Upgrade agentic workflows to gh-aw v0.46.3

[Copilot]

Upgrades all workflows from gh-aw v0.45.3 to v0.46.3 using gh aw upgrade.

Changes

Version updates

• Agent dispatcher and setup actions: v0.45.3 → v0.46.3
• GitHub Copilot CLI: v0.0.410 → v0.0.411

Codemods applied (6 workflows)

• Activation outputs migrated from needs.activation.outputs.text to steps.sanitized.outputs.text for improved security sandboxing
• ai-moderator.md: Role configuration moved to on.roles frontmatter structure

Lock file changes (all 33 workflows)

• Added context variable validation step
• Updated compiler metadata schema: frontmatter-hash → gh-aw-metadata with structured versioning
• Simplified runtime-import paths (workflow names vs full paths)

Example

- **Triggering Content**: "${{ needs.activation.outputs.text }}"
+ **Triggering Content**: "${{ steps.sanitized.outputs.text }}"

- frontmatter-hash: 8cac416a65962362c3e177ba41ce0519e814d5816e454bdee19ef2c3eda90081
+ gh-aw-metadata: {"schema_version":"v1","frontmatter_hash":"8cac416a...","compiler_version":"v0.46.3"}

Notes

Two workflows (daily-perf-improver, daily-test-improver) emit warnings about missing discussions: read permission but compile successfully. They use all: read which covers their discussion access needs.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/checkout/releases
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/releases --jq .[].tag_name (http block)
• https://api.github.com/repos/actions/github-script/releases
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/releases --jq .[].tag_name (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.46.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.46.3 --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw/releases
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/releases --jq .[].tag_name (http block)
• https://api.github.com/repos/github/gh-aw/releases/latest
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
  • Triggering command: /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw upgrade --verbose (http block)
  • Triggering command: /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw upgrade --dir workflows --verbose (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Upgrade agentic workflows

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.