Open
Conversation
github-actions
bot
added
the
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #26567 +/- ##
=======================================
Coverage 73.14% 73.14%
=======================================
Files 1529 1529
Lines 120229 120229
Branches 14523 14523
=======================================
Hits 87941 87941
Misses 31267 31267
Partials 1021 1021
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.49.4→v0.50.0Release Notes
github/gh-aw (github/gh-aw)
v0.50.0Compare Source
🌟 Release Highlights
This release focuses on improving reliability and flexibility for agentic engine authentication — giving teams more control over how secrets are managed — alongside important fixes for CRLF repositories and token security.
✨ What's New
engine.envin workflow frontmatter to override the default agentic engine token expression. gh-aw automatically wires your secret into both the execution step and the secret validator, giving teams full control over credential naming conventions (#18017).🐛 Bug Fixes & Improvements
CRLF repository compatibility — Workflows like Code Simplification that push changes via
safe_outputswere silently failing on repositories that normalize line endings with.gitattributes. Thegit ampatch application step now correctly handles CRLF-encoded patches (#18029).GH_AW_CI_TRIGGER_TOKENscoped correctly — The CI trigger token is now emitted only at the step level (instead of job level), ensuring it is available exclusively to the safe-outputs handler and not inadvertently exposed across all job steps (#18030).Dependency bumps — Claude Code updated to
2.1.51and Copilot CLI to0.0.415across all 158 compiled workflows (#18046).📚 Documentation
llms.txt, Create, Debug, Update) added to the documentation site footer — visible on every page (#18032).llms.txt(#18031).🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release:
@AmoebaChantfor Code Simplification agent silently fails to create PRs when the repo stores line endings as CRLF (#17975)For complete details, see CHANGELOG.
What's Changed
applyFrontmatterLineTransformto eliminate duplicate codemod boilerplate by @Copilot in #18050features.copilot-requestsfeature flag for GitHub Actions token auth by @Copilot in #18028Full Changelog: github/gh-aw@v0.49.7...v0.50.0
v0.49.7Compare Source
🌟 Release Highlights
This release sharpens the developer experience with a cleaner CI token configuration, more accurate
auditdiagnostics, polished error messages, and a new self-hosted runners guide.GH_AW_EXTRA_EMPTY_COMMIT_TOKENrenamed toGH_AW_CI_TRIGGER_TOKEN— If you set this environment variable to trigger CI pipelines on empty commits, update your secret name toGH_AW_CI_TRIGGER_TOKEN. (#17997)✨ What's New
GH_AW_CI_TRIGGER_TOKENis now used automatically whengithub-token-for-extra-empty-commitis not explicitly set, removing the need for thedefaultkeyword. Less boilerplate, same power. (#17997)🐛 Bug Fixes & Improvements
auditnow points to the right error — Theauditcommand was extracting error details from the "Complete job" teardown step instead of the actual failing step. It now correctly surfaces##[error]annotations from the step that failed, making debugging dramatically more straightforward. (#18010)max-turnserror for Copilot engine — The error message for unsupportedmax-turnson the Copilot engine was self-contradictory (telling users to remove it while showing an example using it). The message is now clean and unambiguous. (#18009)check-safe-outputs-conformance.shcaused a permanent false HIGH failure on every run. Now fixed. (#18011)📚 Documentation
runs-onformats, shared runner configuration patterns, and detection job runner overrides. View guide (#17986)🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release:
@benvillalobosfor Confusing error message:max-turns not supportedexample contradicts the errorFor complete details, see CHANGELOG.
What's Changed
Full Changelog: github/gh-aw@v0.49.6...v0.49.7
v0.49.6Compare Source
🌟 Release Highlights
This release focuses on authentication improvements, better self-hosted runner configurability, and a polished CLI experience — with significant documentation restructuring to make auth setup clearer than ever.
✨ What's New
GH_AW_CI_TRIGGER_TOKENmagic secret support — Setgithub-token-for-extra-empty-commit: "default"to automatically use theGH_AW_CI_TRIGGER_TOKENmagic secret without manual token wiring. This simplifies CI trigger token configuration for most workflows. (#17990)Runner resolution for detection jobs — The
detectionjob now inheritsagent.runs-onby default and can be independently overridden viasafe-outputs.detection.runs-on. Theunlockjob usessafe-outputs.runs-on, giving full control over runner placement in self-hosted environments. (#17979)Simplified
secrets setCLI — Thegh aw secrets setcommand now uses a single--repo owner/repoflag (replacing the separate--ownerand--repoflags) and defaults to the current repository. (#17977)🐛 Bug Fixes & Improvements
Frontmatter hash extraction —
extractHashFromLockFilenow correctly reads the new JSON metadata format (# gh-aw-metadata: {...}) in addition to the legacy# frontmatter-hash:format, preventing false "workflow has changed" warnings. (#17971)Docs build — Fixed an unclosed code fence in
auth.mdxthat was silently swallowing theGH_AW_AGENT_TOKENsection, causing broken anchor links across the docs. (#17972)📚 Documentation
Auth documentation has been substantially restructured with dedicated pages:
/reference/github-tools/auth-projectspageassign-to-copilotauth guideFor complete details, see CHANGELOG.
What's Changed
interface{}withanyin WASM layout stub by @Copilot in #17960secrets setto use single--repoflag by @dsyme in #17977Full Changelog: github/gh-aw@v0.49.5...v0.49.6
v0.49.5Compare Source
🌟 Release Highlights
This release focuses on correctness and reliability — fixing propagation bugs in threat detection, stabilizing compiled output ordering, and expanding schema coverage so configurations behave exactly as documented.
✨ What's New
RuntimeConfigandRuntimesConfigtyped structs now cover all 11 supported runtimes (includingbun,deno,uv, and more) plusaction-repo/action-versionfields.repository-projectsandorganization-projectspermission scopes are now correctly included in the schema, preventing silent validation failures. (#17911, #17951)storage.googleapis.comadded to node ecosystem — Deno and Bun workflows that depend on Google Cloud Storage (e.g.,deno/fresh,deno/postgres) can now reachstorage.googleapis.comwithout extra network configuration. (#17944)rpc-messages.jsonlas the canonical telemetry fallback, eliminating false 🔴 Critical alerts for Copilot-engine MCP runs. (#17950)MCPServerIDsemantic type — MCP server ID constants are now compile-time typed, preventing accidental mixing with arbitrary string values. (#17897)🐛 Bug Fixes & Improvements
--agentflag —engine.agentwas being propagated into the threat detection job via pointer copy, causing "No such agent" failures. The detection job now correctly ignores agent configuration. (#17949).lock.ymlfiles on each recompile. Output ordering is now stable. (#17927)hasSafeOutputType()was missing cases for 11 operation types, plural YAML tags were mismatched, and meta fields were not being merged. All resolved. (#17908)cleanup-scriptis now included;log-levelhyphen casing corrected. (#17909)📚 Documentation
network.mdreference now documents firewall and network feature support across all four engines. (#17910)allowed_domainsremoved from docs — This field was deprecated in v0.9.0; the docs now correctly direct users to the top-levelnetwork:field. (#17942)🌍 Community Contributions
A huge thank you to the community member who reported an issue resolved in this release:
@benvillalobosfor Bug:engine.agentpropagates to threat detection job, causing "No such agent" failure (#17943)For complete details, see CHANGELOG.
What's Changed
MCPServerIDsemantic type for MCP server ID constants by @Copilot in #17897allmeta-key in scope converter by @Copilot in #17951Full Changelog: github/gh-aw@v0.49.4...v0.49.5
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Only on Sunday and Saturday ( * * * * 0,6 ), Between 12:00 AM and 12:59 PM, only on Monday ( * 0-12 * * 1 ) in timezone Etc/UTC.
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.