GitHub Agentic Workflows Files

🌟 Release Highlights

This release expands the gh aw compile security pipeline with container vulnerability scanning, license auditing, and YAML linting — while delivering a wave of reliability fixes across the compiler, harness, and PR review workflows.

✨ What's New

• Container vulnerability scanning with Grype — gh aw compile now runs Grype to detect CVEs in gh-* workflow container images before deployment. (#47474)
• SBOM generation with Syft — New --syft flag on gh aw compile produces a Software Bill of Materials for container images. (#47515)
• License scanning with Grant — gh aw compile can now audit container image licenses via Grant. (#47516)
• YAML linting as a static validator — yamllint is now integrated into the compile-time validation pipeline, catching YAML errors early. (#47507)
• Daily firewall container security scan — Automated daily scanning keeps the firewall container image clean. (#47407)
• GitHub suggestion syntax in PR reviews — The PR reviewer now emits proper GitHub suggestion blocks instead of plain code snippets, making review feedback directly applicable. (#47508)
• aw.yml surfaced in add-wizard — The add-wizard now shows existing aw.yml config before prompting for engine setup, reducing accidental overwrites. (#47462)
• Private registry container substitutions — Container image substitutions for private registries are now supported. (#47374)

🐛 Bug Fixes & Improvements

• Flow-sensitive no-unsafe-catch-error-property linter — The rule now respects branch dominance and source order, eliminating false positives in complex control flow. (#47534)
• Hardened report_incomplete signal handling — Fixes a crash when incomplete_signals is missing or empty. (#47533)
• Expression precedence preserved in stringsjoinone autofix — Autofix replacements no longer silently change operator precedence. (#47482)
• Job-level permission shorthands preserved — Custom and safe jobs now correctly retain shorthand permission declarations through the compiler. (#47471)
• Critical CVE cleared — Upgraded gh-aw-firewall v0.27.37 → v0.27.38 to resolve a critical CVE gate. (#47469)
• Harness startup retry extended to push events — Fixes missing retry logic on push-triggered runs and improves Turns=0 driver-handoff diagnostics. (#47384)
• Safe-outputs PR review robustness — Inline comment anchors that are partially invalid no longer cause review failures. (#47356) Self-authored PRs now receive COMMENT instead of REQUEST_CHANGES. (#47400)
• 16 CLI consistency fixes — Resolved a batch of flag, output, and error-message inconsistencies across CLI commands. (#47337)

📚 Documentation

• Clarified compiler-managed skill installation under .github/aw. (#47480)
• Added missing meta/terminal safe-output types to the designer mapping table. (#47506)

Generated by 🚀 Release · sonnet46 22.2 AIC · ⊞ 7.9K

What's Changed

• [dead-code] chore: remove dead functions — 5 functions removed by @github-actions[bot] in https://github.com/github/gh-aw/pull/47339
• fix: use html/template to resolve unsafe-quoting alert in bootstrap page renderer by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47333
• fix: resolve 16 CLI consistency issues from 2026-07-22 inspection by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47337
• Scope Tidy workflow to scheduled/explicit runs to eliminate push-driven API bursts by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47353
• Align glossary and documentation workflows on shared AI Coding Dictionary guidance by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47358
• Explore Git AI integration opportunities by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47360
• pkg/cli tests: migrate assert.NoError to require.NoError for fail-fast error handling by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47355
• Mitigate safe-outputs review failures when inline comment anchors are partially invalid by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47356
• Auto-Triage: deterministically classify machine-generated aggregate reports by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47373
• Add regression coverage for PR review path-resolution fallback by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47380
• [linter-miner] feat(linters): add stringbytesroundtrip linter by @github-actions[bot] in https://github.com/github/gh-aw/pull/47375
• Consolidate PR data pre-fetch across three skills-reviewer workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47392
• [WIP] Fix dead Sergo new-linter detector to reference registry.go by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47371
• Tighten pkg/actionpins spec coverage around formatter edge cases and mapping behavior by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47379
• pkg/cli: add io.Writer params to renderLogs* formatters; kill captureOutput OS-swap by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47372
• [caveman] Optimize instruction verbosity — loop.md (2026-07-22) by @github-actions[bot] in https://github.com/github/gh-aw/pull/47404
• fix(harness): extend startup retry to push events; add Turns=0 driver-handoff diagnostics by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47384
• Refresh gh-aw-node packages and multi-platform publishing by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47405
• fix: add integration build verification to catch fuzz build failures on PRs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47398
• fix: downgrade REQUEST_CHANGES→COMMENT on self-authored PRs in safe-outputs PR review by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47400
• Add container image substitutions for private registries by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47374
• Add daily firewall container security scan by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47407
• Fix container scan exit handling and failure propagation by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47420
• Limit container image scanning to gh-* workflow images by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47429
• Refresh pinned brave-search container digest in workflow artifacts by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47430
• [eslint-monster] Replace console.log with core.info in setup/js OTLP and outcome scripts by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47416
• [community] Update community contributions in README by @github-actions[bot] in https://github.com/github/gh-aw/pull/47447
• [ubuntu-image] research: update Ubuntu runner image analysis to 20260720.247.2 by @github-actions[bot] in https://github.com/github/gh-aw/pull/47454
• refactor(stringutil): extract isASCIIAlphanumeric helper in sanitize.go by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47455
• Clarify compiler-managed skill installation in .github/aw guidance by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47480
• [jsweep] Clean write_large_content_to_file.cjs by @github-actions[bot] in https://github.com/github/gh-aw/pull/47466
• Add grype container image vulnerability scanning to compile pipeline by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47474
• fix(eslint): standardize failure signaling and unsafe coercion patterns in setup/js by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47419
• Guard setup JS sync fs/exec calls with contextual error handling by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47425
• Preserve job-level permission shorthands in custom and safe jobs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47471
• chore: upgrade gh-aw-firewall v0.27.37 → v0.27.38 to clear critical CVE gate by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47469
• Preserve expression precedence in stringsjoinone autofix replacements by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47482
• Surface aw.yml config during add-wizard before generic engine setup by @mnkiefer with @Copilot in https://github.com/github/gh-aw/pull/47462
• docs: add missing meta/terminal safe-output types to designer mapping table by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47506
• Add add-wizard integration coverage for manifest bootstrap ordering by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47517
• Add --syft container scan support to gh aw compile by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47515
• [instructions] Sync instruction files with release v0.82.14 by @github-actions[bot] in https://github.com/github/gh-aw/pull/47537
• Add yamllint as a static analysis validator by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47507
• Add Grant license scanning to gh aw compile by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47516
• [eslint-miner] eslint: add no-err-stack-then-string-fallback rule by @github-actions[bot] in https://github.com/github/gh-aw/pull/47541
• Harden report_incomplete issue handling when incomplete_signals is missing/empty by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47533
• Make no-unsafe-catch-error-property flow-sensitive to branch dominance and source order by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/47534
• [docs] Update glossary - daily scan by @github-actions[bot] in https://github.com/github/gh-aw/pull/47548

Full Changelog: https://github.com/github/gh-aw/compare/v0.83.0...v0.83.1