Skip to content

Update dependency github/gh-aw to v0.82.13 (main)#280905

Open
elastic-renovate-prod[bot] wants to merge 3 commits into
mainfrom
renovate/main-gh-aw
Open

Update dependency github/gh-aw to v0.82.13 (main)#280905
elastic-renovate-prod[bot] wants to merge 3 commits into
mainfrom
renovate/main-gh-aw

Conversation

@elastic-renovate-prod

@elastic-renovate-prod elastic-renovate-prod Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
github/gh-aw minor v0.81.6 → v0.82.13 v0.83.1 (+1)
github/gh-aw action minor v0.81.6 → v0.82.13 v0.83.1 (+1)

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

github/gh-aw (github/gh-aw)

v0.82.13

Compare Source

🌟 Release Highlights

This release brings smarter ESLint rule detection, improved audit accuracy, and key bug fixes across the CLI, workshop, and setup tooling — with a notable breaking change in gh aw add.

⚠️ Breaking Changes
  • gh aw add now rejects packages with aw.yml config — packages that include an aw.yml configuration file will no longer be accepted. Update any such packages before upgrading. See PR #​46273 for details.
✨ What's New
  • Auto-configure COPILOT_PROVIDER_WIRE_API from the model catalog (#​46156) — The CLI now automatically resolves the provider wire API endpoint from the model catalog, reducing manual configuration overhead.
  • Default-on issue intent metadata (#​46207) — set_issue_type, set_issue_field, and add_labels now emit issue intent metadata by default, enabling richer audit trails without extra configuration.
  • NO_COLOR support for stdout (#​46197) — The CLI now honours the NO_COLOR environment variable, improving compatibility with non-interactive and accessibility-focused terminals.
  • Stronger ESLint alias detection (#​46365) — The no-core-setoutput/exportvariable rules now catch aliased and destructured @actions/core bindings, closing a common bypass pattern.
  • Debug logging across CLI bootstrap and logs orchestration (#​46337) — New structured debug output makes it easier to trace startup and log-download behaviour.
🐛 Bug Fixes & Improvements
  • Accurate safe-output write counts in audit reports (#​46360) — SafeItemsCount is now correctly populated in run_summary.json, so audit dashboards reflect real write activity.
  • Workshop progress rail and overflow fixes (#​46378) — Resolves state coupling in the progress rail and responsive overflow issues in the workshop UI.
  • ESLint spawn-error alias guard (#​46199) — Single-assignment aliases of spawn errors are now correctly recognised as valid guards, reducing false positives.
  • mapdeletecheck autofix safety (#​46159) — Autofixes are now suppressed when comments overlap the replaced span, preventing incorrect edits.
  • Setup-JS error resilience (#​46102) — All synchronous filesystem calls in actions/setup/js are now wrapped in try/catch blocks.
  • Integer overflow fix in allocation size hints (#​46375) — Resolves a go/allocation-size-overflow code scanning alert.
📚 Documentation
  • Workshop view guide added (#​46237) — New documentation covering the workshop UI view.
  • Ephemerals reference streamlined (#​46288) — The ephemerals reference page has been trimmed for clarity and readability.
  • ESLint factory rules documented (#​46361) — Six previously undocumented ESLint factory rules now have full README entries.

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🚀 Release · 18.1 AIC · ⊞ 7.8K

What's Changed

Full Changelog: github/gh-aw@v0.82.12...v0.82.13

v0.82.12

Compare Source

🌟 Release Highlights

This release brings usability improvements to gh aw add, important security fixes for agent sandboxing, and a wave of internal refactoring that strengthens the codebase quality and consistency.

✨ What's New
  • gh aw add bootstrap by default — The package manifest config bootstrap flow now runs automatically when adding a new workflow, reducing manual setup steps.
  • Enhanced GitHub host detection — PAT creation and setup commands now correctly detect GitHub host variants, improving multi-environment setups.
  • New mapclearloop linter — Automatically replaces range-delete loops with the idiomatic clear(m) call, keeping generated Go code clean and modern.
🐛 Bug Fixes & Improvements
  • Agent sandbox credential isolation — Job-output credential env vars are now correctly excluded from the agent sandbox (--exclude-env), preventing inadvertent credential leakage.
  • External threat detection — Custom engine base URLs and allowlist propagation are now properly honored, fixing false-negative detections in custom environments.
  • SHA-pinned action version comments — Fixed a bug where version comments were lost when SkipHardcodedFallback was set, restoring full audit traceability.
  • MAI model update — Updated to mai-code-1-flash-picker with improved sandbox test isolation.
  • ESLint error-handling normalization — Consistent error-handling patterns in actions/setup/js improve reliability of generated JavaScript setup steps.
  • Release PR comment throttling — Rate-limit-safe posting prevents secondary rate limit errors during busy release cycles.
🔧 Internal

Extensive refactoring this release: unified token-usage metrics (TokenCoreMetrics), options-struct patterns to eliminate excessive function parameters, shared analysis base types, and consolidated AST predicates across linters.

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🚀 Release · 16.7 AIC · ⊞ 7.6K

What's Changed

Full Changelog: github/gh-aw@v0.82.11...v0.82.12

v0.82.11

Compare Source

🌟 Release Highlights

This release focuses on improved onboarding, stronger safe-outputs reliability, expanded eval coverage, and a wave of targeted bug fixes across the agentic harnesses and compiler toolchain.

✨ What's New
  • Streamlined gh aw add setup — The package manifest config bootstrap flow now runs automatically, reducing manual configuration steps when adding new workflows. (#​46041)
  • Preconfigured Copilot PAT onboarding in gh aw add-wizard — The wizard now walks users through setting up a Copilot Personal Access Token, making first-time setup smoother. (#​45987)
  • Fork-backed safe-output pull request support — Safe outputs now support creating pull requests from fork-backed branches, expanding the supported workflow topologies. (#​45909)
  • GitHub MCP Server upgraded to v1.6.0 — The bundled MCP server is now at v1.6.0 with fields_param enabled by default, giving workflows access to richer GitHub data. (#​45832)
  • Issue-intent metadata required for close/assignment tools — close and assign_to_agent tools now require issue-intent metadata by default (with per-tool opt-out), reducing unintentional issue state changes. (#​46014)
  • Evals expanded to 24 more workflows — Automated evaluation coverage has been significantly broadened, improving reliability signals across the workflow library. (#​45984)
  • PR sous-chef surfaces failed checks in nudge comments — When a PR is nudged, failed CI checks are now included in the comment, making it easier to act on blocking issues. (#​45957)
🐛 Bug Fixes & Improvements
  • Fix repositories: ["*"] in GitHub App token minting — Activation tokens now correctly honor wildcard repository scopes. (#​45908)
  • Decouple safe-outputs client token from project token — The Process Safe Outputs client token is now independent of the project-specific token, fixing token confusion in multi-project setups. (#​45999)
  • Fix compiler version normalization for git describe output — Version strings from git describe are now normalized correctly before use in compiled workflows. (#​46030)
  • Fast-fail Copilot harness on LLM invocation cap — When the LLM invocation cap is saturated, the Copilot harness now fails fast instead of hanging. (#​45827)
  • Exempt large body/content fields from SM-IS-01 10 KB cap — Added maxLength: 65536 to body and content fields so large payloads are not incorrectly rejected. (#​45826)
  • Detect Claude Code 401 auth errors in claude_harness — Authentication failures from Claude Code are now caught and reported clearly. (#​45982)
  • Fix Pi JSONL eval log parsing — YES/NO answers in Pi engine JSONL log format are now parsed correctly. (#​45960)
  • Align actionlint to v1.7.12 — All references now use a consistent actionlint version. (#​45979)
  • Prevent spurious .github symlink probes — The frontmatter hash GitHub API reader no longer emits false symlink probe requests. (#​45989)
  • Improve unknown model pricing errors — Better error messaging and accurate issue titles when a model's pricing data is missing. (#​45985)
  • Prevent duplicate "Download container images" step in Codex evals — A duplicate step in the generated Codex evals job is now correctly suppressed. (#​45991)

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🚀 Release · 33.8 AIC · ⊞ 7.6K

What's Changed

Full Changelog: github/gh-aw@v0.82.10...v0.82.11

v0.82.10

Compare Source

🌟 Release Highlights

This release brings declarative custom-engine support, expanded evals infrastructure, CLI improvements, and an important security default change — alongside a strong wave of bug fixes and code quality improvements.

⚠️ Breaking Changes
  • Strict security mode is now the default — sudo injection and --enable-host-access are no longer injected automatically. Workflows relying on these must opt in explicitly. (#​45360)
✨ What's New
  • Declarative custom-engine frontmatter — Crush, OpenCode, and other engines can now be declared via shared behavior definitions in frontmatter, removing boilerplate and improving portability. (#​44465)
  • engine.driver frontmatter field — New reference field lets you pin workflows to a specific engine driver. Learn more (#​45420)
  • Evals on agentic workflows — BinEval evals enabled on 10 workflows; daily evals report added; evals results now captured in conclusion usage artifacts; --evals flag added to logs and audit commands for filtering. (#​45751, #​45805, #​45373)
  • Bootstrap config consolidation — gh aw add and gh aw add-wizard now share a unified config; the actions subcommand is renamed to config for clarity. (#​45758)
  • Azure OpenAI BYOK support documented — New guide covers bringing your own Azure OpenAI key for Copilot workflows. (#​45276)
  • nilctxpassed Go linter — New analyzer catches nil context passed to functions, preventing hard-to-debug runtime panics. (#​45799)
🐛 Bug Fixes & Improvements
  • Fixed secrets context leaking into ignore-if-missing guard expressions, which could silently suppress legitimate failures. (#​45828)
  • Fixed update_project silently ignoring string-typed fields by iterating over characters instead of field names. (#​45825)
  • Fixed missing id-token: write permission on activation/conclusion/safe_outputs jobs for OTLP OIDC auth. (#​45823)
  • Fixed a recurring 60 s timeout in the logs MCP tool that was corrupting audit datasets. (#​45714)
  • Fixed MCP gateway config to use raw header serialization for the GitHub remote Authorization header. (#​45335)
  • Fixed safe-outputs scope rejection incorrectly triggering when the agent changeset had no workflow files. (#​45870)
  • CLI consistency pass: --no-staged renamed for clarity, -e shorthand added to logs, grammar and style fixes. (#​45280)
  • Reduced GitHub API consumption in PR review cluster via pre-fetching and caching (~significant reduction in rate-limit pressure). (#​45431)
📚 Documentation
  • New BinEval syntax and question decomposition guide at .github/aw/evals.md. (#​45833)
  • Replaced deprecated dispatch_repository reference block with a migration note. (#​45786)
  • CLI help text, shared flag usage, and setup docs aligned for consistency. (#​45753)

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🚀 Release · 16.9 AIC · ⊞ 7.6K

What's Changed

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@elastic-renovate-prod elastic-renovate-prod Bot added backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Operations Kibana-Operations Team labels Jul 25, 2026
@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team as a code owner July 25, 2026 10:19
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 25, 2026

Copy link
Copy Markdown

Pinging @elastic/kibana-operations (Team:Operations)

@kibanamachine
kibanamachine requested a review from a team as a code owner July 25, 2026 10:26
@kibanamachine

kibanamachine commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

💚 Build Succeeded

History

@elastic-renovate-prod

elastic-renovate-prod Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Operations Kibana-Operations Team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kibanamachine