[dependabot]

Bumps github/gh-aw/actions/setup-cli from 0.88.7 to 0.89.17.

Release notes

Sourced from github/gh-aw/actions/setup-cli's releases.

v0.89.17

🌟 Release Highlights

This release focuses on hardening reliability across the AIC accounting pipeline, AWF/firewall integration, and safe-outputs handling, alongside a refreshed model catalog and several documentation clean-ups.

✨ What's New

• Faster, smarter logs auditing — cached workflow runs are no longer redownloaded during logs audits (#61871), and multi-target logs queries are now distributed fairly across targets (#61027), with per-run download duration/size tracked in an end-of-run stats summary (#60951).
• Updated model catalog — added gemini-3.8-flash and claude-fable-5.1 aliases and corrected pricing for gpt-6-astra/gpt-5.6-sol (#61234).
• MCP Gateway and firewall bumped — MCP Gateway updated to v0.4.25 (#61661) and gh-aw-firewall (AWF) updated to v0.28.20 (#61527) and v0.28.17 (#60945), improving compatibility and stability.
• Better automatic grading — native Copilot tool calls are now included in the automatic grader trace payload for more accurate evaluation (#61426).
• Refreshed CLI defaults and scanner image pins for more predictable compiled workflows (#61432).

🐛 Bug Fixes & Improvements

• Fixed Code Scanning Fixer timeouts and tool denials (#61605).
• Fixed slash command activation failing on CRLF line endings (#61602).
• Added support for older curl versions in the AWF installer (#61600).
• Rewrote experiments.<name> references in engine.model into valid job-scoped expressions, preventing invalid compiled workflows (#61599).
• Hardened withRetry against transient fetch failures (#61439).
• Fixed upload_artifact silently succeeding when relative paths were never staged (#61431).
• Fixed Copilot SDK multiword shell-prefix matching and a denial-guard hang (#61430).
• Empty add_labels lists are now treated as a no-op instead of failing the job (#61429).
• Added ability to opt out of the "[aw] Detection Runs" tracking issue independently of threat detection (#61428).
• The safeoutputs CLI transport now fails loudly instead of silently failing open, surfacing real errors sooner (#61427).
• Fixed false-positive AI credits rate-limit detection caused by MCP echoes (#61425).
• Imported engine config (including auth) is now preserved when a workflow sets a top-level model (#61424).
• PLAYWRIGHT_BROWSERS_PATH now uses ${{ runner.temp }} so install and launch agree on the browser path (#61423).
• Fixed several gaps in daily AIC (AI Credits) accounting: legacy runs (#61313), pre-harness failures (#61232), unassigned jobs (#61222), and missing evals now counted as zero instead of skipped (#60892).
• Stabilized the Daily Documentation Healer's runtime (#61235).
• AWF fatal startup errors are now surfaced in agent failure reports (#61199), and not_started execution evidence is recorded when AWF fails before the engine harness starts (#61202).
• Added the Go ecosystem to the network allowlist for ci-coach (#61201).
• Validated cached run uniqueness across JSONL shards to prevent duplicate accounting (#61220).
• Preserved agent accounting in fallback artifacts (#61053).
• Fixed a flaky pkg/cli test-unit crash from concurrent Cobra completion generation (#61146).

📚 Documentation

• Several self-healing documentation passes fixed inaccuracies found via issue analysis (#61683, #61443).
• Documented the threat-detection report-as-issue field (#61563).
• Trimmed and clarified the workflow structure, tools, and IssueOps reference docs (#61485, #61238, #60998).
• Updated the glossary from the daily scan (#61104).

Generated by 🚀 Release · copilot · auto · 18.5 AIC · ⊞ 11.6K

---

What's Changed

• Bump MCP Gateway to v0.4.25 by @​lpcox with @​Copilot in github/gh-aw#61661
• [docs] Self-healing documentation fixes from issue analysis - 2026-09-17 by @​github-actions[bot] in github/gh-aw#61683
• [log] Add debug logging to add-workflow code paths by @​github-actions[bot] in github/gh-aw#61710

... (truncated)

Changelog

Sourced from github/gh-aw/actions/setup-cli's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• 0045747 Avoid redownloading cached runs during logs audit (#61871)
• 9894316 chore: update planned Go, Actions, and docs dependencies (#61774)
• 886aadd Add debug logging to add-workflow code paths (#61710)
• 331bd89 docs: document edit/format commands, audit-diff tool, and fix chat-ops exampl...
• 6db2a82 Bump MCP Gateway to v0.4.25 (#61661)
• 85f8845 Fix slash command activation for CRLF line endings (#61602)
• ce450ab Support older curl versions in AWF installer (#61600)
• 7f516a8 Rewrite experiments.\<name> in engine.model to valid job-scoped expressions ...
• 02f7a69 Bump gh-aw-firewall to v0.28.20 (#61527)
• 3a6ecc5 Fix Code Scanning Fixer timeout and tool denials (#61605)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Superseded by #48.