GitHub Agentic Workflows Files

🌟 Release Highlights

This release delivers significant improvements to safe-outputs reliability, submodule checkout support, enhanced agent failure reporting, stronger security hardening against integer overflow, and a wave of community-requested fixes across MCP, protected-files, repo-memory, and lockdown checks.

✨ What's New

• Submodule-safe credential cleanup — New checkout.clean-git-credentials option prevents credential leaks when workflows use submodules, resolving a long-standing issue with persist-credentials: false in compiled lock files. (#32819)
• Automatic pull-requests: read permission inference — The compiler now infers pull-requests: read for activation jobs that include Vale pre-steps using gh pr diff, eliminating a common silent permission gap. (#32849)
• Larger repo-memory file cap — Default MaxFileSize raised from 10 KB to 100 KB, unblocking analysis of real-world source files. (#32826)
• Denied-command surfacing in failure reports — Agent failure reports now surface denied commands and include improved prompts for actionable debugging. (#32759)
• ctxbackground linter — New Go linter flags context.Background() calls when a ctx parameter already exists, enforcing consistent context propagation. (#32865)

🐛 Bug Fixes & Improvements

• Mentions policy respected in add_comment — Allowed mentions were being escaped due to a missing config pass-through; now correctly applied. (#32805)
• update_pull_request.update_branch permission failures non-fatal — Workflow-permission errors from branch-update calls are now treated as warnings rather than hard failures. (#32900)
• CLI not-found detection unified — Lowercase "not found" errors were previously missed; detection is now case-insensitive and centralized. (#32888)
• Cache-memory artifact upload path fixed — Threat-detection workflows were generating invalid artifact paths; upload now succeeds reliably. (#32733)
• Integer overflow guards — MergeUnique allocation sizing and the run-step sanitizer are both hardened against allocation-size overflow (addresses CodeQL finding [#592]). (#32842, #32841)
• create_pull_request chaos fallback — Prevents a spurious fallback when the branch already exists. (#32770)

📚 Documentation

• Multi-engine guidance in README — Explicit signal added to help users choose the right engine for their workflow. (#32889)
• LLM discoverability — llms.md and llms-full.txt added for LLM tool configuration and GEO discoverability. (#32744, #32867)
• Broken links fixed — Pattern links in patterns.md and engine link in engines.md repaired. (#32804, #32743)

🌍 Community Contributions

For complete details, see CHANGELOG.

Generated by 🚀 Release · ● 3.1M

What's Changed

• [caveman] Optimize instruction verbosity — token-optimization.md (2026-05-15) by @github-actions[bot] in https://github.com/github/gh-aw/pull/32478
• [testify-expert] Standardize pkg/stringutil tests on testify assertions by @Copilot in https://github.com/github/gh-aw/pull/32468
• Replace threat-detection XML marker token across JS and spec by @Copilot in https://github.com/github/gh-aw/pull/32458
• ci: reduce retention for debugging artifacts in ci.yml and cgo.yml by @Copilot in https://github.com/github/gh-aw/pull/32451
• [linter-miner] feat(linters): add osexitinlibrary linter by @github-actions[bot] in https://github.com/github/gh-aw/pull/32448
• Make centralized slash-command workflows emit non-required workflow_dispatch inputs by @Copilot in https://github.com/github/gh-aw/pull/32480
• [WIP] Fix failing GitHub Actions job Integration: CLI Audit Logs & Firewall by @Copilot in https://github.com/github/gh-aw/pull/32483
• Fix docs link-validator failures from stale experiments page URLs by @Copilot in https://github.com/github/gh-aw/pull/32490
• Preserve @copilot in add-comment mention filtering by @Copilot in https://github.com/github/gh-aw/pull/32487
• Refactor safe-output dispatch logic to use a canonical handler descriptor table by @Copilot in https://github.com/github/gh-aw/pull/32489
• [docs] Self-healing documentation fixes from issue analysis - 2026-05-16 by @github-actions[bot] in https://github.com/github/gh-aw/pull/32496
• Make OTEL service names workflow-specific in compiled OTLP workflows by @Copilot in https://github.com/github/gh-aw/pull/32488
• Raise Daily Observability workflow ET budget to prevent proxy-enforced exhaustion by @Copilot in https://github.com/github/gh-aw/pull/32506
• Stabilize Daily Model Inventory Copilot startup by removing fragile quoted jq allow-tool by @Copilot in https://github.com/github/gh-aw/pull/32505
• Refactor workflow config parser helpers and shared mount validation by @Copilot in https://github.com/github/gh-aw/pull/32507
• Prevent Linter Miner runs from completing without a terminal safe output by @Copilot in https://github.com/github/gh-aw/pull/32531
• Add output_format A/B experiment to daily-code-metrics workflow by @Copilot in https://github.com/github/gh-aw/pull/32535
• [compiler-threat-spec] spec: add CTR-017 Secret Leakage via Env Vars and CTR-018 Version Integrity Bypass by @github-actions[bot] in https://github.com/github/gh-aw/pull/32538
• [community] Update community contributions in README by @github-actions[bot] in https://github.com/github/gh-aw/pull/32539
• [log] Add debug logging to 5 workflow compiler files by @github-actions[bot] in https://github.com/github/gh-aw/pull/32543
• [code-simplifier] Simplify sandbox MCP validation - remove redundant variable by @github-actions[bot] in https://github.com/github/gh-aw/pull/32542
• [jsweep] Clean action_input_utils.cjs by @github-actions[bot] in https://github.com/github/gh-aw/pull/32548
• feat: make E003 file-count error actionable and document max-patch-files by @Copilot in https://github.com/github/gh-aw/pull/32541
• chore: Update otel smoke tests by @mnkiefer in https://github.com/github/gh-aw/pull/32598
• chore: enhance otel smoke tests by @mnkiefer in https://github.com/github/gh-aw/pull/32601
• Prevent empty issue creation in Smoke OTEL Backends by @Copilot in https://github.com/github/gh-aw/pull/32607
• [spec-enforcer] Enforce specifications for stringutil, styles, testutil by @github-actions[bot] in https://github.com/github/gh-aw/pull/32612
• [spec-extractor] Update package specifications for envutil, fileutil, gitutil, logger by @github-actions[bot] in https://github.com/github/gh-aw/pull/32599
• [rendering-scripts] fix(copilot-parser): strip harness driver lines and new CLI footer stats by @github-actions[bot] in https://github.com/github/gh-aw/pull/32588
• fix(safe_jobs): hoist expression env vars into step env: block to prevent run-script guardrail failure by @Copilot in https://github.com/github/gh-aw/pull/32532
• Remove no-op workflow init stubs that only emit startup logs by @Copilot in https://github.com/github/gh-aw/pull/32551
• fix: allow @copilot mentions in PR Sous Chef by @Copilot in https://github.com/github/gh-aw/pull/32622
• [docs] Consolidate developer specifications into instructions file (v9.8) by @github-actions[bot] in https://github.com/github/gh-aw/pull/32624
• fix: surface GH_AW_GITHUB_TOKEN guidance on cross-repo private callee auth failure by @Copilot in https://github.com/github/gh-aw/pull/32530
• Add auto-hoist-run-expressions codemod: hoist all ${{ ... }} run-block expressions to env bindings by @Copilot in https://github.com/github/gh-aw/pull/32533
• Honor GH_AW_WORKFLOWS_DIR at all workflows-path join sites by @Copilot in https://github.com/github/gh-aw/pull/32550
• Consolidate diff --git header parsing across safe-output PR handlers by @Copilot in https://github.com/github/gh-aw/pull/32578
• docs: close spec-librarian API drift findings across 5 package READMEs by @Copilot in https://github.com/github/gh-aw/pull/32629
• fix(audit): key_findings error count uses len(errors) not metrics.ErrorCount by @Copilot in https://github.com/github/gh-aw/pull/32633
• Add prompt_style A/B experiment to blog-auditor workflow by @Copilot in https://github.com/github/gh-aw/pull/32630
• Add sub_agent_strategy, caveman_mode, and model_size variant types to ab-testing-advisor by @Copilot in https://github.com/github/gh-aw/pull/32636
• fix(pr-sous-chef): deterministic nudge spam filter via hidden marker by @Copilot in https://github.com/github/gh-aw/pull/32628
• Prefill protected-files fallback compare URL with Closes #N by @Copilot in https://github.com/github/gh-aw/pull/32632
• [WIP] Fix trend data collection in api consumption report by @Copilot in https://github.com/github/gh-aw/pull/32638
• Emit engine metadata on setup spans by injecting GH_AW_INFO_ENGINE_ID into Setup Scripts env by @Copilot in https://github.com/github/gh-aw/pull/32634
• [workflow-style] Normalize Daily Go Function Namer issue-body header formatting by @Copilot in https://github.com/github/gh-aw/pull/32642
• Optimize spec-enforcer prompt with inline small-model sub-agents by @Copilot in https://github.com/github/gh-aw/pull/32641
• Recompile pr-sous-chef lock workflow to resolve stale frontmatter hash by @Copilot in https://github.com/github/gh-aw/pull/32646
• Prevent Multi-Device Docs Tester from self-terminating during cleanup by @Copilot in https://github.com/github/gh-aw/pull/32643
• Capture per-endpoint OTLP export failure details on conclusion spans by @Copilot in https://github.com/github/gh-aw/pull/32631
• Add ASCII chart guidance and route chart requests in agentic-workflows dispatcher by @Copilot in https://github.com/github/gh-aw/pull/32650
• Add emoji field support to aw.yml package manifests by @Copilot in https://github.com/github/gh-aw/pull/32648
• Add top-level package.md prompt for packaging agentic-workflows repositories by @Copilot in https://github.com/github/gh-aw/pull/32647
• [spdd] Add spec implementation tracking, drift SLA guidance, and harness traceability updates by @Copilot in https://github.com/github/gh-aw/pull/32653
• [WIP] Fix failing GitHub Actions job 'Lint Gate' by @Copilot in https://github.com/github/gh-aw/pull/32654
• Short-circuit protected-files fallback-to-issue before push; sanitize fallback issue closing keywords by @Copilot in https://github.com/github/gh-aw/pull/32649
• [docs] docs: unbloat imports.md (~25% smaller) by @github-actions[bot] in https://github.com/github/gh-aw/pull/32662
• Increase repo-memory max-patch-size ceiling from 100KB to 1MB by @Copilot in https://github.com/github/gh-aw/pull/32667
• docs: add FAQ cross-reference for Jira branch name control via preserve-branch-name by @Copilot in https://github.com/github/gh-aw/pull/32668
• docs: surface upload-artifact for attachment-style safe outputs by @Copilot in https://github.com/github/gh-aw/pull/32669
• Resolve SideRepoOps safe-outputs base branch from the checked-out target branch by @Copilot in https://github.com/github/gh-aw/pull/32659
• [linter-miner] feat(linters): add rawloginlib linter — flag standard log package use in library packages by @github-actions[bot] in https://github.com/github/gh-aw/pull/32672
• Reduce immediate lint debt from custom-linter sweep by @Copilot in https://github.com/github/gh-aw/pull/32675
• Model alias inventory update 2026-05-16: add coding/vision aliases and claude-sonnet-4-6 multiplier by @Copilot in https://github.com/github/gh-aw/pull/32677
• Stabilize workflow integration tests for top-level on key rendering by @Copilot in https://github.com/github/gh-aw/pull/32686
• Add daily LintMonster workflow for custom linter triage and agent-driven remediation by @Copilot in https://github.com/github/gh-aw/pull/32687
• Refactor TestAnalyzeEvent into explicit sequential subtests and assert full anomaly output by @Copilot in https://github.com/github/gh-aw/pull/32685
• Add title-based deduplication to create_issue safe outputs (MCP + apply-time) by @Copilot in https://github.com/github/gh-aw/pull/32655
• Preserve allowlisted mentions in add_comment sanitization (@copilot regression) by @Copilot in https://github.com/github/gh-aw/pull/32683
• Fix cache-memory restore/save layout for Chaos PR Bundle Fuzzer by @Copilot in https://github.com/github/gh-aw/pull/32682
• Fix safe-outputs MCP startup crash from missing title-dedup modules by @Copilot in https://github.com/github/gh-aw/pull/32694
• Fix safe-outputs module copy list in setup action by @Copilot in https://github.com/github/gh-aw/pull/32697
• fix: remove screenshot requirement from Documentation Unbloat workflow (#32666) by @Copilot in https://github.com/github/gh-aw/pull/32689
• Stop emitting legacy Copilot assignment step in safe_outputs compiler by @Copilot in https://github.com/github/gh-aw/pull/32693
• Fix safe-outputs bootstrap failure by copying missing transitive dependency in setup.sh by @Copilot in https://github.com/github/gh-aw/pull/32702
• refactor(lint): eliminate >8-parameter functions via options structs (Group 1/3) by @Copilot in https://github.com/github/gh-aw/pull/32710
• [docs] Self-healing documentation fixes from issue analysis - 2026-05-17 by @github-actions[bot] in https://github.com/github/gh-aw/pull/32714
• [compiler-threat-spec] spec: update CTR-004 for sandbox.agent:false breaking change (v1.0.9) by @github-actions[bot] in https://github.com/github/gh-aw/pull/32731
• [community] Update community contributions in README by @github-actions[bot] in https://github.com/github/gh-aw/pull/32732
• [model-inventory] Register 2026-05-17 OpenAI/Gemini model variants in ET multiplier registry by @Copilot in https://github.com/github/gh-aw/pull/32735
• Refactor activation permission helpers to remove parameter-overload lint violations by @Copilot in https://github.com/github/gh-aw/pull/32713
• Refine ET budget exhaustion message for scanability, link fidelity, and optimization guidance by @Copilot in https://github.com/github/gh-aw/pull/32742
• docs: fix broken link to charmbracelet/crush repo in engines.md by @Copilot in https://github.com/github/gh-aw/pull/32743
• docs: add llms.md — AWF /reflect endpoint guide for LLM tool configuration by @Copilot in https://github.com/github/gh-aw/pull/32744
• Fix cache-memory artifact upload path generation in threat-detection workflows by @Copilot in https://github.com/github/gh-aw/pull/32733
• [log] Add debug logs to five workflow files by @github-actions[bot] in https://github.com/github/gh-aw/pull/32747
• Export shared IsNotFoundError helper to pkg/errorutil, adopt across pkg/cli and pkg/parser by @Copilot in https://github.com/github/gh-aw/pull/32757
• Surface OTLP export failures in observability step summary by @Copilot in https://github.com/github/gh-aw/pull/32761
• Adopt isPermissionError helper for gh CLI auth-error detection by @Copilot in https://github.com/github/gh-aw/pull/32758
• [instructions] Document gh aw deploy and --repo flag in cli-commands.md by @github-actions[bot] in https://github.com/github/gh-aw/pull/32783
• feat: surface denied commands and fix prompt in agent failure reports by @Copilot in https://github.com/github/gh-aw/pull/32759
• [jsweep] Clean action_setup_otlp.cjs by @github-actions[bot] in https://github.com/github/gh-aw/pull/32756
• [docs] Update dictation skill instructions by @github-actions[bot] in https://github.com/github/gh-aw/pull/32773
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in https://github.com/github/gh-aw/pull/32793
• [docs] Update documentation for features from 2026-05-17 by @github-actions[bot] in https://github.com/github/gh-aw/pull/32796
• [spec-enforcer] Enforce specifications for linters, actionpins, agentdrain by @github-actions[bot] in https://github.com/github/gh-aw/pull/32800
• Unify OTel engine identity on agent spans and remove duplicate gen_ai.system by @Copilot in https://github.com/github/gh-aw/pull/32801
• Prevent chaos create-pull-request fallback when branch already exists by @Copilot in https://github.com/github/gh-aw/pull/32770
• feat(daily-semgrep-scan): add semgrep_output_format A/B experiment by @Copilot in https://github.com/github/gh-aw/pull/32802
• docs: fix broken pattern links in patterns.md by @Copilot in https://github.com/github/gh-aw/pull/32804
• [safeoutputs] Fix temporary_id '#' prefix confusion in field values (add_labels, remove_labels, and others) by @Copilot in https://github.com/github/gh-aw/pull/32708
• Add shared AgentDB MCP import and wire deep-report for large-scale discussion search by @Copilot in https://github.com/github/gh-aw/pull/32771
• fix: pass mentions config to add_comment handler so allowed mentions aren't escaped by @Copilot in https://github.com/github/gh-aw/pull/32805
• Linter Miner: raise execution limits and switch bash tool allowlist to wildcard by @Copilot in https://github.com/github/gh-aw/pull/32816
• Add missing errorutil package spec and align dependency sections in package READMEs by @Copilot in https://github.com/github/gh-aw/pull/32822
• Connect agent-performance-analyzer to AgentDB for trend, recall, and regression memory by @Copilot in https://github.com/github/gh-aw/pull/32820
• Apply safe-output mention policy across markdown-producing handlers by @Copilot in https://github.com/github/gh-aw/pull/32818
• [docs] Consolidate developer docs: tone fix in mcp_logs_guardrails by @github-actions[bot] in https://github.com/github/gh-aw/pull/32824
• Increase default repo-memory MaxFileSize from 10KB to 100KB by @Copilot in https://github.com/github/gh-aw/pull/32826
• Allow bash * in linter-miner workflow by @Copilot in https://github.com/github/gh-aw/pull/32825
• Rename 'shared/observability-otlp.md' to 'shared/otlp.md' by @mnkiefer in https://github.com/github/gh-aw/pull/32823
• [WIP] Fix failing GitHub Actions job lint-go by @Copilot in https://github.com/github/gh-aw/pull/32831
• [WIP] Fix the failing GitHub Actions job "Integration Unauthenticated Add (Public Repo)" by @Copilot in https://github.com/github/gh-aw/pull/32832
• chore: simplify naming and clarify status checks for OTEL backends by @mnkiefer in https://github.com/github/gh-aw/pull/32835
• Normalize report-formatting guidance across non-compliant reporting workflows by @Copilot in https://github.com/github/gh-aw/pull/32836
• [WIP] Fix failing GitHub Actions job js-typecheck by @Copilot in https://github.com/github/gh-aw/pull/32839
• Guard MergeUnique allocation sizing against integer overflow (CodeQL [#592]) by @Copilot in https://github.com/github/gh-aw/pull/32842
• Harden run step sanitizer against allocation-size overflow pattern by @Copilot in https://github.com/github/gh-aw/pull/32841
• specs: daily SPDD work plan 2026-05-17 — safeguards, DriftRecord schema, sync notes, conformance tests, lifecycle sections by @Copilot in https://github.com/github/gh-aw/pull/32844
• Improve JS step-summary agent trace readability with ordered event markers by @Copilot in https://github.com/github/gh-aw/pull/32847
• [WIP] Fix failing GitHub Actions job JS Tests (shard 4/4) by @Copilot in https://github.com/github/gh-aw/pull/32840
• Add log-triage and workflow-file-scanner inline sub-agents to q.md by @Copilot in https://github.com/github/gh-aw/pull/32861
• [linter-miner] feat(linters): add ctxbackground linter — flag context.Background() when a ctx param exists by @github-actions[bot] in https://github.com/github/gh-aw/pull/32865
• chore: normalize otel auth by @mnkiefer in https://github.com/github/gh-aw/pull/32864
• Strengthen docs homepage JSON-LD graph with explicit node context and KG disambiguation metadata by @Copilot in https://github.com/github/gh-aw/pull/32866
• Align docs GEO discovery artifacts for GitHub Pages subpath hosting by @Copilot in https://github.com/github/gh-aw/pull/32868
• Expose and advertise llms-full.txt for docs GEO discoverability by @Copilot in https://github.com/github/gh-aw/pull/32867
• Improve sanitize test assertions in pkg/stringutil/sanitize_test.go by @Copilot in https://github.com/github/gh-aw/pull/32872
• feat: infer gh CLI permissions for activation job pre-steps by @Copilot in https://github.com/github/gh-aw/pull/32849
• docs: add explicit multi-engine signal in README and make engine guidance need-based by @Copilot in https://github.com/github/gh-aw/pull/32889
• Consolidate CLI not-found detection and fix lowercase “not found” miss by @Copilot in https://github.com/github/gh-aw/pull/32888
• Remove duplicate CLI install step in deep-report agent job by @Copilot in https://github.com/github/gh-aw/pull/32894
• Centralize default HTTP client timeout in pkg/constants and remove duplicated 30s literals by @Copilot in https://github.com/github/gh-aw/pull/32890
• Add checkout.clean-git-credentials to support submodule-safe checkout credential cleanup by @Copilot in https://github.com/github/gh-aw/pull/32819
• Add UK AI operational resilience workflow with recent-change triage and sub-agent risk governance by @Copilot in https://github.com/github/gh-aw/pull/32904
• Handle update_pull_request.update_branch workflow-permission failures as non-fatal by @Copilot in https://github.com/github/gh-aw/pull/32900

Full Changelog: https://github.com/github/gh-aw/compare/v0.74.3...v0.74.4