Skip to content

Update github/gh-aw action to v0.85.4 - #506

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/github-gh-aw-0.x
Aug 6, 2026
Merged

Update github/gh-aw action to v0.85.4#506
renovate[bot] merged 1 commit into
mainfrom
renovate/github-gh-aw-0.x

Conversation

@renovate

@renovate renovate Bot commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
github/gh-aw action minor v0.84.3 → v0.85.4

Release Notes

github/gh-aw (github/gh-aw)

v0.85.4

Compare Source

🌟 Release Highlights

This release is a major security-hardening pass — expanding secret masking across git, JavaScript runtimes, and MCP servers — alongside new automated audits, linter capabilities, and documentation improvements.

🔒 Security Hardening
  • Expanded secret masking coverage: git invocations in JS action scripts, derived secrets in JavaScript runtimes, authHeader values in git auth helpers, and API-derived OTLP access tokens are now automatically masked with core.setSecret, closing several avenues for accidental secret leakage in logs and artifacts.
  • MCP server secret protection: secret masking is now prevented from leaking through MCP servers, and safe-output artifacts no longer capture base64 CI trigger tokens or raw process stdout/stderr logs.
  • Zizmor CI gating: workflows now fail CI on high/critical severity Zizmor findings, and Zizmor now runs against all generated workflows in CI for continuous security scanning.
✨ What's New
  • Daily action/setup security audit with cache-memory aspect rotation to continuously check for supply-chain risk.
  • report-failed-jobs added to the safe-outputs JSON schema.
  • New linters: regexpdynamicpattern flags non-constant regexp compile patterns, and the errormessage linter gained a full-repo audit mode.
  • list_label MCP pagination now supports name filtering.
  • Custom engine execution steps now receive GH_AW_ENGINE_VERSION for better version-aware behavior.
🐛 Bug Fixes & Improvements
  • Fixed add_labels silently applying no labels.
  • Fixed container pin validation to correctly skip unpinned containers.
  • Fixed a fleet-wide smoke-test outage caused by a cli-proxy image tag mismatch.
  • Fixed trial not forwarding issue_number to workflows that don't declare it, and rendering the logical repo in the github-context prompt.
  • Fixed GITHUB_STEP_SUMMARY being unwritable in the AWF sandbox during threat detection (external detector bumped to v0.4.0).
  • Fixed detection-analysis-report timeouts and redundant log downloads.
  • compile no longer adds an ineffective merge=ours entry to the generated .gitattributes.
  • Retained jobs.*.permissions for built-in safe-outputs and conclusion jobs.
📚 Documentation
  • New guide documenting ARC and sandbox runtime architecture.
  • Refined homepage security features and highlighted self-hosted runners with microVM isolation.
  • Clarified that custom safe-output jobs run once per workflow run, not once per tool call.
  • Various self-healing documentation fixes and an unbloated "About" page.> Generated by 🚀 Release · auto · 18.4 AIC · ⊞ 11.2K
What's Changed

Full Changelog: github/gh-aw@v0.85.3...v0.85.4

v0.85.3

Compare Source

v0.85.2

Compare Source

v0.85.1

Compare Source

🌟 Release Highlights

This release expands agentic engine support with new integrations for Cursor, Kiro.dev, and Crush, alongside key fixes for metrics collection, workflow reliability, and network domain configuration.

✨ What's New
🐛 Bug Fixes & Improvements
  • Fixed the Metrics Collector zeroing out safe-output metrics when the logs tool times out, ensuring accurate reporting (#​50576).
  • Added missing Kiro network domains and SECRET_ auth key fallbacks (#​50573).
  • Fixed prettier formatting issues in eslint-factory rules (#​50574).
  • Fixed false positives in the require-nan-check rule (#​50556).
  • Fixed excessive blank lines before generated footers in safe-output bodies (#​50554).
  • Removed unsupported -y flag causing Crush engine failures (#​50436) and fixed a Crush configuration error (#​50452).
  • Fixed several smoke workflow failures related to authentication and container-attach races across Cursor, Aider, and Kiro engines (#​50472, #​50480, #​50443, #​50455, #​50468).
  • Reviewed smoke workflows and updated the network domain allow list (#​50462).
  • Removed support for the deprecated antigravity agentic engine (#​50460).
  • Added t.Parallel() to safe Go tests to speed up the test suite (#​50509).
  • Optimized agent progress validation (#​50442).
📚 Documentation
What's Changed

Full Changelog: github/gh-aw@v0.85.0...v0.85.1

v0.85.0

Compare Source

🌟 Release Highlights

This release focuses on hardening safe-output handling, smoothing out agentic engine configuration, and continuing the cleanup around the OpenCode engine removal.

⚠️ Breaking Changes
  • OpenCode engine removed — documentation now reflects the removal of the OpenCode engine; workflows relying on it must migrate to a supported engine. (#​50311)
✨ What's New
  • Shared workflow engine configuration — agentic engine setup is now unified across workflows, reducing duplication and configuration drift. (#​50422)
  • Partial-batch status counts for safe outputs — safe-output jobs now expose counts for partially completed batches, making it easier to diagnose incomplete runs. (#​50371)
  • Normalized JSON-encoded safe-output labels — label values are now consistently normalized, avoiding mismatches from JSON-encoded strings. (#​50364)
  • Review thread resolution from review comment node IDs — PR review threads can now be resolved directly from review comment node IDs. (#​50349)
🐛 Bug Fixes & Improvements
  • Suppressed false-positive RGS-004 runner-guard warnings for activation-gated jobs. (#​50370)
  • The threat detection parser now accepts Markdown-emphasis-wrapped THREAT_DETECTION_RESULT lines. (#​50401)
  • Disabled compile watch mode in automated environments to avoid hangs in CI. (#​50385)
  • Fixed a broken docs/safe-outputs.md link surfaced in the dangerous-permissions compile error message. (#​50381)
📚 Documentation
  • Added guidance for repository maintenance workflows, including a new "Repo Assist" doc for AI-assisted maintenance and a sample maintainer prompt. (#​50414, #​50413, #​50346)

Generated by 🚀 Release · auto · 20.9 AIC · ⊞ 11.3K

What's Changed

Full Changelog: github/gh-aw@v0.84.4...v0.85.0

v0.84.4

Compare Source

🌟 Release Highlights

This release focuses on security hardening, MCP tooling improvements, and a wide range of internal reliability and CI fixes.

🔒 Security Fixes
  • Fixed an SSRF host-allowlist bypass in workflowspec imports and added secret redaction to mcp inspect output (#​50259)
  • Remediated critical CVEs in the serena-mcp-server container image (#​50245)
  • Fixed vulnerabilities in the node:lts-alpine base container image (#​50207)
  • Fixed a potential secret exfiltration issue in the docs-noob-tester lock file (#​50296)
  • Injected zizmor unverified-creator annotations for 9 SHA-pinned third-party actions to improve supply-chain auditability (#​50015)
✨ What's New
  • Added prompt discovery support to mcp-inspect, making it easier to explore MCP server capabilities (#​49968)
  • push_to_pull_request_branch/reporting workflows now report failed non-builtin jobs as issues automatically from the conclusion job (#​49959)
  • Replaced ASCII charts with matplotlib and clarified P10/P50/P90 terminology in the daily spending forecast workflow (#​49978)
🐛 Bug Fixes & Improvements
  • Fixed dynamic dispatch_workflow ref forwarding and prevented ref leakage into inputs (#​50042)
  • Fixed failure_kind misclassification for safe_outputs post-agent failures (#​50037)
  • Handled deleted PR head refs non-fatally to avoid unnecessary run failures (#​50051)
  • Fixed workflow update source-only merges (#​50156)
  • Fixed check_permissions to handle a missing inherited_role field (#​50183)
  • Enforced runner→gateway OIDC path to prevent AWF agent exposure for HTTP MCP auth (#​50054)
📚 Documentation
  • Documented PR ruleset patterns for enforcing agentic workflows (#​49975)
  • Removed Agent Finder mentions from skills docs and reinforced local skill discovery guidance (#​50278, #​50244)
  • Fixed CLI/docs consistency: documented --shellcheck and --version, normalized update flag help (#​50280)
🔧 Internal

Numerous internal refactors, test parallelization, linter additions, and CI reliability improvements across the compiler, safe-outputs pipeline, and agentic maintenance workflows.

Generated by 🚀 Release · auto · 22.7 AIC · ⊞ 11.3K

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/github-gh-aw-0.x branch from e7c94cf to 7d6362f Compare August 6, 2026 06:39
@renovate renovate Bot changed the title Update github/gh-aw action to v0.85.3 Update github/gh-aw action to v0.85.4 Aug 6, 2026
@renovate
renovate Bot merged commit 1f283a3 into main Aug 6, 2026
9 checks passed
@renovate
renovate Bot deleted the renovate/github-gh-aw-0.x branch August 6, 2026 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants