GitHub Agentic Workflows Files

🌟 Release Highlights

This release brings a long-awaited gh aw validate command, expanded safe-output capabilities, a new checkout frontmatter field, and a wave of community-reported bug fixes — making workflows more reliable and easier to author.

✨ What's New

• gh aw validate command (#18191) — Validate workflows with a single, discoverable command instead of chaining compile --validate --no-emit --zizmor --actionlint --poutine. Catch issues before they reach CI. Learn more

• checkout frontmatter field (#18223) — Fine-tune how actions/checkout is emitted in the agent job directly from frontmatter, giving you more control over repository checkout depth and behavior.

• duplicate state reason for close-issue (#18257) — Safe-output close-issue now supports state_reason: duplicate, enabling agentic triage workflows to properly categorize and close duplicate issues.

• New built-in prompt files (#18273, #18272, #18221) — Three new reference prompt files added to .github/aw/: test-coverage.md (with artifact-reading guidance), visual-regression.md (Playwright + cache-memory patterns), and report.md (report generation with markup style guidance).

• Smarter create-agentic-workflow prompt (#18274, #18271) — The workflow creation prompt now correctly suggests deployment_status triggers for external deployment monitoring, and expands language ecosystem inference to automatically configure network.allowed based on project type.

🐛 Bug Fixes & Improvements

• threat-detection: false now respected across imports (#18231) — Imported safe-output fragments no longer silently re-enable threat detection when the main workflow has explicitly disabled it, preventing spurious compilation errors with sandbox.agent: false.

• hide-older-comments now correctly identifies previous comments (#18205) — Fixed a matching bug where hide-older-comments on add-comment safe output failed to find previous comments due to a mismatch in XML marker format.

• Fixed relative import resolution for nested remote files (#18190) — Nested remote imports now resolve relative to their immediate parent file's directory instead of the top-level workflow, enabling proper modular workflow composition.

• code-simplifier unblocked for Go projects (#18214) — The go network preset now includes proxy.golang.org so go build, go test, and make lint no longer fail in the code-simplifier workflow.

• ExitError preserved in workflow validation error chain (#18282) — errors.As(err, &exec.ExitError{}) now works correctly in workflow validation, enabling accurate error type detection downstream.

• Fixed invalid Compiler Playground URL (#18206) — The broken 404 link in the editors reference documentation now correctly points to the Compiler Playground.

• GFM Alert syntax for discussion-to-issue fallback warning (#18268) — The fallback warning added to issues when create-discussion fails due to permissions is now rendered as a prominent GFM [!NOTE] alert instead of a plain blockquote.

📚 Documentation

• Updated docs for gh aw validate, checkout field, and threat-detection behavior from this release (#18254)
• Clarified mandatory sudo requirement for self-hosted agentic workflow runners (#18210)
• Condensed and streamlined FAQ page to reduce repetition (#18237)
• Updated init/upgrade/fix help text to remove stale .github/aw/ prompt file references (#18218)

🌍 Community Contributions

A huge thank you to the community members who reported issues that were resolved in this release:

• @strawgate for imported safe-output fragments override explicit threat-detection: false (#18226)
• @Nikhil-Anand-DSG for hide-older-comments finds no matching comments despite correct workflow_id marker (#18200)
• @jeremiah-snee-openx for Editor Link is invalid (#18196)

And a special thanks to @dsyme and @bmerkle for their direct code contributions in this release!

For complete details, see CHANGELOG.

Generated by Release

What's Changed

• cleanup fix2 for [#18178] by @bmerkle in https://github.com/github/gh-aw/pull/18194
• feat: add gh aw validate command by @Copilot in https://github.com/github/gh-aw/pull/18191
• [code-simplifier] refactor: extract execGHAPI helper in checks_command (#18164) by @github-actions[bot] in https://github.com/github/gh-aw/pull/18197
• 📂 Fix relative import resolution for nested remote files by @dsyme in https://github.com/github/gh-aw/pull/18190
• fix: correct invalid Compiler Playground URL in editors reference by @Copilot in https://github.com/github/gh-aw/pull/18206
• fix: hide-older-comments fails to match workflow_id in combined XML marker by @Copilot in https://github.com/github/gh-aw/pull/18205
• [log] Add debug logging to 5 workflow pkg files by @github-actions[bot] in https://github.com/github/gh-aw/pull/18208
• Document mandatory sudo requirement for self-hosted agentic workflows by @Copilot in https://github.com/github/gh-aw/pull/18210
• fix(code-simplifier): allow Go module proxy domains via go network preset by @Copilot in https://github.com/github/gh-aw/pull/18214
• fix(step-names): standardize Upload charts, compound step names, and Recompile verb across workflows by @Copilot in https://github.com/github/gh-aw/pull/18215
• Bump minimatch 9.0.5 → 9.0.6 in .github/workflows by @Copilot in https://github.com/github/gh-aw/pull/18224
• docs: update init/upgrade/fix help text to remove stale .github/aw/ prompt file references by @Copilot in https://github.com/github/gh-aw/pull/18218
• Improve test quality in pkg/cli/actionlint_test.go: adopt testify, reduce duplication by @Copilot in https://github.com/github/gh-aw/pull/18216
• Update awf to v0.23.0 by @Copilot in https://github.com/github/gh-aw/pull/18234
• [docs] Consolidate yaml-version-gotchas.md into dev.md (v3.0) by @github-actions[bot] in https://github.com/github/gh-aw/pull/18236
• [instructions] Sync github-agentic-workflows.md with v0.40.1 by @github-actions[bot] in https://github.com/github/gh-aw/pull/18235
• fix: imported safe-output fragments no longer override explicit threat-detection: false by @Copilot in https://github.com/github/gh-aw/pull/18231
• [docs] docs: condense faq.md - remove verbose and repetitive content by @github-actions[bot] in https://github.com/github/gh-aw/pull/18237
• [WIP] Create prompt file for report generation by @Copilot in https://github.com/github/gh-aw/pull/18221
• fix(SEC-005): remove false-positive cross-repo pattern matches in generate_git_patch.cjs by @Copilot in https://github.com/github/gh-aw/pull/18251
• Add checkout field and manager for agent job by @Copilot in https://github.com/github/gh-aw/pull/18223
• [docs] Update documentation for features from 2026-02-25 by @github-actions[bot] in https://github.com/github/gh-aw/pull/18254
• [jsweep] Clean add_reaction_and_edit_comment.cjs by @github-actions[bot] in https://github.com/github/gh-aw/pull/18252
• refactor: semantic function clustering — eliminate duplicates and relocate outlier functions by @Copilot in https://github.com/github/gh-aw/pull/18258
• Use GFM Alert syntax for discussion-to-issue fallback warning by @Copilot in https://github.com/github/gh-aw/pull/18268
• Expand language ecosystem inference for network.allowed in create-agentic-workflow prompt by @Copilot in https://github.com/github/gh-aw/pull/18271
• feat(safe-outputs): add duplicate state_reason to close-issue by @Copilot in https://github.com/github/gh-aw/pull/18257
• docs: document intentional exclusion of head_commit.id from numeric validation by @Copilot in https://github.com/github/gh-aw/pull/18266
• feat: add test-coverage prompt with artifact-reading guidance by @Copilot in https://github.com/github/gh-aw/pull/18273
• Add deployment_status trigger guidance to create-agentic-workflow prompt by @Copilot in https://github.com/github/gh-aw/pull/18274
• Add visual regression reference prompt (.github/aw/visual-regression.md) by @Copilot in https://github.com/github/gh-aw/pull/18272

Full Changelog: https://github.com/github/gh-aw/compare/v0.50.1...v0.50.2