deps-dev): Bump @playwright/test from 1.62.1 to 1.63.0 in /docs by @dependabot[bot] in #60130
• build(deps): Bump actions/deploy-pages from 4.0.5 to 5.0.1 by @dependabot[bot] in #60131
• build(deps): Bump golang.org/x/sync from 0.22.0 to 0.23.0 by @dependabot[bot] in #60124
• Restore Copilot usage accounting without the agent sandbox by @pelikhan with @Copilot in #60134
• build(deps): Bump golang.org/x/mod from 0.40.0 to 0.41.0 by @dependabot[bot] in #60123
• Cache audit results in logs JSONL by @pelikhan with @Copilot in #60183
• Add GitHub App token minting for release workflow by @mnkiefer in #60214
• Revert GitHub App token minting for release tags by @mnkiefer in #60218

Full Changelog: v0.89.3...v0.89.4