v0.91.14

🌟 Release Highlights

This release tightens multi-repository checkout semantics and hardens OTLP credential handling, plus a CI stability fix.

⚠️ Breaking Changes

• Multi-repository checkout now requires explicit multi: true (#68816). Repository expressions no longer implicitly enable list expansion. If you relied on repository lists in a checkout entry, add multi: true to that entry. Entries without it keep ordinary single-repository behavior (LFS, submodules, current checkout, wiki), and literal repository lists in single mode are rejected at compile time.

✨ What's New

• Per-entry opt-in for multi-repo checkout: predictable behavior, with expression results validated as exactly one owner/repo before checkout in both agent and safe-output jobs.

🐛 Bug Fixes & Improvements

• Stronger OTLP credential protection (#68811): GH_AW_OTLP_ALL_HEADERS is now excluded from agent and eval sandboxes (including multi-endpoint configs). Shared credential extraction now masks and redacts decoded Basic-auth passwords, repeated/percent-encoded headers, and JSON-escaped values in artifacts and step summaries. Recompile your workflows to pick up the change.
• CI reliability (#68807): the CLI's embedded session parser bundle now includes all runtime dependencies.

Generated by 🚀 Release · copilot · auto · 15.9 AIC · ⊞ 11.7K

---

What's Changed

• Fix CI parser dependencies and linter metadata by @pelikhan in #68807
• Require explicit multi: true for multi-repository checkout by @pelikhan in #68816
• Harden OTLP credential redaction and eval sandbox isolation by @pelikhan in #68811

Full Changelog: v0.91.13...v0.91.14