GitHub Agentic Workflows Files

🌟 Release Highlights

This release focuses on hardening the sandbox and MCP gateway, smoothing out safe-output and threat-detection reliability, and shipping a steady stream of security and quality fixes across the compiler and CLI.

✨ What's New

• Docker sandbox (docker-sbx) rollout continues — the sandboxed execution environment now runs for a larger share of agentic workflows, with fixes for pre-flight step naming, gVisor false positives, and Docker Hub secret handling (#51264, #51294, #51341, #51439, #51949). See the sandbox reference.
• Agent runtime tracking — sandbox.agent.runtime is now stored in aw_info.json, and gh aw logs/gh aw audit gained a --runtime filter for easier debugging across engines (#51465, #52076). See agent runtimes.
• MCP gateway hardening — explicit mount policy allowlisting for the safeoutputs backend server, plus a bump to gh-aw-mcpg v0.4.9 and github-mcp-server v1.9.0 (#51870, #51828).
• Skills frontmatter flexibility — non-SHA refs are now allowed in skills frontmatter and pinned automatically at compile time, and an explicit end-marker syntax was added for inline skills/sub-agents (#51455, #51446).
• Threat detection improvements — inline threat detection for Code Scanning Fixer, rendered detection logs with group/mask macros, and gh-aw's own <system> prompt block is no longer flagged as prompt injection (#51277, #51255, #51818). See threat detection.

🐛 Bug Fixes & Improvements

• Fixed silent failures in the Copilot session data fetcher and in gh aw mcp inspect pagination (#51195, #51193).
• Fixed Claude harness retrying invalid-JSON body errors with --continue instead of starting a fresh run (#51793).
• Fixed a CGO/CJS workflow cache key collision that caused widespread job failures (#51342).
• Fixed recurring gh-aw-firewall digest-pin loss on default firewall version bumps (#51423).
• Fixed Windows MCP server timeouts by propagating context through GitHub CLI subprocess calls (#51426).
• Fixed retry handling and denials in the Contribution Check proxy (#51631).
• Added support for HEAD-only bundles when pushing to pull request branches (#51833).
• Fixed safe-output run summary classification so entries are always linked and correctly attributed (#51484, #51478).

📚 Documentation

• Documented the --runtime flag for gh aw logs/gh aw audit, agent runtime selection/troubleshooting, and clarified Claude engine selection in automated bootstrap (#52076, #51427, #52099).
• Improved overall documentation discoverability and trimmed troubleshooting guides (#52065, #51251).

🔧 Internal

A large batch of custom-linter hardening, dependency bumps, test-parallelization, and dependency vulnerability remediations (container image pinning, ip-address patch, deprecated MCP container replacements) round out this release — thanks to the automated maintenance workflows keeping the codebase clean and secure.> Generated by 🚀 Release · auto · 20.7 AIC · ⊞ 11.3K

What's Changed

• Add GitHub CLI fallback guidance to Daily Team Evolution Insights workflow prompt by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51192
• Bump Claude Code, OpenAI Codex, and Pi CLI pinned versions by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51194
• Fix silent conversation-transcript fetch failures in Copilot session data fetcher by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51195
• fix(threat-detection): stop uploading detection.log for external gh-aw-detection path by @davidslater in https://github.com/github/gh-aw/pull/51233
• Harden safe-output field validation by @pelikhan in https://github.com/github/gh-aw/pull/51133
• [docs] Self-healing documentation fixes from issue analysis - 2026-08-07 by @github-actions[bot] in https://github.com/github/gh-aw/pull/51235
• [docs] docs: unbloat troubleshooting common issues by @github-actions[bot] in https://github.com/github/gh-aw/pull/51251
• feat: enable docker-sbx sandbox for ~50% of agentic workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51264
• Refactor safe-outputs handler assembly by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51229
• Refactor engine secret validation wrappers by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51216
• Fix silent pagination truncation in gh aw mcp inspect, dedupe connect logic by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51193
• Revert sbx to 10% of agentic workflows, set gvisor to 10% by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51294
• feat(threat-detection): render detection.log in detection job with group/mask macros by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51255
• [log] Add debug logging to guard-policy, arc-dind, and validation helpers by @github-actions[bot] in https://github.com/github/gh-aw/pull/51298
• Increase post-result watchdog default to 120s and add frontmatter timeout override by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51292
• Handle discarded filepath.Glob errors in CLI by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51296
• Detect typed map[string]bool set aliases in short declarations by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51303
• fix(pydantic): install the pydantic-ai CLI and match the real pai interface by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51242
• Suppress RGS-012 false positive on the gVisor install step by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51322
• Add mobile interaction regression test for the home page quick-start CTA by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51323
• Use inline threat detection for Code Scanning Fixer by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51277
• [test-parallel] Add t.Parallel() to safe top-level tests in cmd/gh-aw by @github-actions[bot] in https://github.com/github/gh-aw/pull/51331
• Refactor engine import defaults parameters by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51295
• [purelock] Lock down parsePermissionsConfig, validateImportInputType, resolveRuntimeCooldown with pure-function test suites by @github-actions[bot] in https://github.com/github/gh-aw/pull/51374
• Fix require-error-code-in-thrown-error false positives on Identifier message args by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51324
• Remove bounded-queries from instruction files by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51339
• Fix CGO/CJS workflow cache key collision causing widespread job failures by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51342
• [instructions] Sync instruction files with release v0.86.1 by @github-actions[bot] in https://github.com/github/gh-aw/pull/51351
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in https://github.com/github/gh-aw/pull/51355
• Document missing internal dependencies in parser, cli, and workflow specs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51380
• Standardize USE-001 error codes in add_labels and dismiss_pull_request_review by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51338
• Suppress systemic runner-guard gVisor false positives and remove docker-sbx shellcheck noise at source by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51341
• Detect thrown custom Error subclasses in error-code lint rule by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51343
• Bump pinned Claude Code CLI to 2.1.226 and Pi CLI to 0.84.1 by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51340
• [eslint-miner] Add ESLint rule: require-invalid-date-check-before-compare by @github-actions[bot] in https://github.com/github/gh-aw/pull/51354
• Fix Copilot path portability across runners by @lpcox in https://github.com/github/gh-aw/pull/51275
• Audit helper-built thrown Error messages by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51412
• Add formal PR outcome evaluator coverage by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51403
• feat(sandbox): add runtime-install field to control sbx/gVisor install step generation by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51413
• Allow Smoke Copilot dispatches to main by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51416
• remove aw-harness spec and all references by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51428
• Import shared reporting guidance into workflows missing report formatting rules by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51431
• Fix recurring gh-aw-firewall digest-pin loss on DefaultFirewallVersion bumps by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51423
• Suppress unenforceable action-failure expiry markers when no maintenance workflow will exist to close them by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51425
• Document agent runtime selection and troubleshooting by @lpcox in https://github.com/github/gh-aw/pull/51427
• Add Simplified Technical English (STE) output_format variant to daily experiments by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51442
• [WIP] Fix failing GitHub Actions job lint-go by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51444
• Improve test quality for pkg/console/confirm_test.go by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51434
• Soft-fail missing docker-sbx Docker Hub secrets by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51439
• fix: propagate context through GitHub CLI subprocess calls to fix Windows MCP server timeout by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51426
• Add Ponytail pull request reviewer workflow by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51454
• Restore setup action before evals post-hook by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51453
• Fix invalid SKILL.md frontmatter metadata by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51457
• Fix broken relative links in skill docs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51458
• [aw] Correct Kiro model ID in Daily Spec Coverage workflow by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51456
• Remove all uses of the Rig skill from agentic workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51461
• Allow non-SHA refs in skills frontmatter, pinned at compile time by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51455
• Make safe-output run summary entries regular and always linked by @dsyme with @Copilot in https://github.com/github/gh-aw/pull/51478
• Regularize conclusion no-op summaries by @dsyme in https://github.com/github/gh-aw/pull/51487
• Fix safe-output summary outcome classification by @dsyme with @Copilot in https://github.com/github/gh-aw/pull/51484
• Raise Avenger turn budget for self-repair runs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51491
• Store sandbox.agent.runtime in aw_info.json and add --runtime filter to logs/audit by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51465
• Add anti-probing guidance to submit_pull_request_review tool description by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51469
• [instructions] Sync instruction files with release v0.85.4 by @github-actions[bot] in https://github.com/github/gh-aw/pull/51553
• [test-parallel] Add t.Parallel() to safe standalone Go tests (batch 1) by @github-actions[bot] in https://github.com/github/gh-aw/pull/51539
• Add explicit end marker syntax for inline skills and sub-agents by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51446
• [docs] docs: trim repetition in editing workflows guide by @github-actions[bot] in https://github.com/github/gh-aw/pull/51486
• [log] Add debug logging to under-instrumented wasm/console helpers by @github-actions[bot] in https://github.com/github/gh-aw/pull/51508
• Deduplicate commit-ref SHA resolution in action_resolver by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51472
• fix(seenmapbool): treat non-true values in declaration-site composite literals as non-set maps by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51514
• [rendering-scripts] Fix Copilot engine bash tool name normalization in log rendering by @github-actions[bot] in https://github.com/github/gh-aw/pull/51551
• Fix responsive docs navigation test targeting by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51540
• Unify skill reference parsing and classification by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51473
• Fix import cycle between pkg/logger and pkg/colorwriter by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51562
• Update Playwright CLI default version to 0.1.18 by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51541
• Apply the small-value-space guard to null-valued constants in no-duplicate-constant-values by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51542
• Require isNaN(getTime()) guard to precede and dominate the date comparison by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51532
• Remediate 14 collection/perf custom-lint findings by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51507
• Suppress poutine untrusted_checkout_exec via .poutine.yml skip rule by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51533
• [eslint-miner] eslint-factory: add require-spawn-error-listener rule by @github-actions[bot] in https://github.com/github/gh-aw/pull/51556
• [avenger] Regenerate wasm golden files after poutine:ignore removal by @github-actions[bot] in https://github.com/github/gh-aw/pull/51569
• Guard colorwriter against logger import cycles by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51570
• Refactor add interactive workflow run prompt by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51517
• Fix nolintlint format error in copilot_engine_execution.go by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51579
• Resolve spec-librarian export coverage drift in pkg READMEs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51592
• [purelock] Lock down sameExpr, addAllowedToNetwork, rpcEntryToTimelineEvent with pure-function test suites by @github-actions[bot] in https://github.com/github/gh-aw/pull/51586
• Fix flaky TestStatusWorkflows tests failing outside repo root by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51582
• Fix golint-custom failure: tolowerequalfold false positive on empty-string check by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51602
• Accept ADR-43244 and add predicate traceability by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51611
• Normalize report formatting guidance in 5 daily audit workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51612
• test: formalize AWF config drift safeguards by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51605
• Grant agentic engines read/write access to /tmp/gh-aw in AWF sandbox by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51608
• Improve comment-memory config test coverage by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51622
• Skip stale review-thread node IDs in resolve_pull_request_review_thread instead of failing safe_outputs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51630
• [blog] Weekly blog post – 2026-08-10 by @github-actions[bot] in https://github.com/github/gh-aw/pull/51671
• Enforce four clean custom linters in CGO by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51682
• [spec-review] Update Safe Outputs conformance checker for recent spec changes by @github-actions[bot] in https://github.com/github/gh-aw/pull/51685
• Fix Contribution Check proxy denials and retry handling by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51631
• [log] Add debug logging to threat-detection, frontmatter, and validation paths by @github-actions[bot] in https://github.com/github/gh-aw/pull/51676
• Deduplicate update-entity parser wrappers in pkg/workflow by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51647
• Replace vulnerable ast-grep MCP container by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51718
• [specs] Update layout specification - 2026-08-10 by @github-actions[bot] in https://github.com/github/gh-aw/pull/51731
• Use Alpine-based grafana/mcp-grafana image to clear container scan findings by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51728
• Require invalid-date guards to exit before comparisons by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51720
• [test-parallel] test: add t.Parallel() to safe pure-function tests in pkg/cli by @github-actions[bot] in https://github.com/github/gh-aw/pull/51706
• Deduplicate safe-output body attribution handling by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51648
• [docs] Update glossary - weekly full scan by @github-actions[bot] in https://github.com/github/gh-aw/pull/51756
• eslint-factory: detect relational comparisons of x.getTime() in require-invalid-date-check-before-compare by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51729
• Refactor action pin warnings and agentdrain helpers by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51674
• Patch vulnerable ip-address dependency in gh-aw-node by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51719
• Replace vulnerable mcp/context7 container with the hosted Context7 HTTP MCP server by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51727
• [eslint-miner] Add require-mkdtempsync-try-catch ESLint rule by @github-actions[bot] in https://github.com/github/gh-aw/pull/51746
• [code-simplifier] Simplify add_reviewer.cjs: extract copilot reviewer helper by @github-actions[bot] in https://github.com/github/gh-aw/pull/51675
• Harden runner-guard Docker command rendering by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51753
• Remove python:alpine container usage and pins to clear container scan findings by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51762
• Suppress SC2016 for literal behavior-defined engine configs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51759
• Disable vulnerable arXiv MCP container by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51758
• Remove vulnerable open-ontologies container image from glossary-maintainer workflow by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51778
• Align MCP management tool annotation helpers by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51785
• Mitigate mcp/memory scan findings by removing container usage and pin references by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51752
• Normalize --help flag description for the help command by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51829
• Add coverage-aware perf gating for allocation-focused custom linters by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51573
• Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9 by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51754
• Bump gh-aw-mcpg to v0.4.9 and github-mcp-server to v1.9.0 by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51828
• Fix coverage profile environment lookup lint failure by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51847
• Formalize CTR-022/CTR-023 behavior with predicate-level unit coverage by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51820
• [purelock] Lock down removeUnsafeEngineEnvKeys, migrateMessagesEffectiveTokensSuffixToAICreditsSuffix with pure-function test suites by @github-actions[bot] in https://github.com/github/gh-aw/pull/51783
• Restrict Gemini/Cursor/Kiro engines to smoke-* workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51869
• Stop threat detection from flagging gh-aw's own <system> prompt block as prompt injection by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51818
• Use parameterized GraphQL variables instead of Sprintf interpolation by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51827
• Fix Claude harness retrying invalid-JSON body error with --continue instead of a fresh run by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51793
• Fix MCP gateway mount policy rejection for safeoutputs backend server by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51870
• Pretty-print audit workflow repo-memory JSON by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51890
• Enable threat detection for Q and ESLint Monster workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51891
• Add native-counterpart doc comments to progress_wasm.go and spinner_wasm.go by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51904
• Fix Matt Pocock skills reviewer pin by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51902
• Support HEAD-only bundles when pushing to pull request branches by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51833
• Allow add-wizard to initialize empty repositories by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51895
• Retry upload-asset pushes after concurrent branch updates by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51893
• Skip ripgrep apt install when rg already exists by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51915
• Prevent raw observability log loss during artifact extraction by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51907
• DeepReport: align repo-memory paths with branch root and allow JSON state files by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51931
• Allow sandbox agents to reach declared service ports by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51842
• Render workflow prompts with JavaScript instead of shell heredocs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51850
• Add missing push-repo-memory mapping to the workflow designer by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51937
• Enforce ctxbackground in cgo custom lint by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51936
• Add Kimi K3 to the Copilot model inventory by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51938
• Suppress visual regression loopback Runner-Guard finding by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51947
• Align docker-sbx pre-flight step naming by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51949
• Fix errorfwrapv false positive on explicit arg index before dynamic * width by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51932
• [instructions] Sync instruction files with release v0.86.1 by @github-actions[bot] in https://github.com/github/gh-aw/pull/51991
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in https://github.com/github/gh-aw/pull/51998
• [docs] Update glossary - daily scan by @github-actions[bot] in https://github.com/github/gh-aw/pull/52007
• Bump @github/copilot-sdk from 1.0.8 to 1.0.9 in /actions/setup/js by @dependabot[bot] in https://github.com/github/gh-aw/pull/52005
• Bump astro from 7.1.6 to 7.2.0 in /docs by @dependabot[bot] in https://github.com/github/gh-aw/pull/52004
• Bump vite from 8.2.0 to 8.2.1 in /actions/setup/js by @dependabot[bot] in https://github.com/github/gh-aw/pull/52003
• Bump @astrojs/starlight from 0.41.6 to 0.41.7 in /docs by @dependabot[bot] in https://github.com/github/gh-aw/pull/52001
• Bump @primer/octicons from 19.32.0 to 19.33.0 in /docs by @dependabot[bot] in https://github.com/github/gh-aw/pull/52002
• Bump @types/node from 26.1.1 to 26.2.0 in /actions/setup/js by @dependabot[bot] in https://github.com/github/gh-aw/pull/52000
• Rename panic linter test fixture functions by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52051
• Bump Claude Code CLI to 2.1.227 and Copilot CLI to 1.0.79 by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51977
• Detect spawn DI fallback bindings in error-listener rule by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51975
• Refactor duplicated pkg/cli outcome and stats helpers by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51948
• Make spawn error listener checks path-sensitive by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51982
• [eslint-miner] eslint-factory: add no-json-stringify-set-or-map rule by @github-actions[bot] in https://github.com/github/gh-aw/pull/51995
• Use cursor traversal in analyzer helper by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52058
• Remediate targeted custom-linter findings by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51942
• [aw] Reduce Daily PR review tool-denial failures in Copilot SDK runs by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52060
• Remediate dynamic regexp pattern findings by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51941
• Harden remote workflow import fallbacks to prevent cross-host downgrade to public GitHub by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/51976
• Harden scanner/relaunch exec trust boundaries and argument validation by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52032
• docs: document --runtime flag for gh aw logs and gh aw audit by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52076
• Suppress benign workflow exfiltration findings by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52083
• Normalize report formatting in video-analyzer, plan, and centralization-drilldown workflows by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52085
• Improve GitHub Agentic Workflows documentation discoverability by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52065
• Fix inverted strict: mode documentation in frontmatter reference by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52100
• Clarify Claude engine selection in automated bootstrap by @pelikhan with @Copilot in https://github.com/github/gh-aw/pull/52099

Full Changelog: https://github.com/github/gh-aw/compare/v0.86.1...v0.86.2