GitHub Agentic Workflows Files

🌟 Release Highlights

v0.72.1 delivers a new developer-facing lint command, critical compiler correctness fixes, and improved shared workflow ergonomics — all driven largely by community-reported issues.

✨ What's New

• gh aw lint — fast lock-file validation (#30704): New gh aw lint command runs actionlint directly against existing .lock.yml files — no recompile, no extra scanners. Perfect for a lightweight CI gate to catch syntax errors before pushing. Supports --dir, explicit file paths, and optional --shellcheck/--pyflakes checks.

• Import engine.mcp.tool-timeout from shared workflows (#30634): Shared workflows wrapping slow MCP servers (e.g. Repo Mind Light) can now declare engine.mcp.tool-timeout and engine.mcp.session-timeout once, and consumers inherit those values automatically — no more duplicating timeout configs in every consumer. Consumer-declared values still take precedence.

• First-party coding-agent skill for gh aw (#27259): Added a router skill that gives coding agents (Copilot, Claude, etc.) structured guidance on creating, debugging, and updating agentic workflows using the gh aw CLI.

• Shared skip-if-match dedup component: The common "open issue/PR by title prefix" deduplication query is now a shared compiler-imported component, eliminating copy-paste duplication across dozens of workflows.

🐛 Bug Fixes & Improvements

• && preserved in compiled workflow expressions (#30695): Go's HTML escaping was converting && to \u0026\u0026 inside AWF config JSON embedded in .lock.yml files, corrupting ${{ ... && ... }} expressions and causing workflow parse failures. Fixed by switching to json.Encoder with SetEscapeHTML(false).

• safe-outputs permission regression fixed (#30733): When update-project appeared alongside add-comment/add-labels, the minted App token was incorrectly downgraded to issues:read instead of issues:write, silently failing issue mutations.

• Conclusion comment now reflects safe_outputs failures (#30662): The conclusion job was reporting ✅ success even when safe_outputs failed (e.g., 422 on PR review submission). The job now correctly propagates safe_outputs status.

• Firewall binary version corrected (#30705, #30191): v0.71.1 was referencing a non-existent gh-aw-firewall version, causing 404s on AWF binary install. This release ships with the correct firewall v0.25.29 (which also includes the healthcheck fix).

• Playwright mode: cli recognized by compiler (#30088): gh aw compile now correctly accepts mode: cli in Playwright tool configuration.

• COPILOT_API_KEY dummy key no longer triggers over-billing (#30324): The dummy byok-key placeholder introduced in v0.71 was causing 10–100x premium request over-billing compared to v0.68. Fixed.

For complete details, see CHANGELOG.

[!NOTE]

🔒 Integrity filter blocked 3 items

The following items were blocked because they don't meet the GitHub integrity level.

• #30705 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #30088 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #30324 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

yaml tools: github: min-integrity: approved # merged | approved | unapproved | none

Generated by Release · ● 14.1M

What's Changed

• Fix js-typecheck failure in OTLP payload guard by @Copilot in https://github.com/github/gh-aw/pull/30669
• Add daily SPDD spec-planning workflow that opens actionable issue queues by @Copilot in https://github.com/github/gh-aw/pull/30663
• fix: show failure in conclusion comment when safe_outputs job fails by @Copilot in https://github.com/github/gh-aw/pull/30666
• Remove cache option from Go setup step by @pelikhan in https://github.com/github/gh-aw/pull/30679
• Make bundle mode the default for safe-output patch packaging by @Copilot in https://github.com/github/gh-aw/pull/30626
• docs: move release process documentation to CONTRIBUTING.md by @Copilot in https://github.com/github/gh-aw/pull/30682
• Stabilize template conditional fuzz assertions to eliminate malformed-input false failures by @Copilot in https://github.com/github/gh-aw/pull/30678
• Stabilize codemod registry test by removing stale hardcoded count by @Copilot in https://github.com/github/gh-aw/pull/30677
• docs: SPDD spec improvements — multiplier registry, safeguards, conflict norms, error norms, sync notes, compliance stubs by @Copilot in https://github.com/github/gh-aw/pull/30681
• Fix lint-go failures in docker context tests and OTLP env assembly by @Copilot in https://github.com/github/gh-aw/pull/30676
• [caveman] Optimize instruction verbosity — cli-commands, experiments, github-mcp-server (2026-05-06) by @github-actions[bot] in https://github.com/github/gh-aw/pull/30690
• Add missing Agentic Ops pattern page by @Copilot in https://github.com/github/gh-aw/pull/30688
• Add retirement notice for releases 0.68.4–0.71.3 and FAQ upgrade instructions by @Copilot in https://github.com/github/gh-aw/pull/30698
• fix: skip COPILOT_API_KEY and /reflect when sandbox.agent is disabled by @Copilot in https://github.com/github/gh-aw/pull/30687
• Stabilize BenchmarkCompileMCPWorkflow by using Playwright CLI mode in benchmark fixture by @Copilot in https://github.com/github/gh-aw/pull/30697
• Align CLI help text semantics and terminology across mcp, project, pr, completion, logs, and init by @Copilot in https://github.com/github/gh-aw/pull/30696
• [workflow-style] Normalize report formatting guidance in workflow report prompts by @Copilot in https://github.com/github/gh-aw/pull/30702
• feat: support importing engine.mcp.tool-timeout and session-timeout from shared workflows by @Copilot in https://github.com/github/gh-aw/pull/30686
• [docs] Self-healing documentation fixes from issue analysis - 2026-05-07 by @github-actions[bot] in https://github.com/github/gh-aw/pull/30709
• Consolidate Grumpy + PR Nitpick into single pr-code-quality-reviewer by @Copilot in https://github.com/github/gh-aw/pull/30708
• perf: fix 104% regression in ExtractWorkflowNameFromFile by reducing scanner buffer allocation by @Copilot in https://github.com/github/gh-aw/pull/30706
• Preserve && in AWF config JSON embedded in lock workflows by @Copilot in https://github.com/github/gh-aw/pull/30700
• perf: eliminate reflection in validateSafeOutputsMax (4.3x faster) by @Copilot in https://github.com/github/gh-aw/pull/30701
• docs(instructions): never suggest pull_request_target over pull_request by @Copilot in https://github.com/github/gh-aw/pull/30718
• build(deps): Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/github/gh-aw/pull/30716
• Add compile release update checks by @Copilot in https://github.com/github/gh-aw/pull/30692
• Add W3C-driven compiler threat detection spec and daily coverage reconciler workflow by @Copilot in https://github.com/github/gh-aw/pull/30735
• Stabilize flaky MCP progress-notification tests in pkg/cli by @Copilot in https://github.com/github/gh-aw/pull/30727
• Enforce explicit safe-output completion in Resource Summarizer workflow by @Copilot in https://github.com/github/gh-aw/pull/30729
• feat: model alias inventory update 2026-05-07 by @Copilot in https://github.com/github/gh-aw/pull/30739
• Optimize jsweep workflow token footprint by trimming tool surface and prompt payload by @Copilot in https://github.com/github/gh-aw/pull/30730
• Remove cache-memory state from the Q workflow by @Copilot in https://github.com/github/gh-aw/pull/30731
• Add a lightweight agentic-workflows skill that routes to existing gh-aw prompts by @Copilot in https://github.com/github/gh-aw/pull/30734
• Preserve issues: write in safe-outputs App token when update-project is co-configured by @Copilot in https://github.com/github/gh-aw/pull/30738
• Unblock community attribution workflow by aligning restricted bash usage with prompt examples by @Copilot in https://github.com/github/gh-aw/pull/30766
• degrade: MCP guard policy auto-apply message from warning to info by @Copilot in https://github.com/github/gh-aw/pull/30774
• feat: enhance OTLP telemetry by @mnkiefer in https://github.com/github/gh-aw/pull/30800
• Add lightweight gh aw lint for lock-file-only actionlint checks and cancellation-aware execution by @Copilot in https://github.com/github/gh-aw/pull/30728
• [log] Add debug logging to 5 workflow pkg files by @github-actions[bot] in https://github.com/github/gh-aw/pull/30747
• [docs] docs: consolidate developer specs v9.2 (2026-05-07) by @github-actions[bot] in https://github.com/github/gh-aw/pull/30837
• [docs] Update documentation for features from 2026-05-07 by @github-actions[bot] in https://github.com/github/gh-aw/pull/30816
• fix: resolve 9 spec audit issues — add jsonutil spec, fix missing deps, standardize API table format by @Copilot in https://github.com/github/gh-aw/pull/30835
• [docs] Update glossary - daily scan by @github-actions[bot] in https://github.com/github/gh-aw/pull/30811
• [instructions] Sync mcp-servers stdio example with MCP Gateway v0.1.5 by @github-actions[bot] in https://github.com/github/gh-aw/pull/30801
• [spec-enforcer] Enforce specifications for agentdrain, cli by @github-actions[bot] in https://github.com/github/gh-aw/pull/30822
• Align workflow step names to Title Case in source and compiled workflows by @Copilot in https://github.com/github/gh-aw/pull/30788
• Refactor skip-if-match dedup into shared import and enable import-safe on field merging by @Copilot in https://github.com/github/gh-aw/pull/30787
• [ubuntu-image] Ubuntu Runner Image Analysis - 2026-05-07 by @github-actions[bot] in https://github.com/github/gh-aw/pull/30755
• [fp-enhancer] Improve pkg/actionpins: eliminate mutable shortSHA variable by @github-actions[bot] in https://github.com/github/gh-aw/pull/30808
• agentdrain: make NewAnomalyDetector consistent with package constructors by returning validated errors by @Copilot in https://github.com/github/gh-aw/pull/30786
• refactor: reorganize misplaced functions per semantic clustering analysis by @Copilot in https://github.com/github/gh-aw/pull/30770
• [dead-code] chore: remove dead functions — 1 function removed by @github-actions[bot] in https://github.com/github/gh-aw/pull/30843
• [spdd] Tighten spec conformance and safeguards across five Draft reference specs by @Copilot in https://github.com/github/gh-aw/pull/30865
• docs: replace low-level cron with fuzzy scheduling in documentation by @Copilot in https://github.com/github/gh-aw/pull/30871
• [jsweep] Clean add_reaction_and_edit_comment.cjs by @github-actions[bot] in https://github.com/github/gh-aw/pull/30756
• Fix stale logging-level assertion causing JS Tests shard 2/4 failure by @Copilot in https://github.com/github/gh-aw/pull/30875

Full Changelog: https://github.com/github/gh-aw/compare/v0.72.0...v0.72.1