chore(deps): update github/gh-aw action to v0.74.8

[release-workflows]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
github/gh-aw	action	minor	v0.43.18 → v0.74.8

---

Release Notes

github/gh-aw (github/gh-aw)

v0.74.8

Compare Source

🌟 Release Highlights

This release strengthens reliability, developer experience, and observability with daily automated reviews, improved error messages, and enhanced telemetry instrumentation.

✨ What's New

🔍 Daily Reliability Review — A new scheduled workflow automatically detects and reports gh-aw reliability issues using Sentry observability data, querying for failures, timeouts, cancellations, and token truncations. The workflow creates prioritized findings with actionable recommendations, helping maintainers catch issues early. (#​33493)

💡 Fuzzy "Did You Mean?" Suggestions — Validation errors now include helpful suggestions when you mistype engine names, events, permissions, or MCP types (e.g., invalid engine: copiliot → Did you mean: copilot?). The feature uses Levenshtein distance matching to catch common typos during compilation. (#​33467)

📍 File/Line Context in Validation Errors — Validation errors now show file:line:col: positioning so IDE tooling can jump directly to the problematic field, eliminating manual searches through workflow files. (#​33466)

💭 Reasoning Message Rendering — Reasoning content (Claude extended thinking blocks, Codex thinking sections, Copilot reasoning_text) now renders with a distinct ◯ open circle icon and italic styling, making agent thought processes visible and distinguishable from regular output. (#​33464)

🐛 Bug Fixes & Improvements

Telemetry Instrumentation — Fixed four critical OTLP gaps: service.version fallback to GITHUB_SHA, gen_ai.response.finish_reasons always emitted, timeouts distinguished from failures, and gen_ai.usage.total_tokens now tracked. (#​33528, #​33510)

Network Access — Added patch-diff.githubusercontent.com to the GitHub domain ecosystem, allowing workflows using network.allowed: [github] to fetch PR diffs without blocking. (#​33543)

Linter Improvements — Enhanced analyzer ergonomics with ctxbackground autofix, consistent test-file handling, and range-based diagnostics for better IDE integration. (#​33541)

Code Quality — Resolved 12 lint violations including functions exceeding parameter limits (refactored to options structs), context.Background() calls in functions already receiving ctx, and os.Exit() calls in library packages. (#​33452)

📚 Documentation

Developer Specifications — Consolidated developer documentation with 7 tone fixes across 4 spec files, removing marketing language and subjective phrasing. (#​33566)

Reference Updates — Added Gemini 3.5 Flash model configuration, documented footer-install template behavior, and specified JSON workflow field mapping for Copilot automation API imports. (#​33522)

Glossary Expansion — Daily glossary scan added terms for tools.github.allowed-repos, repository access restrictions, and other workflow configuration options. (#​33519)

🔧 Internal

MCP Refactoring — Extracted duplicated MCP wrapper logic into renderDefaultJSONMCPConfig helper, eliminating 10-12 line code blocks across four JSON engines. (#​33482)

Chaos Testing — Updated Chaos PR Bundle Fuzzer to allow modifications to tests/chaos/** in safe-output PR creation. (#​33553)

Workflow Cleanup — Removed centralized pull_request_reviewer dispatching from agentic_commands.yml, simplifying workflow routing. (#​33542)

---

For complete details, see CHANGELOG.

Generated by 🚀 Release · ● 3.9M

---

What's Changed

• feat: render reasoning/thinking messages with ◯ icon and italic styling by @​Copilot in #​33464
• fix: resolve 12 lint violations — excess params, context.Background, os.Exit by @​Copilot in #​33452
• chore: update otlp.md with xml docs by @​mnkiefer in #​33468
• feat: add daily reliability review via sentry by @​mnkiefer in #​33493
• Strengthen shared Sentry prompts for grounded reliability triage by @​Copilot in #​33499
• fix(otlp): service.version fallback, timeout vs failure, finish_reasons, total_tokens by @​Copilot in #​33510
• Improve Daily Reliability Review readability with progressive disclosure by @​Copilot in #​33523
• [spec-enforcer] Enforce specifications for errorutil, syncutil, jsonutil by @​github-actions[bot] in #​33527
• [docs] Update documentation for features from 2026-05-20 by @​github-actions[bot] in #​33522
• [docs] Update glossary - daily scan by @​github-actions[bot] in #​33519
• feat: add file/line context to validation errors by @​Copilot in #​33466
• [plan] Migrate high-impact validation paths to NewValidationError with actionable YAML guidance by @​Copilot in #​33491
• refactor: extract renderDefaultJSONMCPConfig to eliminate duplicated MCP wrapper logic by @​Copilot in #​33482
• fix(otlp): always emit gen_ai.response.finish_reasons; use GITHUB_SHA as service.version fallback by @​Copilot in #​33528
• Add sub_agent_strategy A/B experiment to smoke-gemini workflow by @​Copilot in #​33540
• Allow patch-diff.githubusercontent.com in the GitHub domain ecosystem by @​Copilot in #​33543
• Remove centralized pull_request_reviewer dispatching from agentic_commands.yml by @​Copilot in #​33542
• Improve linter analyzer ergonomics: ctxbackground autofix, test-file parity, and range diagnostics by @​Copilot in #​33541
• Allow Chaos PR Bundle Fuzzer to modify tests/chaos/** in safe-output PR creation by @​Copilot in #​33553
• [docs] Consolidate developer specifications v9.12: 7 tone fixes across 4 files by @​github-actions[bot] in #​33566
• feat: fuzzy "Did you mean?" suggestions for engine, event, permission, and MCP type typos by @​Copilot in #​33467
• Update Daily OTel Advisor to use shared Sentry/Grafana OTEL MCP imports by @​Copilot in #​33570
• [blog] Agent of the Day – 2026-05-20 by @​github-actions[bot] in #​33568

Full Changelog: github/gh-aw@v0.74.7...v0.74.8

v0.74.7

Compare Source

🌟 Release Highlights

A focused maintenance release that strengthens workflow activation handling and improves code maintainability.

🐛 Bug Fixes & Improvements

Workflow Activation & Routing

• Fixed pull request review activation - Resolved hybrid routing conflicts where pull_request_review events were incorrectly processed, ensuring reviewer lifecycle events bypass slash-command gating for smoother automated reviews
• Improved reaction handling - The add_reaction safe-output now correctly processes pull_request_review activation events
• Stabilized secret replacement - Eliminated non-deterministic behavior in workflows using shared fallback expressions, making secret handling more reliable

Code Quality

• Simplified schedule parser - Refactored complex functions into focused helpers for better maintainability and readability
• Cleaned up semantic clustering - Deduplicated linter helpers, removed stub files, and improved naming consistency across the codebase

Developer Experience

• Enhanced safe-output guidance - Strengthened anti-probing documentation for add_comment and create_issue to prevent common workflow authoring mistakes

---

For complete details, see CHANGELOG.

Generated by 🚀 Release · ● 2.9M

---

What's Changed

• [community] Update community contributions in README by @​github-actions[bot] in #​33439
• Fix non-deterministic secret replacement in workflows with shared fallback expressions by @​Copilot in #​33441
• Bypass slash-command gating for pull_request reviewer lifecycle events by @​Copilot in #​33447
• [safeoutputs] Strengthen anti-probing guidance for add_comment and create_issue by @​Copilot in #​33433
• Handle pull_request_review activation reactions in add_reaction by @​Copilot in #​33449
• [log] Add namespace loggers to three workflow files by @​github-actions[bot] in #​33453
• Refactor schedule parser long functions into focused helpers by @​Copilot in #​33448
• [WIP] Fix failing GitHub Actions job JS Tests (shard 2/4) by @​Copilot in #​33455
• refactor: semantic function clustering — dedup linter helpers, drop stub files, rename outliers by @​Copilot in #​33434
• Remove pull_request_review from on.pull_request_reviewer hybrid routing by @​Copilot in #​33461

Full Changelog: github/gh-aw@v0.74.6...v0.74.7

v0.74.6

Compare Source

🌟 Release Highlights

This maintenance release focuses on workflow import UX improvements, MCP security hardening, and critical bug fixes across safe outputs and workflow triggers.

✨ What's New

Enhanced Workflow Import Experience

• JSON workflow imports now preserve meaningful workflow names instead of GUID-like identifiers (#​33432, #​33421)
• Cleaner import output - removed noisy API metadata and refined import messages for better readability (#​33420, #​33424)
• Copilot workflow imports now support authenticated fetching from api.githubcopilot.com (#​33402)

New Synthetic Trigger: pull_request_reviewer

• Added on.pull_request_reviewer: slash_command for PR reviewer lifecycle dispatch with reviewer-aware concurrency (#​33273)
• Migrated ready-for-review workflows to the new trigger (#​33412)

Model Support

• Added gemini-3.5-flash to model inventory with ET multiplier 14.0 (#​33430)

🐛 Bug Fixes & Improvements

Safe Outputs & Review Handling

• Fixed submit_pull_request_review to gracefully skip when PR review context is unavailable (e.g., workflow_dispatch on main) (#​33435)
• Fixed dispatchWorkflow API version header - now correctly passed as top-level header instead of nested params (#​33419)

MCP Telemetry & Observability

• Zero-byte rpc-messages.jsonl files (MCP server crash/startup failures) now correctly reported as telemetry failures instead of silently passing (#​33358)

Trigger & Event Handling

• Fixed activation steps attempting to add reactions/comments on unsupported pull_request_review events (#​33418)

📚 Documentation

• Updated Astro dependencies to latest and applied Starlight 0.39 sidebar config migration (#​33431)
• Hardened shared MCP allowlists for high-risk servers and documented wildcard policy (#​33384)
• Self-healing documentation fixes from automated issue analysis (#​33414)

🔧 Internal

• Dependency updates: vite 8.0.12→8.0.13, @types/node 25.7.0→25.9.1 (#​33410, #​33407)
• Optimized instruction verbosity in workflow-health runbook and report generation (#​33393)

---

For complete details, see CHANGELOG.

Generated by 🚀 Release · ● 2.4M

---

What's Changed

• Add on.pull_request_reviewer: slash_command synthetic trigger and reviewer lifecycle routing by @​Copilot in #​33273
• [caveman] Optimize instruction verbosity — workflow-health, report (2026-05-19) by @​github-actions[bot] in #​33393
• Treat zero-byte rpc-messages.jsonl as an MCP telemetry failure by @​Copilot in #​33358
• Migrate ready-for-review agentic workflows to pull_request_reviewer by @​Copilot in #​33412
• Harden shared MCP allowlists for high-risk servers and document wildcard policy by @​Copilot in #​33384
• Allow add URL importer auth for api.githubcopilot.com by @​Copilot in #​33402
• [docs] Self-healing documentation fixes from issue analysis - 2026-05-20 by @​github-actions[bot] in #​33414
• fix: pass X-GitHub-Api-Version as top-level header in dispatchWorkflow by @​Copilot in #​33419
• Skip unsupported pull_request_review events in activation reaction/status conditions by @​Copilot in #​33418
• Drop non-config JSON metadata during add/add-wizard import by @​Copilot in #​33420
• Prefer JSON title/name for URL imports when derived workflow name is GUID-like by @​Copilot in #​33421
• Polish JSON-import UX for add/add-wizard output by @​Copilot in #​33424
• Preserve JSON-imported workflow names in add/add-wizard resolution by @​Copilot in #​33432
• Add missing gemini-3.5-flash ET multiplier to model inventory by @​Copilot in #​33430
• [WIP] Fix failing GitHub Actions job lint-go by @​Copilot in #​33429
• [docs] Update Astro dependencies and apply Starlight 0.39 sidebar migration by @​Copilot in #​33431
• Soft-skip submit_pull_request_review when no PR review context is available by @​Copilot in #​33435
• chore(deps-dev): bump @​types/node from 25.7.0 to 25.9.1 in /actions/setup/js by @​dependabot[bot] in #​33407
• chore(deps-dev): bump vite from 8.0.12 to 8.0.13 in /actions/setup/js by @​dependabot[bot] in #​33410

Full Changelog: github/gh-aw@v0.74.5...v0.74.6

v0.74.5

Compare Source

🌟 Release Highlights

This release delivers 125 improvements focused on quality, stability, and developer experience. Key themes include enhanced observability with OpenTelemetry integration, improved CLI tooling with JSON workflow import capabilities, and significant bug fixes addressing authentication, safe-output handling, and workflow compilation edge cases.

✨ What's New

OpenTelemetry Observability & Multi-Backend Support

• Comprehensive OTel documentation and specification (#​33380)
• Support for Datadog, Grafana, and Sentry backends with modular shared imports (#​33202, #​33023)
• Enhanced span attributes including resolved runtime models (gen_ai.response.model) and AWF/AWMG versions (#​33275, #​33030)

JSON Workflow Import

• New CLI capability to import workflows from JSON format with automatic trigger, tool, and permissions mapping (#​33376)
• Support for importing from arbitrary HTTP(S) URLs (#​33164)

Enhanced Error Handling & Developer Experience

• Actionable error message standards with custom linter enforcement (#​33336)
• Prioritized compilation errors with recovery guidance in gh aw compile (#​33337)
• Deprecated frontmatter field warnings via generic schema walker (#​33362)
• Aggregate validation errors (report all issues together) with --fail-fast flag for legacy behavior

AI Engine & Model Improvements

• Per-engine default model aliases with Sonnet-sized agent defaults (#​33182)
• Model inventory updates including raptor-mini alias coverage and GPT-5 search multipliers (#​33177)
• Prompt compression A/B experiments and caveman prompt variant (#​33296, #​33162)

Safe Outputs Enhancements

• Field-name divergence warnings for add_labels, remove_labels, and update_pull_request (#​33170)
• Preserved inline review analysis in 422 body-only fallback (#​33361)
• Prevention of safe-output PR probing from creating stray downstream PRs (#​33044)
• Support for tools.github.allowed-repos: current for repo-scoped MCP guard policies (#​33041)

CLI & Tooling Improvements

• run_id alias support for audit MCP tool parameters (#​33250)
• Lipgloss tree rendering for MCP hierarchy and status dependencies (#​33276)
• Idempotent setup-gh-aw install when gh-aw is already available (#​33240)

🐛 Bug Fixes & Improvements

Authentication & Credential Handling

• Fixed Copilot/Claude/Codex retry loops after authentication failure (stopped futile retries) (#​33093)
• Restored authenticated ls-remote in signed commit push path (#​33178)
• Hardened MCP gh-aw binary discovery for Q dev install paths (#​33321, #​33168)
• GitHub App token minting guarded across workflow paths with missing-key ignore mode (#​33033)

Safe Outputs & Git Operations

• Fixed create_pull_request git am fallback and unrelated safe output cancellation (#​33295)
• Resolved temporary ID substitution in bundle-based signed commit replay (#​33181)
• Branch rename support when recreate-ref deleteRef is blocked by protection rules (#​33163)
• Self-healing cache-memory git setup when restored metadata is corrupt (#​33249)

Workflow Compilation & Validation

• Validation of required workflows: field on workflow_run trigger (#​33191)
• Compile-time rejection of queue: max with cancel-in-progress: true (#​33353)
• Fixed compound || expressions in prompt markdown never substituting at runtime (#​33129)
• Prevention of compile panic when workflow directory contains only shared components (#​33029)
• Fixed OTLP shared import in UK AI operational resilience workflow (#​33036)

Error Context & Reporting

• Rendered report_incomplete reasons in agent failure comments and issue templates (#​33087)
• Agent failure issue matching by stored metadata instead of title alone (#​33089)
• Preserved inline review analysis in 422 body-only fallback (#​33361)
• Derived gh-aw.run.status and status.code from output errors when conclusion env var is absent (#​33037)

Network & Permissions

• Added pypi.org and files.pythonhosted.org to daily-semgrep-scan allowlist (#​33035)
• Exposed reusable workflow network allowlist as opt-in workflow_call input (#​33200)

Dependencies & Build

• Bumped default AWF firewall to v0.25.49 and MCP gateway versions (#​33124, #​32913)
• Updated GitHub Actions versions (2026-05-19) (#​33238)
• Charmbracelet golden pseudo-version bump to 920740d (#​33281)

⚡ Performance

• Reduced CLI Consistency Checker token usage via pre-agent help capture and prompt/frontmatter trimming (#​33363)
• Optimized CLI Consistency Checker via inline small-model sub-agents (#​33179)
• Reduced Step Name Alignment agent turns via deterministic pre-agent manifest (#​33247)
• Optimized instruction verbosity for adr-writer, developer.instructions, agentic-chat (#​33162)
• Trimmed token spend in Matt Pocock skills reviewer workflow (#​33085)

📚 Documentation

• Unbloated documentation for correction-ops.md and integrity reference (#​33375, #​33110)
• Consolidated developer specifications into instructions file v9.11 (#​33323)
• Added pkg/syncutil README and registered dependency in cli/workflow specs (#​33325)
• Strengthened SPDD safeguards and OTel norms across 5 spec files (#​33096)
• Daily/weekly glossary updates and feature documentation (#​33278, #​33283, #​33021, #​33018)
• Normalized report-formatting guidance across reporting workflows (#​33335, #​33220)
• Self-healing documentation fixes from issue analysis (#​32915)
• Architecture diagram updates (2026-05-18) (#​33006)
• Added FAQ guidance for using skills with agentic workflows (#​33034)

🔧 Internal Improvements

• Refactored current-repository lookup caches to shared syncutil.OnceLoader (#​33180)
• Replaced raw log.Print* usage in library packages with package-scoped logger instances (#​33272)
• Refactored parser engine-include tests to table-driven testify assertions (#​33241)
• Extracted resolveSafeOutputIssueTarget to eliminate boilerplate (#​33231)
• Refactored create- config parsing* to shared helper (#​33242)
• Added panic recovery to mcp inspect background goroutines (#​33217)
• Refactored pkg mutex sites to use deferred unlocks consistently (#​33038)
• JavaScript cleanup via jsweep for add_labels.cjs and add_comment.cjs (#​33208, #​32949)
• Centralized 403/410 error classification via errstringmatch linter enforcement (#​33216, #​33117)
• Schema coverage demos for multiple frontmatter fields (pre-steps, models, inline-sub-agents, github-app, environment, dependencies, container, check-for-updates) (#​32985, #​32984, #​32983, #​32981, #​32980, #​32978, #​32977, #​32976)

🌍 Community Contributions

A huge thank you to the community members who reported issues that were resolved in this release!

@Calidus

• bug: gh aw compile should validate required workflows: field on workflow_run trigger

@IEvangelist

• create_pull_request: git am fallback also fails and cancels unrelated safe outputs — needs stronger retry
• Copilot CLI retry loop in copilot_driver.cjs is futile after entrypoint unsets COPILOT_GITHUB_TOKEN between attempts
• report_incomplete context silently dropped: {report_incomplete_context} placeholder missing from agent_failure_comment.md and agent_failure_issue.md
• Failure-issue handler matches by title alone, turning one issue into an unbounded multi-PR / multi-cause / post-expiry comment magnet
• Agent step probes the runtime instead of relying solely on safe-outputs (leaves stray test PRs behind)

@mason-tim

• push_repo_memory broken on signed-commit rulesets: ls-remote missing gitAuthEnv (regression from #​31478)
• Compound || expressions in prompt markdown body never substitute at runtime (compiler/runtime env-var naming mismatch)

@norrietaylor

• Expose network.allowed as a workflow_call input for reusable workflows

@polmichel

• conclusion job's App-token mint step fails hard when GH_AW_APP_ID isn't available and previous step are canceled

@samuelkahessay

• Generated locks emit secret-shaped dummy COPILOT_API_KEY value
• tools.github.allowed-repos cannot express current repository for generated workflows

@wtgodbe

• Bundle-based push path skips temporary ID substitution in file contents

---

Full Details: For complete commit-by-commit changes, see CHANGELOG.

What's Next: We're continuing to improve observability, enhance AI engine capabilities, and refine developer tooling. Stay tuned for more updates!

Generated by 🚀 Release · ● 4.1M

---

What's Changed

• Reject removed tools.serena in parser and align with schema by @​Copilot in #​32909
• [docs] Self-healing documentation fixes from issue analysis - 2026-05-18 by @​github-actions[bot] in #​32915
• Bump default AWF firewall to v0.25.48 and MCP gateway to v0.3.11 by @​Copilot in #​32913
• fix(model-inventory): enrich /reflect null models via models_url fallback by @​Copilot in #​32939
• fix(safe-output): prevent silent 422 on PR review submission by @​Copilot in #​32910
• Revert default firewall/MCP gateway bump from ac0fd25 by @​Copilot in #​32944
• [spec-review] Update Safe Outputs conformance checker for recent spec changes by @​github-actions[bot] in #​32956
• [log] Add debug log statements to 5 workflow compiler files by @​github-actions[bot] in #​32948
• [schema-coverage] feat: Add schema coverage demo for check-for-updates field by @​github-actions[bot] in #​32976
• [specs] Update layout specification - 2026-05-18 by @​github-actions[bot] in #​32990
• [docs] Update glossary - weekly full scan by @​github-actions[bot] in #​33018
• [docs] Update documentation for features from 2026-05-18 by @​github-actions[bot] in #​33021
• [architecture] Update architecture diagram - 2026-05-18 by @​github-actions[bot] in #​33006
• [schema-coverage] feat: Add schema coverage demo for pre-steps field by @​github-actions[bot] in #​32985
• [schema-coverage] feat: Add schema coverage demo for models field by @​github-actions[bot] in #​32984
• [schema-coverage] feat: Add schema coverage demo for inline-sub-agents field by @​github-actions[bot] in #​32983
• [schema-coverage] feat: Add schema coverage demo for github-app field by @​github-actions[bot] in #​32981
• [schema-coverage] feat: Add schema coverage demo for environment field by @​github-actions[bot] in #​32980
• [spec-enforcer] Enforce specifications for cli, console, constants by @​github-actions[bot] in #​33027
• [schema-coverage] feat: Add schema coverage demo for container field by @​github-actions[bot] in #​32977
• [code-simplifier] refactor(parser): extract extractBuiltinMCPTools helper to remove duplicate logic by @​github-actions[bot] in #​32947
• Add FAQ guidance for using skills with agentic workflows by @​Copilot in #​33034
• Fix broken OTLP shared import in UK AI operational resilience workflow by @​Copilot in #​33036
• [jsweep] Clean add_comment.cjs by @​github-actions[bot] in #​32949
• Harden privileged checkout path in q.lock.yml for comment-triggered runs by @​Copilot in #​32906
• fix(network): allow pypi.org and files.pythonhosted.org in daily-semgrep-scan by @​Copilot in #​33035
• fix(otlp): derive gh-aw.run.status and status.code from output errors when conclusion env var is absent by @​Copilot in #​33037
• Add AWF/AWMG runtime versions to OTLP resource attributes by @​Copilot in #​33030
• Prevent compile panic when workflow directory contains only shared components by @​Copilot in #​33029
• [schema-coverage] feat: Add schema coverage demo for dependencies field by @​github-actions[bot] in #​32978
• Add pr-to-go-linter skill for PR-driven custom linter generation by @​Copilot in #​33050
• [docs] docs: consolidate developer specifications (tone scan v9.10) by @​github-actions[bot] in #​33056
• [dead-code] chore: remove dead functions — 3 functions removed by @​github-actions[bot] in #​33065
• feat: agentic workflow — rewrite merged PR descriptions in caveman style by @​Copilot in #​33059
• Add github-app.missing-key ignore mode and guard App token minting across workflow paths by @​Copilot in #​33033
• Refactor pkg mutex sites to use deferred unlocks consistently by @​Copilot in #​33038
• Support tools.github.allowed-repos: current for repo-scoped MCP guard policies by @​Copilot in #​33041
• Add SSL Skill Normalizer and convert reporting, error-messages, jqschema to SSL JSON by @​Copilot in #​32911
• chore: update workflow to include Grafana mcp server by @​mnkiefer in #​33086
• Render report_incomplete reasons in agent failure comment and issue templates by @​Copilot in #​33087
• Stop futile auth retries in Copilot/Claude/Codex harnesses after first-attempt authentication failure by @​Copilot in #​33093
• chore: enhance smoke test workflow to include datadog validation by @​mnkiefer in #​33023
• Prevent safe-output PR probing from creating stray downstream pull requests by @​Copilot in #​33044
• [docs] docs: unbloat integrity reference by @​github-actions[bot] in #​33110
• docs(spdd): strengthen safeguards, OTel norms, and compliance tests across 5 spec files by @​Copilot in #​33096
• Trim token spend in Matt Pocock skills reviewer workflow by @​Copilot in #​33085
• [linter-miner] feat(linters): add errstringmatch linter — flag strings.Contains(err.Error(), ...) calls by @​github-actions[bot] in #​33117
• feat(pr-sous-chef): run formatters and push to branch by @​Copilot in #​33125
• Align CLI help/docs consistency for outcomes, project setup, URLs, and wording by @​Copilot in #​33130
• Match agent failure issues by stored metadata instead of title alone by @​Copilot in #​33089
• fix: use COPILOT_DUMMY_BYOK indirection to suppress secret-scanner false positives on lock files by @​Copilot in #​33116
• [WIP] Fix failing GitHub Actions job 'Lint Gate' by @​Copilot in #​33144
• Bump default AWF firewall to v0.25.49 and refresh compiled lockfiles by @​Copilot in #​33124
• Wrap experiment assignment summary in collapsible details block by @​Copilot in #​33152
• [caveman] Optimize instruction verbosity — adr-writer, developer.instructions, agentic-chat (2026-05-18) by @​github-actions[bot] in #​33162
• Analyze: update_pull_request with empty args silently drops safe outputs by @​Copilot in #​33134
• Fix gh-aw install guard to handle github/gh-aw owner-prefix in gh extension list output by @​Copilot in #​33168
• fix: rename branch when recreate-ref deleteRef is blocked by branch protection rules by @​Copilot in #​33163
• [WIP] Fix failing GitHub Actions job JS Tests (shard 4/4) by @​Copilot in #​33165
• Fix compound || expressions in prompt markdown never substituting at runtime by @​Copilot in #​33129
• Handle resolve_pull_request_review_thread integration-token 403 as actionable soft-skip by @​Copilot in #​33171
• feat: import workflow or JSON workflow from arbitrary HTTP(S) URL by @​Copilot in #​33164
• Model inventory 2026-05-19: add raptor-mini alias coverage and missing GPT-5 search multipliers by @​Copilot in #​33177
• Optimize CLI Consistency Checker via inline small-model sub-agents by @​Copilot in #​33179
• Add per-engine default model aliases with Sonnet-sized agent defaults by @​Copilot in #​33182
• Restore authenticated ls-remote in signed commit push path by @​Copilot in #​33178
• fix(safe-outputs): warn agents about field-name divergence in add_labels, remove_labels, and update_pull_request by @​Copilot in #​33170
• Refactor current-repository lookup caches to shared syncutil.OnceLoader by @​Copilot in #​33180
• Validate required workflows on workflow_run during compile by @​Copilot in #​33191
• Resolve #aw_* temporary IDs during bundle-based signed commit replay by @​Copilot in #​33181
• [WIP] Fix failing GitHub Actions job Lint Gate by @​Copilot in #​33193
• Split shared OTLP backend import into Sentry, Grafana, and Datadog components by @​Copilot in #​33202
• [WIP] Fix failing GitHub Actions job build-wasm by @​Copilot in #​33203
• [WIP] Fix failing GitHub Actions job lint-go by @​Copilot in #​33204
• [WIP] Fix failing GitHub Actions job 'test' by @​Copilot in #​33205
• [code-simplifier] Simplify nested ternary to if/else chain in safe_output_helpers by @​github-actions[bot] in #​33206
• [log] Add debug logging to 5 cli/ files (outcome_eval, audit_comparison, audit_diff, audit_cross_run_render, download_workflow) by @​github-actions[bot] in #​33207
• [jsweep] Clean add_labels.cjs by @​github-actions[bot] in #​33208
• [aw] Prevent Step Name Alignment from using invalid gh search issues --state all by @​Copilot in #​33218
• Normalize report-style guidance across non-compliant issue/report workflows by @​Copilot in #​33220
• Multi-Device Docs Tester: move Astro server startup to pre-agent steps to unblock background-shell failures by @​Copilot in #​33221
• Add panic recovery to mcp inspect background goroutines by @​Copilot in #​33217
• Enforce prod errstringmatch findings and centralize 403/410 error classification by @​Copilot in #​33216
• [actions] Update GitHub Actions versions - 2026-05-19 by @​github-actions[bot] in #​33238
• refactor: extract resolveSafeOutputIssueTarget to eliminate safe-output target resolution boilerplate by @​Copilot in #​33231
• Reduce Step Name Alignment agent turns via deterministic pre-agent manifest by @​Copilot in #​33247
• Refactor parser engine-include tests to table-driven testify assertions by @​Copilot in #​33241
• Self-heal cache-memory git setup when restored metadata is corrupt by @​Copilot in #​33249
• OTel: propagate GenAI semantic attrs to gh-aw.agent.conclusion spans by @​Copilot in #​33245
• Tighten golden-test coverage: remove dead console fixtures and goldenize wasm all-engines by @​Copilot in #​33248
• [instructions] Sync safe-outputs.md with v0.74.4 schema by @​github-actions[bot] in #​33257
• Expose reusable workflow network allowlist as an opt-in workflow_call input by @​Copilot in #​33200
• Accept run_id alias for audit MCP tool parameters by @​Copilot in #​33250
• Refactor create-* config parsing to shared helper and unify string→array coercion by @​Copilot in #​33242
• [spec-enforcer] Enforce specifications for envutil, fileutil

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.