chore(deps): update github/gh-aw action to v0.86.2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
github/gh-aw	action	minor	v0.67.1 → v0.86.2

---

Release Notes

github/gh-aw (github/gh-aw)

v0.86.2

Compare Source

🌟 Release Highlights

This release focuses on hardening the sandbox and MCP gateway, smoothing out safe-output and threat-detection reliability, and shipping a steady stream of security and quality fixes across the compiler and CLI.

✨ What's New

• Docker sandbox (docker-sbx) rollout continues — the sandboxed execution environment now runs for a larger share of agentic workflows, with fixes for pre-flight step naming, gVisor false positives, and Docker Hub secret handling (#​51264, #​51294, #​51341, #​51439, #​51949). See the sandbox reference.
• Agent runtime tracking — sandbox.agent.runtime is now stored in aw_info.json, and gh aw logs/gh aw audit gained a --runtime filter for easier debugging across engines (#​51465, #​52076). See agent runtimes.
• MCP gateway hardening — explicit mount policy allowlisting for the safeoutputs backend server, plus a bump to gh-aw-mcpg v0.4.9 and github-mcp-server v1.9.0 (#​51870, #​51828).
• Skills frontmatter flexibility — non-SHA refs are now allowed in skills frontmatter and pinned automatically at compile time, and an explicit end-marker syntax was added for inline skills/sub-agents (#​51455, #​51446).
• Threat detection improvements — inline threat detection for Code Scanning Fixer, rendered detection logs with group/mask macros, and gh-aw's own <system> prompt block is no longer flagged as prompt injection (#​51277, #​51255, #​51818). See threat detection.

🐛 Bug Fixes & Improvements

• Fixed silent failures in the Copilot session data fetcher and in gh aw mcp inspect pagination (#​51195, #​51193).
• Fixed Claude harness retrying invalid-JSON body errors with --continue instead of starting a fresh run (#​51793).
• Fixed a CGO/CJS workflow cache key collision that caused widespread job failures (#​51342).
• Fixed recurring gh-aw-firewall digest-pin loss on default firewall version bumps (#​51423).
• Fixed Windows MCP server timeouts by propagating context through GitHub CLI subprocess calls (#​51426).
• Fixed retry handling and denials in the Contribution Check proxy (#​51631).
• Added support for HEAD-only bundles when pushing to pull request branches (#​51833).
• Fixed safe-output run summary classification so entries are always linked and correctly attributed (#​51484, #​51478).

📚 Documentation

• Documented the --runtime flag for gh aw logs/gh aw audit, agent runtime selection/troubleshooting, and clarified Claude engine selection in automated bootstrap (#​52076, #​51427, #​52099).
• Improved overall documentation discoverability and trimmed troubleshooting guides (#​52065, #​51251).

🔧 Internal

A large batch of custom-linter hardening, dependency bumps, test-parallelization, and dependency vulnerability remediations (container image pinning, ip-address patch, deprecated MCP container replacements) round out this release — thanks to the automated maintenance workflows keeping the codebase clean and secure.> Generated by 🚀 Release · auto · 20.7 AIC · ⊞ 11.3K

---

What's Changed

• Add GitHub CLI fallback guidance to Daily Team Evolution Insights workflow prompt by @​pelikhan with @​Copilot in #​51192
• Bump Claude Code, OpenAI Codex, and Pi CLI pinned versions by @​pelikhan with @​Copilot in #​51194
• Fix silent conversation-transcript fetch failures in Copilot session data fetcher by @​pelikhan with @​Copilot in #​51195
• fix(threat-detection): stop uploading detection.log for external gh-aw-detection path by @​davidslater in #​51233
• Harden safe-output field validation by @​pelikhan in #​51133
• [docs] Self-healing documentation fixes from issue analysis - 2026-08-07 by @​github-actions[bot] in #​51235
• [docs] docs: unbloat troubleshooting common issues by @​github-actions[bot] in #​51251
• feat: enable docker-sbx sandbox for ~50% of agentic workflows by @​pelikhan with @​Copilot in #​51264
• Refactor safe-outputs handler assembly by @​pelikhan with @​Copilot in #​51229
• Refactor engine secret validation wrappers by @​pelikhan with @​Copilot in #​51216
• Fix silent pagination truncation in gh aw mcp inspect, dedupe connect logic by @​pelikhan with @​Copilot in #​51193
• Revert sbx to 10% of agentic workflows, set gvisor to 10% by @​pelikhan with @​Copilot in #​51294
• feat(threat-detection): render detection.log in detection job with group/mask macros by @​pelikhan with @​Copilot in #​51255
• [log] Add debug logging to guard-policy, arc-dind, and validation helpers by @​github-actions[bot] in #​51298
• Increase post-result watchdog default to 120s and add frontmatter timeout override by @​pelikhan with @​Copilot in #​51292
• Handle discarded filepath.Glob errors in CLI by @​pelikhan with @​Copilot in #​51296
• Detect typed map[string]bool set aliases in short declarations by @​pelikhan with @​Copilot in #​51303
• fix(pydantic): install the pydantic-ai CLI and match the real pai interface by @​pelikhan with @​Copilot in #​51242
• Suppress RGS-012 false positive on the gVisor install step by @​pelikhan with @​Copilot in #​51322
• Add mobile interaction regression test for the home page quick-start CTA by @​pelikhan with @​Copilot in #​51323
• Use inline threat detection for Code Scanning Fixer by @​pelikhan with @​Copilot in #​51277
• [test-parallel] Add t.Parallel() to safe top-level tests in cmd/gh-aw by @​github-actions[bot] in #​51331
• Refactor engine import defaults parameters by @​pelikhan with @​Copilot in #​51295
• [purelock] Lock down parsePermissionsConfig, validateImportInputType, resolveRuntimeCooldown with pure-function test suites by @​github-actions[bot] in #​51374
• Fix require-error-code-in-thrown-error false positives on Identifier message args by @​pelikhan with @​Copilot in #​51324
• Remove bounded-queries from instruction files by @​pelikhan with @​Copilot in #​51339
• Fix CGO/CJS workflow cache key collision causing widespread job failures by @​pelikhan with @​Copilot in #​51342
• [instructions] Sync instruction files with release v0.86.1 by @​github-actions[bot] in #​51351
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @​github-actions[bot] in #​51355
• Document missing internal dependencies in parser, cli, and workflow specs by @​pelikhan with @​Copilot in #​51380
• Standardize USE-001 error codes in add_labels and dismiss_pull_request_review by @​pelikhan with @​Copilot in #​51338
• Suppress systemic runner-guard gVisor false positives and remove docker-sbx shellcheck noise at source by @​pelikhan with @​Copilot in #​51341
• Detect thrown custom Error subclasses in error-code lint rule by @​pelikhan with @​Copilot in #​51343
• Bump pinned Claude Code CLI to 2.1.226 and Pi CLI to 0.84.1 by @​pelikhan with @​Copilot in #​51340
• [eslint-miner] Add ESLint rule: require-invalid-date-check-before-compare by @​github-actions[bot] in #​51354
• Fix Copilot path portability across runners by @​lpcox in #​51275
• Audit helper-built thrown Error messages by @​pelikhan with @​Copilot in #​51412
• Add formal PR outcome evaluator coverage by @​pelikhan with @​Copilot in #​51403
• feat(sandbox): add runtime-install field to control sbx/gVisor install step generation by @​pelikhan with @​Copilot in #​51413
• Allow Smoke Copilot dispatches to main by @​pelikhan with @​Copilot in #​51416
• remove aw-harness spec and all references by @​pelikhan with @​Copilot in #​51428
• Import shared reporting guidance into workflows missing report formatting rules by @​pelikhan with @​Copilot in #​51431
• Fix recurring gh-aw-firewall digest-pin loss on DefaultFirewallVersion bumps by @​pelikhan with @​Copilot in #​51423
• Suppress unenforceable action-failure expiry markers when no maintenance workflow will exist to close them by @​pelikhan with @​Copilot in #​51425
• Document agent runtime selection and troubleshooting by @​lpcox in #​51427
• Add Simplified Technical English (STE) output_format variant to daily experiments by @​pelikhan with @​Copilot in #​51442
• [WIP] Fix failing GitHub Actions job lint-go by @​pelikhan with @​Copilot in #​51444
• Improve test quality for pkg/console/confirm_test.go by @​pelikhan with @​Copilot in #​51434
• Soft-fail missing docker-sbx Docker Hub secrets by @​pelikhan with @​Copilot in #​51439
• fix: propagate context through GitHub CLI subprocess calls to fix Windows MCP server timeout by @​pelikhan with @​Copilot in #​51426
• Add Ponytail pull request reviewer workflow by @​pelikhan with @​Copilot in #​51454
• Restore setup action before evals post-hook by @​pelikhan with @​Copilot in #​51453
• Fix invalid SKILL.md frontmatter metadata by @​pelikhan with @​Copilot in #​51457
• Fix broken relative links in skill docs by @​pelikhan with @​Copilot in #​51458
• [aw] Correct Kiro model ID in Daily Spec Coverage workflow by @​pelikhan with @​Copilot in #​51456
• Remove all uses of the Rig skill from agentic workflows by @​pelikhan with @​Copilot in #​51461
• Allow non-SHA refs in skills frontmatter, pinned at compile time by @​pelikhan with @​Copilot in #​51455
• Make safe-output run summary entries regular and always linked by @​dsyme with @​Copilot in #​51478
• Regularize conclusion no-op summaries by @​dsyme in #​51487
• Fix safe-output summary outcome classification by @​dsyme with @​Copilot in #​51484
• Raise Avenger turn budget for self-repair runs by @​pelikhan with @​Copilot in #​51491
• Store sandbox.agent.runtime in aw_info.json and add --runtime filter to logs/audit by @​pelikhan with @​Copilot in #​51465
• Add anti-probing guidance to submit_pull_request_review tool description by @​pelikhan with @​Copilot in #​51469
• [instructions] Sync instruction files with release v0.85.4 by @​github-actions[bot] in #​51553
• [test-parallel] Add t.Parallel() to safe standalone Go tests (batch 1) by @​github-actions[bot] in #​51539
• Add explicit end marker syntax for inline skills and sub-agents by @​pelikhan with @​Copilot in #​51446
• [docs] docs: trim repetition in editing workflows guide by @​github-actions[bot] in #​51486
• [log] Add debug logging to under-instrumented wasm/console helpers by @​github-actions[bot] in #​51508
• Deduplicate commit-ref SHA resolution in action_resolver by @​pelikhan with @​Copilot in #​51472
• fix(seenmapbool): treat non-true values in declaration-site composite literals as non-set maps by @​pelikhan with @​Copilot in #​51514
• [rendering-scripts] Fix Copilot engine bash tool name normalization in log rendering by @​github-actions[bot] in #​51551
• Fix responsive docs navigation test targeting by @​pelikhan with @​Copilot in #​51540
• Unify skill reference parsing and classification by @​pelikhan with @​Copilot in #​51473
• Fix import cycle between pkg/logger and pkg/colorwriter by @​pelikhan with @​Copilot in #​51562
• Update Playwright CLI default version to 0.1.18 by @​pelikhan with @​Copilot in #​51541
• Apply the small-value-space guard to null-valued constants in no-duplicate-constant-values by @​pelikhan with @​Copilot in #​51542
• Require isNaN(getTime()) guard to precede and dominate the date comparison by @​pelikhan with @​Copilot in #​51532
• Remediate 14 collection/perf custom-lint findings by @​pelikhan with @​Copilot in #​51507
• Suppress poutine untrusted_checkout_exec via .poutine.yml skip rule by @​pelikhan with @​Copilot in #​51533
• [eslint-miner] eslint-factory: add require-spawn-error-listener rule by @​github-actions[bot] in #​51556
• [avenger] Regenerate wasm golden files after poutine:ignore removal by @​github-actions[bot] in #​51569
• Guard colorwriter against logger import cycles by @​pelikhan with @​Copilot in #​51570
• Refactor add interactive workflow run prompt by @​pelikhan with @​Copilot in #​51517
• Fix nolintlint format error in copilot_engine_execution.go by @​pelikhan with @​Copilot in #​51579
• Resolve spec-librarian export coverage drift in pkg READMEs by @​pelikhan with @​Copilot in #​51592
• [purelock] Lock down sameExpr, addAllowedToNetwork, rpcEntryToTimelineEvent with pure-function test suites by @​github-actions[bot] in #​51586
• Fix flaky TestStatusWorkflows tests failing outside repo root by @​pelikhan with @​Copilot in #​51582
• Fix golint-custom failure: tolowerequalfold false positive on empty-string check by @​pelikhan with @​Copilot in #​51602
• Accept ADR-43244 and add predicate traceability by @​pelikhan with @​Copilot in #​51611
• Normalize report formatting guidance in 5 daily audit workflows by @​pelikhan with @​Copilot in #​51612
• test: formalize AWF config drift safeguards by @​pelikhan with @​Copilot in #​51605
• Grant agentic engines read/write access to /tmp/gh-aw in AWF sandbox by @​pelikhan with @​Copilot in #​51608
• Improve comment-memory config test coverage by @​pelikhan with @​Copilot in #​51622
• Skip stale review-thread node IDs in resolve_pull_request_review_thread instead of failing safe_outputs by @​pelikhan with @​Copilot in #​51630
• [blog] Weekly blog post – 2026-08-10 by @​github-actions[bot] in #​51671
• Enforce four clean custom linters in CGO by @​pelikhan with @​Copilot in #​51682
• [spec-review] Update Safe Outputs conformance checker for recent spec changes by @​github-actions[bot] in #​51685
• Fix Contribution Check proxy denials and retry handling by @​pelikhan with @​Copilot in #​51631
• [log] Add debug logging to threat-detection, frontmatter, and validation paths by @​github-actions[bot] in #​51676
• Deduplicate update-entity parser wrappers in pkg/workflow by @​pelikhan with @​Copilot in #​51647
• Replace vulnerable ast-grep MCP container by @​pelikhan with @​Copilot in #​51718
• [specs] Update layout specification - 2026-08-10 by @​github-actions[bot] in #​51731
• Use Alpine-based grafana/mcp-grafana image to clear container scan findings by @​pelikhan with @​Copilot in #​51728
• Require invalid-date guards to exit before comparisons by @​pelikhan with @​Copilot in #​51720
• [test-parallel] test: add t.Parallel() to safe pure-function tests in pkg/cli by @​github-actions[bot] in #​51706
• Deduplicate safe-output body attribution handling by @​pelikhan with @​Copilot in #​51648
• [docs] Update glossary - weekly full scan by @​github-actions[bot] in #​51756
• eslint-factory: detect relational comparisons of x.getTime() in require-invalid-date-check-before-compare by @​pelikhan with @​Copilot in #​51729
• Refactor action pin warnings and agentdrain helpers by @​pelikhan with @​Copilot in #​51674
• Patch vulnerable ip-address dependency in gh-aw-node by @​pelikhan with @​Copilot in #​51719
• Replace vulnerable mcp/context7 container with the hosted Context7 HTTP MCP server by @​pelikhan with @​Copilot in #​51727
• [eslint-miner] Add require-mkdtempsync-try-catch ESLint rule by @​github-actions[bot] in #​51746
• [code-simplifier] Simplify add_reviewer.cjs: extract copilot reviewer helper by @​github-actions[bot] in #​51675
• Harden runner-guard Docker command rendering by @​pelikhan with @​Copilot in #​51753
• Remove python:alpine container usage and pins to clear container scan findings by @​pelikhan with @​Copilot in #​51762
• Suppress SC2016 for literal behavior-defined engine configs by @​pelikhan with @​Copilot in #​51759
• Disable vulnerable arXiv MCP container by @​pelikhan with @​Copilot in #​51758
• Remove vulnerable open-ontologies container image from glossary-maintainer workflow by @​pelikhan with @​Copilot in #​51778
• Align MCP management tool annotation helpers by @​pelikhan with @​Copilot in #​51785
• Mitigate mcp/memory scan findings by removing container usage and pin references by @​pelikhan with @​Copilot in #​51752
• Normalize --help flag description for the help command by @​pelikhan with @​Copilot in #​51829
• Add coverage-aware perf gating for allocation-focused custom linters by @​pelikhan with @​Copilot in #​51573
• Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9 by @​pelikhan with @​Copilot in #​51754
• Bump gh-aw-mcpg to v0.4.9 and github-mcp-server to v1.9.0 by @​pelikhan with @​Copilot in #​51828
• Fix coverage profile environment lookup lint failure by @​pelikhan with @​Copilot in #​51847
• Formalize CTR-022/CTR-023 behavior with predicate-level unit coverage by @​pelikhan with @​Copilot in #​51820
• [purelock] Lock down removeUnsafeEngineEnvKeys, migrateMessagesEffectiveTokensSuffixToAICreditsSuffix with pure-function test suites by @​github-actions[bot] in #​51783
• Restrict Gemini/Cursor/Kiro engines to smoke-* workflows by @​pelikhan with @​Copilot in #​51869
• Stop threat detection from flagging gh-aw's own <system> prompt block as prompt injection by @​pelikhan with @​Copilot in #​51818
• Use parameterized GraphQL variables instead of Sprintf interpolation by @​pelikhan with @​Copilot in #​51827
• Fix Claude harness retrying invalid-JSON body error with --continue instead of a fresh run by @​pelikhan with @​Copilot in #​51793
• Fix MCP gateway mount policy rejection for safeoutputs backend server by @​pelikhan with @​Copilot in #​51870
• Pretty-print audit workflow repo-memory JSON by @​pelikhan with @​Copilot in #​51890
• Enable threat detection for Q and ESLint Monster workflows by @​pelikhan with @​Copilot in #​51891
• Add native-counterpart doc comments to progress_wasm.go and spinner_wasm.go by @​pelikhan with @​Copilot in #​51904
• Fix Matt Pocock skills reviewer pin by @​pelikhan with @​Copilot in #​51902
• Support HEAD-only bundles when pushing to pull request branches by @​pelikhan with @​Copilot in #​51833
• Allow add-wizard to initialize empty repositories by @​pelikhan with @​Copilot in #​51895
• Retry upload-asset pushes after concurrent branch updates by @​pelikhan with @​Copilot in #​51893
• Skip ripgrep apt install when rg already exists by @​pelikhan with @​Copilot in #​51915
• Prevent raw observability log loss during artifact extraction by @​pelikhan with @​Copilot in #​51907
• DeepReport: align repo-memory paths with branch root and allow JSON state files by @​pelikhan with @​Copilot in #​51931
• Allow sandbox agents to reach declared service ports by @​pelikhan with @​Copilot in #​51842
• Render workflow prompts with JavaScript instead of shell heredocs by @​pelikhan with @​Copilot in #​51850
• Add missing push-repo-memory mapping to the workflow designer by @​pelikhan with @​Copilot in #​51937
• Enforce ctxbackground in cgo custom lint by @​pelikhan with @​Copilot in #​51936
• Add Kimi K3 to the Copilot model inventory by @​pelikhan with @​Copilot in #​51938
• Suppress visual regression loopback Runner-Guard finding by @​pelikhan with @​Copilot in #​51947
• Align docker-sbx pre-flight step naming by @​pelikhan with @​Copilot in #​51949
• Fix errorfwrapv false positive on explicit arg index before dynamic * width by @​pelikhan with @​Copilot in #​51932
• [instructions] Sync instruction files with release v0.86.1 by @​github-actions[bot] in #​51991
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @​github-actions[bot] in #​51998
• [docs] Update glossary - daily scan by @​github-actions[bot] in #​52007
• Bump @​github/copilot-sdk from 1.0.8 to 1.0.9 in /actions/setup/js by @​dependabot[bot] in #​52005
• Bump astro from 7.1.6 to 7.2.0 in /docs by @​dependabot[bot] in #​52004
• Bump vite from 8.2.0 to 8.2.1 in /actions/setup/js by @​dependabot[bot] in #​52003
• Bump @​astrojs/starlight from 0.41.6 to 0.41.7 in /docs by @​dependabot[bot] in #​52001
• Bump @​primer/octicons from 19.32.0 to 19.33.0 in /docs by @​dependabot[bot] in #​52002
• Bump @​types/node from 26.1.1 to 26.2.0 in /actions/setup/js by @​dependabot[bot] in #​52000
• Rename panic linter test fixture functions by @​pelikhan with @​Copilot in #​52051
• Bump Claude Code CLI to 2.1.227 and Copilot CLI to 1.0.79 by @​pelikhan with @​Copilot in #​51977
• Detect spawn DI fallback bindings in error-listener rule by @​pelikhan with @​Copilot in #​51975
• Refactor duplicated pkg/cli outcome and stats helpers by @​pelikhan with @​Copilot in #​51948
• Make spawn error listener checks path-sensitive by @​pelikhan with @​Copilot in #​51982
• [eslint-miner] eslint-factory: add no-json-stringify-set-or-map rule by @​github-actions[bot] in #​51995
• Use cursor traversal in analyzer helper by @​pelikhan with @​Copilot in #​52058
• Remediate targeted custom-linter findings by @​pelikhan with @​Copilot in #​51942
• [aw] Reduce Daily PR review tool-denial failures in Copilot SDK runs by @​pelikhan with @​Copilot in #​52060
• Remediate dynamic regexp pattern findings by @​pelikhan with @​Copilot in #​51941
• Harden remote workflow import fallbacks to prevent cross-host downgrade to public GitHub by @​pelikhan with @​Copilot in #​51976
• Harden scanner/relaunch exec trust boundaries and argument validation by @​pelikhan with @​Copilot in #​52032
• docs: document --runtime flag for gh aw logs and gh aw audit by @​pelikhan with @​Copilot in #​52076
• Suppress benign workflow exfiltration findings by @​pelikhan with @​Copilot in #​52083
• Normalize report formatting in video-analyzer, plan, and centralization-drilldown workflows by @​pelikhan with @​Copilot in #​52085
• Improve GitHub Agentic Workflows documentation discoverability by @​pelikhan with @​Copilot in #​52065
• Fix inverted strict: mode documentation in frontmatter reference by @​pelikhan with @​Copilot in #​52100
• Clarify Claude engine selection in automated bootstrap by @​pelikhan with @​Copilot in #​52099

Full Changelog: github/gh-aw@v0.86.1...v0.86.2

v0.86.1

Compare Source

🌟 Release Highlights

This release delivers a broad set of compiler safety fixes, new diagnostics for gh aw fix, expanded engine support, and continued investment in automated linting and test coverage across the codebase.

✨ What's New

• New guided diagnostics: gh aw fix now offers a guided fix for restricted tools.bash allow-listing on engines that ignore it (#​51102), plus tips for known external engines (opencode, crush) missing their import (#​51088).
• Expanded engine support: Added shared engine definitions and smoke tests for Pydantic AI (#​51161), plus new example workflows for the aider, cursor, and kiro definition-based engines (#​51166). Bumped default Claude, Codex, and Playwright MCP versions (#​50947).
• PureLock initiative: Introduced a daily pure-function maximum-coverage test workflow (#​51107) that is progressively locking down core compiler functions (e.g. simplifyDataSchemaNode, parseManifestBootstrapAction) with dedicated pure-function test suites (#​51167, #​51119).
• Safe-outputs improvements: Fixed add_labels failing on pull requests in issue-intent paths (#​51168), replaced any bool-or-expression fields with *TemplatableBool for safer config typing (#​51097), and deduplicated AllowedLabels into a shared embedded config struct (#​50988).
• Log parsing: Added log-parser support for behavior-defined engines (#​50991) and a log-parser script for the cursor engine definition (#​51087).

🐛 Bug Fixes & Improvements

• Fixed the compiler re-adding a COPILOT_GITHUB_TOKEN reference when copilot-requests: write is set (#​51117).
• Fixed detection config_error caused by inaccessible GITHUB_STEP_SUMMARY in chroot environments (#​51104).
• Hardened project GraphQL lookups by replacing interpolated owner inputs with variableized requests (#​51143).
• Added a warning for unsafe pull-request-target checkouts in non-strict mode (#​51103).
• Validated slide PDF downloads before writing, and validated uv package names against PEP 508 before uv pip show (#​51142, #​51016).
• Normalized DefaultClaudeCodeVersion in wasm golden tests (#​51121) and used Unicode display widths for CLI column padding (#​51093).
• Fixed several linter false positives/negatives: write-reference dominance and alias resolution in require-fetch-response-body-try-catch (#​51027), local overflow warnings from multi-device docs testing reports (#​51026), regexpdynamicpattern POSIX coverage (#​51002), and unsafe try/catch autofix suggestions in fetch-body/JSON.parse rules (#​51017). Added a new globwalkignorederror linter to flag discarded errors from filepath.Glob/os.ReadDir (#​51185) and an ESLint rule requiring error codes in thrown errors (#​51042).

📚 Documentation

• Added guidance on using pkg/logger for debug instrumentation (#​51163).
• Synced instruction files with the 0.86.0 release and refreshed the glossary and feature docs (#​51040, #​51053, #​51052).

🔧 Internal

• Enforced autopilot mode so agents never ask for confirmation before acting (#​51123).
• Continued large-scale test-quality work: migrated tracker_id_integration_test.go to testify assertions (#​51178), added t.Parallel() to safe Go tests (#​51024), and split AWF helpers into focused modules (#​51154).
• Bumped github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3 (#​51187) and dompurify to 3.4.13 in /docs (#​51132).> Generated by 🚀 Release · auto · 17.7 AIC · ⊞ 11.3K

---

What's Changed

• Fix glossary doc: status-comment belongs under on:, not safe-outputs by @​pelikhan with @​Copilot in #​50987
• [log] Add debug logging to run phase, update compile, trial types, and safe-outputs handler/data-schema code by @​github-actions[bot] in #​50993
• Refactor toImportsResult to satisfy custom function-length linter by @​pelikhan with @​Copilot in #​50994
• [docs] Update documentation for features from 2026-08-07 by @​github-actions[bot] in #​51053
• [docs] Update glossary - daily scan by @​github-actions[bot] in [#​5

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[deepsource-io]

DeepSource Code Review

We reviewed changes in a4ccdc8...53b257c on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		May 6, 2026 11:42a.m.	Review ↗
Secrets		May 6, 2026 11:42a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-10 00:53 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-11 00:54 UTC · at 962ccd6975185fe90f9ffcf7f2c85630e810ca44

This pull request spent 1 day 33 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Changes are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.81.5). No functional changes detected. This is a Renovate bot update for GitHub Actions.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous Review Summaries (6 snapshots, latest commit 3030fd6)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3030fd6)

Status: No Issues Found | Recommendation: Merge

Overview

Changes are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.80.9). No functional changes detected. This is a Renovate bot update for GitHub Actions.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit f1d3998)

Status: No Issues Found | Recommendation: Merge

Overview

Full diff review (incremental base unavailable due to history rewrite) — changes are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.80.9). No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit e352849)

Status: No Issues Found | Recommendation: Merge

Overview

Incremental changes since commit 3c9b0f5b5bc6bd47d37bcdaa50f4a6b30ff56d6e are routine version bumps in auto-generated workflow lock files (v0.67.1 → v0.80.5). No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit 3c9b0f5)

Status: No Issues Found | Recommendation: Merge

Overview

Full diff review (incremental history unavailable) - changes are routine version bumps in auto-generated workflow lock files. No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit f04c221)

Status: No Issues Found | Recommendation: Merge

Overview

Incremental changes since previous review (commit 566df554b2b2750fe192348e6e5aea10cca7db9a) are routine version bumps in auto-generated workflow lock files. No functional changes detected.

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

Previous review (commit 566df55)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/workflows/agentics-maintenance.yml
• .github/workflows/code-simplifier.lock.yml

EOF

---

_{Reviewed by laguna-m.1-20260312:free · Input: 244.4K · Output: 2.3K · Cached: 313.1K}

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-11 00:54 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-13 17:52 UTC · at 12bb3e3ff9585ab26910b80c10e5309e29b68450

This pull request spent 2 days 16 hours 57 minutes 39 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-13 17:52 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-13 20:31 UTC · at 989e44b1b5e600b4c29575debef4592dbf4a301f

This pull request spent 2 hours 39 minutes 5 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-13 20:32 UTC · Rule: Github Actions Updates
• 🚫 Left the queue — 2026-04-15 01:25 UTC · at aa3aa42aa7fe2b49fe23b2ef31a7de0829aec225

This pull request spent 1 day 4 hours 53 minutes 29 seconds in the queue, with no time running CI.

Reason

The pull request #369 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #342, #349 and #369 together #449
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #451
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #451
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #454
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-27 20:35 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372 and #369 together #454
• 🚫 Left the queue — 2026-07-31 14:15 UTC · at 042aaea85e58685fea93bfeef6a0c73baf70897a

This pull request spent 3 days 17 hours 40 minutes 30 seconds in the queue, including 9 minutes 25 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-31 14:17 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #342, #349 and #369 together #459
• 🚫 Left the queue — 2026-07-31 19:42 UTC · at ac9e1d2b05e7ee6b12159b535440441e5fe96fd4

This pull request spent 5 hours 25 minutes 44 seconds in the queue, including 3 minutes 41 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-31 19:43 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #462
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-31 19:43 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #462
• 🚫 Left the queue — 2026-08-03 05:06 UTC · at 9ae2112cf90412fc86b839adf4404bac98a2bd85

This pull request spent 2 days 9 hours 23 minutes 16 seconds in the queue, including 6 minutes 14 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-03 05:07 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349, #342 and #369 together #465
• 🚫 Left the queue — 2026-08-03 12:42 UTC · at baf9d7594630dfeb74f94d6b979226d6814825ec

This pull request spent 7 hours 34 minutes 29 seconds in the queue, including 15 minutes 10 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-03 12:42 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349, #342 and #369 together #466
• 🚫 Left the queue — 2026-08-03 18:44 UTC · at 268b03b69763f51f78814d5858507050880bca9d

This pull request spent 6 hours 2 minutes 7 seconds in the queue, including 3 minutes 6 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-03 18:45 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349, #342 and #369 together #467
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-03 18:45 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349, #342 and #369 together #467
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-03 18:45 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349 and #369 together #468
• 🚫 Left the queue — 2026-08-06 02:28 UTC · at 4a5f7fcfd43754b3fa7917223bb33761ab63647c

This pull request spent 2 days 7 hours 43 minutes 49 seconds in the queue, including 7 minutes 9 seconds running CI.

Required conditions to merge

• any of [🛡 GitHub repository ruleset rule main]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-06 02:33 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349, #342 and #369 together #471
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-06 02:33 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• 🟠 Checks running · on draft merge queue: checking main (0ea46b4), #348, #344, #370, #371, #373, #372, #349, #342 and #369 together #471
• 🚫 Left the queue — 2026-08-06 06:47 UTC · at 587b8f255a8cd724d432897f2da58cb0902b5595

This pull request spent 4 hours 13 minutes 48 seconds in the queue, including 6 minutes 49 seconds running CI.

Reason

The pull request #369 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-06 06:48 UTC · Rule: Github Actions Updates · triggered by rule autoqueue
• ✅ Checks passed · on draft merge queue: checking main (0ea46b4), #348, #370, #371, #373, #372, #349, #342 and #369 together #478
• ✅ All checks passed · ready to merge 🚀
• 🔜 Merge