v0.89.5

🌟 Release Highlights

This release focuses on hardening safe-output reliability, tightening security around confused-deputy protections, and improving multi-target log collection under load.

✨ What's New

• Configurable safe-output footers — safe-outputs.body-footer lets you append shared, additive content to every safe output that produces a body, composing cleanly across imported workflows and handler-specific config. Learn more
• Early validation for external safe-output secrets — Jira, Linear, and Azure DevOps safe outputs now fail fast at activation time with actionable errors when required credentials are missing, instead of failing mid-run after agent execution.
• GHE-compatible activation artifacts — Activation jobs now upload aw_info.json as an archived artifact, fixing compatibility with GitHub Enterprise where unarchived artifacts aren't supported.

🐛 Bug Fixes & Improvements

• Fixed daily AIC snapshot accounting — Resolved reuse of incomplete observations, repeated re-fetching of historical artifacts, and inaccurate "under budget" reporting after quota failures.
• Honored bot allowlists before confused-deputy checks — Allowlisted bots pushing to PRs opened by another actor were previously rejected on synchronize events; the bot allowlist is now checked first.
• More reliable multi-target log collection — Queued log targets no longer start after the shared count limit or timeout has already been reached, with clearer diagnostic logging for cache reuse and active limits.

🔧 Internal

• Updated GitHub Actions versions, dependency bumps (@primer/octicons, @types/node, @astrojs/sitemap, starlight-links-validator, @astrojs/starlight), package specification refreshes, and dead-code removal.

Generated by 🚀 Release · copilot · auto · 17.9 AIC · ⊞ 11.9K

---

What's Changed

• Upload activation run info as a GHE-compatible artifact by @pelikhan with @Copilot in #60057
• Fix daily AIC snapshot completeness and quota handling by @pelikhan with @Copilot in #60136
• Honor bot allowlists before confused-deputy checks by @pelikhan with @Copilot in #60135
• [instructions] Sync instructions with release v0.88.7 by @github-actions[bot] in #60231
• [eslint-miner] fix(eslint-factory): detect setFailed+exit(0) inside try/catch/finally by @github-actions[bot] in #60238
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #60243
• build(deps): Bump @primer/octicons from 19.33.0 to 19.34.0 in /docs by @dependabot[bot] in #60125
• build(deps-dev): Bump @types/node from 26.2.0 to 26.5.0 in /actions/setup/js by @dependabot[bot] in #60126
• build(deps): Bump @astrojs/sitemap from 3.7.3 to 3.7.4 in /docs by @dependabot[bot] in #60127
• build(deps): Bump starlight-links-validator from 0.25.3 to 0.26.0 in /docs by @dependabot[bot] in #60128
• build(deps): Bump @astrojs/starlight from 0.41.10 to 0.42.0 in /docs by @dependabot[bot] in #60129
• [actions] Update GitHub Actions versions - 2026-09-11 by @github-actions[bot] in #60217
• Stop starting log targets after reaching the shared count limit by @pelikhan with @Copilot in #60266
• Validate external safe-output secrets before activation by @pelikhan with @Copilot in #60267
• Stop queued log targets after timeout by @pelikhan with @Copilot in #60273
• Add additive global footers to safe-output bodies by @pelikhan with @Copilot in #60275
• [blog] Agent of the Day – 2026-09-11 by @github-actions[bot] in #60287
• [dead-code] chore: remove dead functions — 5 functions removed by @github-actions[bot] in #60286

Full Changelog: v0.89.4...v0.89.5