github/gh-aw v0.79.4

on GitHub

🌟 Release Highlights

v0.79.4 delivers significant improvements to AI credit (AIC) cost tracking and telemetry accuracy, introduces new workflow authoring controls for custom model pricing and configurable timeouts, and hardens sandbox security. A focused round of bug fixes improves milestone caching, SHA-pinning reliability, and failure reporting.

⚠️ Breaking Changes

• dangerously-disable-sandbox-agent now requires an operator-authored string justification (#38325). Boolean true is no longer accepted — workflows must supply a plain-text reason (≥ 20 characters) explaining why the trust boundary is being removed. Update any workflow using dangerously-disable-sandbox-agent: true to a descriptive string.

• user-invokable and disable-model-invocation fields removed from the gh-aw schema (#38328). These Copilot-specific fields have no meaning in gh-aw workflows and will now produce a validation error. Remove them from any .github/workflows/*.md files.

✨ What's New

• Custom model pricing via models frontmatter (#38276). Declare custom cost tables for private or non-catalog models directly in your workflow frontmatter. Overlays merge over the built-in models.json at runtime with main-workflow precedence. Learn more

• Configurable safe-outputs timeout (#38361). The default safe_outputs job timeout has been raised from 30 to 45 minutes, and a new safe-outputs.timeout-minutes frontmatter field lets you tune it per workflow. Learn more

• create_check_run now supports PR targeting (#38237). Pass target: "pr" or target: "*" to attach check runs to the triggering pull request in addition to the existing commit-based flow.

• Steering messages visible in unified log view (#38277). Mid-run steering messages from operators are now rendered inline in the unified workflow log.

🐛 Bug Fixes & Improvements

• AIC telemetry accuracy across all engines (#38314, #38364, #38327, #38412). The github_models provider alias is now recognised; zero-AIC firewall proxy responses correctly fall back to engine-reported values; AIC credits are properly wired through the agent failure handler and propagated into the failure footer.

• Milestone cache now scoped per owner/repo (#38342). Milestone lookups in assign_milestone no longer bleed across repositories in multi-repo runs.

• SHA-pinning for runtime setup-cli in custom steps: workflows (#38344). The emitted setup-cli step in steps: workflows now receives a SHA pin, aligning with the security posture of standard compiled workflows.

• Failure-issue permission denials handled gracefully (#38273). Workflows lacking issues: write no longer crash on failure reporting; timeout-specific failure messages are now enforced separately.

• Usage tracking fixed for engine jobs (#38353). sendJobConclusionSpan now correctly records token usage for engine-backed jobs.

📚 Documentation

• Auth reference page restructured for clarity (#38390)
• copilot-requests: write now recommended for Copilot authentication (#38404) — see permissions reference
• AIC pricing documentation now links to the live models.dev catalog (#38371)

Generated by 🚀 Release · 164.2 AIC · ⊞ 28.8K

What's Changed

• [caveman] Optimize instruction verbosity — memory, mcp-clis, messages, network (2026-06-10) by @github-actions[bot] in #38263
• [WIP] Fix failing GitHub Actions job Integration: Workflow Misc Part 2 by @Copilot in #38265
• Handle failure-issue permission denials and enforce timeout-specific failure messaging by @Copilot in #38273
• Add steering message rendering in unified log view by @Copilot in #38277
• emit gh-aw.aic as OTLP Sum metric for backend-native consumption by @Copilot in #38279
• Add objective mapping constants and tests by @mnkiefer in #38293
• Fix empty AIC cells in daily guardrail summary when no prior runs exist in 24h window by @Copilot in #38304
• Remove gh_aw.aic OTLP metric emission and keep AIC on traces only by @Copilot in #38312
• fix: emit gh-aw.aic for all engines by recognizing github_models provider alias by @Copilot in #38314
• Add PR-targeting support to create_check_run (including target: "*" flows) by @Copilot in #38237
• [instructions] Sync instruction files with release v0.79.3 by @github-actions[bot] in #38316
• [spec-extractor] Update package specifications for tty, types, typeutil, workflow by @github-actions[bot] in #38334
• feat: require operator-authored justification for dangerously-disable-sandbox-agent by @Copilot in #38325
• fix: wire GH_AW_AIC and GH_AW_MAX_AI_CREDITS to Handle agent failure step by @Copilot in #38327
• Cap impacted Go test selection at ~1 minute via sampled unit tests by @Copilot in #38343
• CJS: ignore impacted JS runs when no matching test files exist by @Copilot in #38339
• pkg/linters: extract inspector helper, migrate to Cursor API, add autofixes by @Copilot in #38317
• fix: usage tracking for engine jobs in sendJobConclusionSpan by @mnkiefer in #38353
• [docs] Update documentation for features from 2026-06-10 by @github-actions[bot] in #38351
• chore: remove user-invokable and disable-model-invocation from the gh-aw schema by @Copilot in #38328
• Updating daily token consumption report to new AIC format by @Copilot in #38362
• fix(assign_milestone): scope milestone cache by owner/repo to prevent cross-repo pollution by @Copilot in #38342
• docs: source AIC pricing from models.dev catalog by @Copilot in #38371
• Bound sampled impacted Go test patterns to prevent go test argv overflow by @Copilot in #38381
• Add models frontmatter field for custom model pricing by @Copilot in #38276
• Record agent failure categories as OTLP attribute for counting by @Copilot in #38331
• feat: raise safe_outputs default timeout to 45m and add safe-outputs.timeout-minutes frontmatter by @Copilot in #38361
• fix: SHA-pin the runtime setup-cli step emitted for custom steps: workflows by @Copilot in #38344
• Replace /reference/auth engine-secret table with header/list reference blocks by @Copilot in #38390
• fix(telemetry): emit gh-aw.aic=0 and fall back to engine-reported AIC when firewall proxy reports zero by @Copilot in #38364
• optimize: reduce claude-code-user-docs-review AIC cost ~20–33% by eliminating redundant main-agent work by @Copilot in #38401
• docs: recommend copilot-requests: write for Copilot authentication by @Copilot in #38404
• Expand Daily AIC report to include Grafana telemetry and backend-specific AIC gaps by @Copilot in #38400
• [docs] docs: unbloat monitoring-with-projects.md by @github-actions[bot] in #38417
• [WIP] Fix failing GitHub Actions job 'js-typecheck' by @Copilot in #38397
• [WIP] Explore agent persona and scenarios for agentic workflows by @Copilot in #38407
• Propagate resolved AI credits into failure footer context by @Copilot in #38412

Full Changelog: v0.79.3...v0.79.4