github/gh-aw v0.87.7 on GitHub

What's Changed

Use mai-code-1-flash-picker model in pr-triage-agent by @pelikhan with @Copilot in #55643
Treat GitHub Actions bot PRs as trusted contributions by @pelikhan with @Copilot in #55645
[WIP] Fix failing GitHub Actions job Integration: Workflow Features by @pelikhan with @Copilot in #55638
[WIP] Fix failing lint-go-golangci GitHub Actions job by @pelikhan with @Copilot in #55648
Add PDF-aware preliminary investigation to arXiv research by @pelikhan with @Copilot in #55644
[trajectory-grader] Implement recurrence-laminarity by @pelikhan with @Copilot in #55659
Collapse manual PR recovery instructions into a details section by @pelikhan with @Copilot in #55667
Make generated Copilot setup workflows Zizmor-compliant by @pelikhan with @Copilot in #55641
Fix RGS-008: render HTTP MCP header secrets as shell env vars in TOML config by @pelikhan with @Copilot in #55658
eslint-factory: handle getExecOutput exitCode checks across reassignment and helper returns by @pelikhan with @Copilot in #55677
Bump default CLI/MCP versions: Claude Code, Codex, Pi, GitHub MCP Server by @pelikhan with @Copilot in #55676
Suppress RGS-012 finding for pinned GitHub remote MCP handshake curl by @pelikhan with @Copilot in #55686
Verify RGS-008 secret-interpolation finding is not reproducible; add regression test by @pelikhan with @Copilot in #55685
Harden uv/grype exec argument boundaries for Sighthound command-injection findings by @pelikhan with @Copilot in #55675
eslint-factory: resolve promisify()-wrapped child_process bindings in prefer-actions-exec-over-child-process by @pelikhan with @Copilot in #55687
Fix Daily VulnHunter Scan hitting LLM invocation cap (40/40) by @pelikhan with @Copilot in #55694
Fix false-positive gate failure in Daily Container Image Security Scan by @pelikhan with @Copilot in #55695
Remove unreferenced $defs entries from main workflow schema by @pelikhan with @Copilot in #55699
Add MCP handshake diagnostics to raw_mcp_canary by @pelikhan with @Copilot in #55697
Add operational value grader to daily file diet workflow by @mnkiefer in #55705
Fix full local Go and JavaScript test suites by @dsyme in #55559
Fix arXiv link redaction and add quick-win agentic prompts by @pelikhan with @Copilot in #55702
[test-parallel] test: add t.Parallel() to safe Go tests (daily batch) by @github-actions[bot] in #55704
[actions] Update GitHub Actions versions - 2026-08-25 by @github-actions[bot] in #55709
Expose Copilot web_fetch when tools.web-fetch is enabled by @pelikhan with @Copilot in #55696
[eslint-miner] Add ESLint rule: require-decodeuricomponent-try-catch by @github-actions[bot] in #55726
[docs] Update glossary - daily scan by @github-actions[bot] in #55746
Bump vite from 8.2.1 to 8.2.2 in /actions/setup/js by @dependabot[bot] in #55745
Bump @vitest/coverage-v8 from 4.1.10 to 4.1.11 in /actions/setup/js by @dependabot[bot] in #55744
Bump astro from 7.2.2 to 7.2.4 in /docs by @dependabot[bot] in #55739
Bump starlight-blog from 0.28.0 to 0.29.0 in /docs by @dependabot[bot] in #55738
Bump mermaid from 11.16.1 to 11.17.0 in /docs by @dependabot[bot] in #55736
Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #55737
Bump @astrojs/markdown-remark from 7.2.2 to 7.2.4 in /docs by @dependabot[bot] in #55741
Bump starlight-changelogs from 0.5.1 to 0.6.0 in /docs by @dependabot[bot] in #55735
Bump charm.land/bubbletea/v2 from 2.0.8 to 2.0.9 by @dependabot[bot] in #55740
Restore two-day schedules for smoke agentic workflows by @pelikhan with @Copilot in #55782
[ci-coach] Fix prettier formatting in eslint-factory test file by @github-actions[bot] in #55789
Prevent docs automation from editing primary messaging by @pelikhan with @Copilot in #55790
Add targeted copy-guard workflow for README.md and docs index.mdx by @pelikhan with @Copilot in #55791
Move steer to the safe-outputs root by @pelikhan with @Copilot in #55792
[test-parallel] Add t.Parallel() to safe linter test files (batch) by @github-actions[bot] in #55808
[blog] Agent of the Day – 2026-08-25 by @github-actions[bot] in #55805
Document the graders CLI command by @pelikhan with @Copilot in #55794
Fix swapped openai/anthropic ports in AWF api-proxy gateway constants by @pelikhan with @Copilot in #55693
Persist safe-outputs failure diagnostics as an artifact and fix blank create_issue titles by @pelikhan with @Copilot in #55701
Split over-length functions in orchestrator tools and safe-outputs job compiler files by @pelikhan with @Copilot in #55703
Split add command implementation into focused modules by @pelikhan with @Copilot in #55785
Add shared custom grader imports to agentic workflows by @pelikhan with @Copilot in #55831
[test-parallel] test: add t.Parallel() to safe linter analyzer tests by @github-actions[bot] in #55832
Deduplicate MCP schema default injection by @pelikhan with @Copilot in #55795
Rename audit report finding type by @pelikhan with @Copilot in #55801
Formalize forecast Monte Carlo compliance coverage by @pelikhan with @Copilot in #55817
Tighten daily SPDD spec maintenance items by @pelikhan with @Copilot in #55820
Fix AI Moderator Codex crash: seed CODEX_HOME into cloud-hypervisor filesystem allow-list by @pelikhan with @Copilot in #55711
Rename aw-value skill to operational-value-designer and update grader guidance references by @pelikhan with @Copilot in #55829
Render grader values in collapsible step summary by @pelikhan with @Copilot in #55823
Extend semantic-type convention: add ArtifactName/Filename/FilePath to pkg/constants by @pelikhan with @Copilot in #55787
Add recurrence-trapping-time trajectory grader (RQA TT) and update grader catalog status by @pelikhan with @Copilot in #55834
Pin Linter Miner to a supported Copilot model by @pelikhan with @Copilot in #55837
Add YAML dashboard language specification by @pelikhan with @Copilot in #55841
Give GitHubReposScope a concrete type by @pelikhan with @Copilot in #55793
Add daily dashboard language specification review by @pelikhan with @Copilot in #55867
docs: clarify Pi provider-prefixed model configuration by @pelikhan with @Copilot in #55865
Add depguard rule blocking imports of unmaintained x/crypto/openpgp by @pelikhan with @Copilot in #55882
Make design-decision-gate run-success message outcome-specific by @pelikhan with @Copilot in #55884
docs: expand Troubleshooting section in mcp-scripts reference by @pelikhan with @Copilot in #55883
Remove bounded-queries support (replaced by enclaves) by @pelikhan with @Copilot in #55839
Replace template-injection grep with parsed workflow check by @pelikhan with @Copilot in #55863
Add govulncheck gate to Go CI by @pelikhan with @Copilot in #55889
Allow npm registry access for workflow agents by @pelikhan with @Copilot in #55890
[test-parallel] test: add t.Parallel() to safe bootstrap_profile_helpers_test.go tests by @github-actions[bot] in #55892
[docs] docs: unbloat inline sub-agents reference by @github-actions[bot] in #55905
[community] Update community contributions in README by @github-actions[bot] in #55915
[log] Add debug logging to pkg/actionpins gap functions by @github-actions[bot] in #55927
[compiler-threat-spec] Extend CTR-006 mapping with MCP guard-policy template escaping (spec 1.0.27) by @github-actions[bot] in #55916
Add FormatDurationMs/FormatDurationNs coverage and testify assertions in pkg/timeutil by @pelikhan with @Copilot in #55891
[test-parallel] test: add t.Parallel() to safe tests in pkg/cli (batch) by @github-actions[bot] in #56039
[docs] Update glossary - daily scan by @github-actions[bot] in #56004
[spec-extractor] Update package specifications for tty, types, typeutil, workflow by @github-actions[bot] in #55999
[instructions] Sync instruction files with release v0.87.5 by @github-actions[bot] in #55990
Allow npm/go module domains for Daily Reliability Review and Daily Secrets Analysis by @pelikhan with @Copilot in #55973
refactor(timeutil): unify duration formatters to eliminate minute-boundary artifacts by @pelikhan with @Copilot in #55958
Fail fast on approve_workflow_run permission denials to stop safe-outputs API storm by @pelikhan with @Copilot in #55957
Harden zizmor Docker invocation and validate scanner image references by @pelikhan with @Copilot in #55956
Warn when workflow dispatches share conclusion concurrency by @pelikhan with @Copilot in #55836
Fix double blank line before Flags: in 7 CLI commands' help output by @pelikhan with @Copilot in #56052
Define deterministic dashboard custom-link semantics by @pelikhan with @Copilot in #56056
Fix Daily Documentation Diagram allowed-files globs rejecting its own dated SVG by @pelikhan with @Copilot in #56051
[blog] Agent of the Day – 2026-08-26 by @github-actions[bot] in #56064
Allow gh aw edit on source-managed workflows by @dsyme with @Copilot in #55875
[yamllint-fixer] Fix yamllint indentation warnings in workflow_call on: sections by @github-actions[bot] in #55921
Add create-if-missing option to add-labels safe output by @pelikhan with @Copilot in #56055
Add pending formal predicate tests for OTel outcome/mirror/security/reliability spec (§13-16) by @pelikhan with @Copilot in #56077
docs: add GitHub official documentation links to self-hosted runners reference by @pelikhan with @Copilot in #56071
Close SPDD daily gaps: AWF Approach section, forecast anchor sync test, MCP tool-filter fixture, T-CTR naming guard by @pelikhan with @Copilot in #56080
Document advanced frontmatter configuration options by @pelikhan with @Copilot in #56090
[test-parallel] test: add t.Parallel() to safe Go tests in pkg/cli (batch) by @github-actions[bot] in #56087
[eslint-miner] eslint-factory: add no-json-stringify-equality rule by @pelikhan with @Copilot in #56069
Refactor aw-failure-investigator deterministic prefetch from Python to actions/github-script by @pelikhan with @Copilot in #56099
[test-parallel] test: add t.Parallel() to safe CLI tests (batch 10) by @github-actions[bot] in #56118
Allow permissions: none shorthand in schema validation by @pelikhan with @Copilot in #55972
Decode bootstrap and engine configuration maps into typed structs by @pelikhan with @Copilot in #56068
[test-parallel] test: add t.Parallel() to safe top-level tests in pkg/cli by @github-actions[bot] in #56136
feat(audit): add cluster and pattern analysis to cross-run audit by @pelikhan with @Copilot in #56072
Retry Claude runs after AWF/MCP startup failures by @pelikhan with @Copilot in #55864
Suppress Codex rebuild guard after terminal safe-output by @pelikhan with @Copilot in #56067
Surface graders data in logs and audit commands by @pelikhan with @Copilot in #56066
Type experiment storage as an enum by @pelikhan with @Copilot in #56059
Narrow child_process exec handle-retention exemptions by @pelikhan with @Copilot in #56091
Apply cross-run audit clustering to graders and evals by @pelikhan with @Copilot in #56146
[test-parallel] Add t.Parallel() to safe Go tests (batch: git_helpers–lint_command) by @github-actions[bot] in #56154
Lint shell scripts declared in workflow frontmatter by @pelikhan with @Copilot in #56150
[test-parallel] Add t.Parallel() to safe Go test candidates (episode, fallback integration, filtering) by @github-actions[bot] in #56216
[docs] docs: fix spelling errors in AstroStyleLite content by @github-actions[bot] in #56240
[ubuntu-image] docs: update Ubuntu runner image analysis (20260816.277) by @github-actions[bot] in #56243
[log] Add debug logging to copilot permissions, gh-aw-ref resolution, and add command by @github-actions[bot] in #56241
[docs] docs: unbloat OrchestratorOps page by @github-actions[bot] in #56207
Fix step summary rendering by moving WSRF block out of token usage details by @pelikhan with @Copilot in #56264
Ignore broccoli-labeled PRs in triage workflows by @pelikhan with @Copilot in #56260
[trajectory-grader] Implement recurrence-rate (Tier 1, rank 9) by @pelikhan with @Copilot in #56256
Add missing description frontmatter to 8 .github/aw spec docs by @pelikhan with @Copilot in #56262
Update stale notYetEnforced rationale for largefunc, excessivefuncparams, and errormessage by @pelikhan with @Copilot in #56258
[code-scanning-fix] Fix go/bad-redirect-check: incomplete leading-slash validation in manifest path check by @github-actions[bot] in #56219
[community] Update community contributions in README by @github-actions[bot] in #56227
Add remove_redundant_context_v1 A/B experiment to pr-sous-chef workflow by @pelikhan with @Copilot in #56257
[test-parallel] test: add t.Parallel() to safe pkg/cli logs tests (daily batch) by @github-actions[bot] in #56275
Trim redundant guardrail recap in Issue Monster; skip unsafe cli-proxy suggestion for AI Moderator by @pelikhan with @Copilot in #56274
Fix pricing discrepancies for gpt-5.6-sol and gemini-3.6-flash in models.json by @pelikhan with @Copilot in #56272
Allow strict-mode workflows to pass AWF --image-tag while keeping sandbox.agent.args locked down by @pelikhan with @Copilot in #56265
[docs-diagram] Add workflow sharing/distribution diagram to Using at Scale guide by @github-actions[bot] in #56283
E007: ignore inert code-region mentions in comment limit enforcement by @pelikhan with @Copilot in #56269
Resolve dispatch workflow refs from PR comments by @pelikhan with @Copilot in #56266
Use explicit PR head baseline for fork PR branch updates by @dsyme with @Copilot in #56119
[actions] Update GitHub Actions versions - 2026-08-27 by @github-actions[bot] in #56308
[instructions] Sync instruction files with release v0.87.5 by @github-actions[bot] in #56334
[test-parallel] test: add t.Parallel() to safe command_groups_test.go tests by @github-actions[bot] in #56336
Treat primitive decodeURI arguments as statically safe by @pelikhan with @Copilot in #56331
Go Fan: remove hard dependency on blocked network tools for module prioritization by @pelikhan with @Copilot in #56324
[aw] Reduce Daily Storify log footprint to prevent runner ENOSPC failures by @pelikhan with @Copilot in #56323
Clarify ESLint try/catch diagnostic guidance by @pelikhan with @Copilot in #56332
[aw] Route Daily Evals Feature Report through Copilot model path by @pelikhan with @Copilot in #56327
Extend MCP gateway readiness timeout by @pelikhan with @Copilot in #56315
Bump default CLI and MCP versions by @pelikhan with @Copilot in #56329
Add issue-only permission controls to remove-labels by @pelikhan with @Copilot in #56270
[spec-extractor] Fix corrupted table row in pkg/cli/README.md by @github-actions[bot] in #56347
[WIP] Fix failing GitHub Actions job 'Unit tests (S-Z and other)' by @pelikhan with @Copilot in #56346
[fp-enhancer] Improve pkg/scanfindings: pure declarative FormatMessage by @github-actions[bot] in #56348
[WIP] Fix failing GitHub Actions job 'Unit tests (A-C)' by @pelikhan with @Copilot in #56345
Fix safe-output updates for fork pull request branches by @dsyme in #56341
[docs] Update glossary - daily scan by @github-actions[bot] in #56355
Harden Docker scanner exec paths against argv/path injection by @pelikhan with @Copilot in #56333
Always configure OTLP from enterprise default variables and secrets by @pelikhan with @Copilot in #56353
Include grader evaluator scripts in workflow packages by @pelikhan with @Copilot in #56268
Clarify prerelease upgrade downgrade guidance by @pelikhan with @Copilot in #56351
Fix user-rate-limit alias schema and event fallback by @pelikhan with @Copilot in #56328
Add daily grader audit workflow by @pelikhan with @Copilot in #56359

Full Changelog: v0.87.5...v0.87.7