github/gh-aw v0.33.2

gh-aw 0.33.2

on GitHub

🌟 Release Highlights

This maintenance release brings important MCP server enhancements, security improvements, and quality-of-life updates across the codebase.

✨ What's New

MCP Server Enhancements

• HTTP header authentication support - MCP servers can now authenticate using custom HTTP headers, enabling secure connections to authenticated API endpoints (#6687). [Learn more about MCP servers →]((redacted)
• Session timeout protection - Added automatic session timeout to MCP HTTP servers to prevent resource leaks (#6690)

Scheduling Improvements

• Fuzzy schedule syntax - New flexible scheduling with natural language support like "around 9am" and "weekly around Monday 3pm" prevents workflow load spikes through deterministic scattering (#6659, #6693, #6664). [View scheduling docs →]((redacted)
• Cron validation - Automatic validation ensures schedule expressions are compatible with GitHub Actions before deployment (#6671)

Workflow Enhancements

• Metadata field support - New metadata frontmatter field for storing custom workflow metadata (#6666)
• Auto-fallback for project tokens - update_project jobs now automatically fall back to GH_AW_PROJECT_GITHUB_TOKEN when needed (#6596)

🔒 Security Improvements

• Secure Copilot CLI installation - Replaced insecure curl | sudo bash pattern with official install.sh script downloaded to temp file, reducing supply-chain risks (#6691)

🐛 Bug Fixes

• Fixed campaign workflow compilation issues in watch mode (#6669)
• Fixed update_project mutation missing color field for single-select options (#6604)
• Resolved intermittent Safe Inputs API key generation test failures (#6696)
• Corrected inconsistent capitalization of "Markdown" and "MCP" in CLI descriptions (#6631)
• Multiple fuzz test fixes for mention wrapping validation (#6656, #6660)

⚡ Performance & Testing

• 35% reduction in CI test duplication - Optimized integration test matrix with intelligent skip patterns (#6640)
• Comprehensive fuzz testing - Added fuzz tests for mentions filtering and JavaScript sanitization functions (#6580, #6585)
• Better CI balance - Improved integration test matrix distribution for faster builds (#6599)

🔧 Updates

• Updated GitHub MCP Server to v0.25.0 (#6641)
• Updated Claude Code CLI to v2.0.71 (#6699)
• Updated Claude Code CLI to v2.0.70 and Codex to v0.73.0 (#6618)

For complete details, see the full changelog.

AI generated by Release

What's Changed

• Add fuzz tests for mentions filtering by @Copilot in #6580
• Collapse agent environment validation into HTML details section by @Copilot in #6583
• Add fuzz testing for JavaScript sanitization functions by @Copilot in #6585
• Import slide deck and integrate Marp build tooling by @Copilot in #6589
• Add automatic GH_AW_PROJECT_GITHUB_TOKEN fallback for update_project jobs by @Copilot in #6596
• Add missing fuzz tests to CI workflow by @Copilot in #6606
• Fix update_project mutation missing color field for single-select options by @Copilot in #6604
• Optimize CI integration test matrix for better balance by @Copilot in #6599
• Fix campaign workflow detection bug in ComputeCompiledState by @Copilot in #6613
• Improve issue-monster heuristics with smart filtering and priority scoring by @Copilot in #6595
• [docs] Update glossary - daily scan by @github-actions[bot] in #6615
• [instructions] Sync github-agentic-workflows.md with v0.33.1 by @github-actions[bot] in #6609
• [specs] Update layout specification - 2025-12-16 by @github-actions[bot] in #6597
• Update CLI versions: Claude Code 2.0.70, Codex 0.73.0 by @Copilot in #6618
• Consolidate duplicate GitHub identifier validation and string array parsing functions by @Copilot in #6619
• [log] Add debug logging to 5 Go files (MCP listing, secret management, caching, YAML generation) by @github-actions[bot] in #6625
• Add agentic workflow for slide deck maintenance with Marp and Playwright by @Copilot in #6622
• Fix campaign orchestrator treating closed issues as blockers using embedded templates by @Copilot in #6623
• Add GitHub issue form template for campaign creation by @Copilot in #6630
• docs: Use idiomatic --no-strict flag syntax in campaign validate examples by @Copilot in #6632
• Fix inconsistent capitalization of "Markdown" and "MCP" in command descriptions by @Copilot in #6631
• Eliminate 35% test duplication in CI integration matrix using skip patterns by @Copilot in #6640
• Focus ai-moderator on issues only, skip bot-created issues by @Copilot in #6637
• Fix slide path references in slide-deck-maintainer workflow by @Copilot in #6646
• Update GitHub MCP Server to v0.25.0 by @Copilot in #6641
• Use :latest version tag for copilot-cli devcontainer feature and update existing files by @Copilot in #6639
• Fix slide deck: correct AI engine defaults and installation commands by @Copilot in #6649
• [WIP] Add slide updater agentic workflow with expiration by @Copilot in #6648
• Add comprehensive documentation for upload-assets safe output type by @Copilot in #6652
• Convert Astro directive syntax to GitHub alerts in command-triggers.md by @Copilot in #6655
• Fix fuzz test length check for mention wrapping in sanitizeIncomingText by @Copilot in #6656
• Fix fuzz test length check for mention wrapping overhead by @Copilot in #6660
• Add fuzzy schedule support with deterministic scattering to prevent load spikes by @Copilot in #6659
• Add Node.js setup with npm caching to hourly-ci-cleaner workflow by @Copilot in #6663
• [instructions] Sync github-agentic-workflows.md with v0.33.1 by @github-actions[bot] in #6665
• Add "around" constraint for fuzzy schedule syntax by @Copilot in #6664
• Add infer: false to custom agent frontmatter by @Copilot in #6668
• Add metadata field to workflow frontmatter by @Copilot in #6666
• Fix campaign workflow compilation in watch mode by @Copilot in #6669
• [instructions] Sync github-agentic-workflows.md with v0.33.1 by @github-actions[bot] in #6684
• Add cron expression validation to ensure GitHub Actions compatibility by @Copilot in #6671
• [docs] Reduce bloat in quick-start.md (26% reduction) by @github-actions[bot] in #6688
• Add HTTP header injection for MCP server authentication by @Copilot in #6687
• Add fuzzy scheduling support for weekly schedules by @Copilot in #6693
• Extract MCP timeout constants for maintainability by @Copilot in #6692
• Add SessionTimeout to MCP HTTP server to prevent resource leaks by @Copilot in #6690
• Use official Copilot CLI installer script with security improvements by @Copilot in #6691
• Update issue-arborist to inspect only open issues by @Copilot in #6695
• Fix intermittent test failure in Safe Inputs API key generation by @Copilot in #6696
• Update Claude Code CLI to v2.0.71 and disable Chrome integration by @Copilot in #6699
• [docs] Update documentation for features from 2025-12-16 by @github-actions[bot] in #6703

Full Changelog: v0.33.1...v0.33.2