Blog

Weekly Update – August 17, 2026

Aug 17, 2026

Another busy week for github/gh-aw! The team shipped v0.87.0, a release packed with security hardening, a new safe output for fork pull requests, and dozens of smaller reliability improvements across the workflow ecosystem.

Release: v0.87.0

v0.87.0 landed on August 16th and is best described as a major internal hardening pass — custom linters, security fixes, and refactors — plus one notable new capability.

What’s New

Approve fork pull request workflow runs (#52541): a new experimental approve-workflow-run safe output lets agents programmatically unblock GitHub’s fork PR approval gate, with strict guardrails including protected-file checks, allowed-workflow/PR scoping, and required external tokens. See ADR-52541 for the design rationale.
Cloud-hypervisor agent runtime (#52932): enabled on eligible agentic workflows for improved isolation.
Model inventory refresh (#52993): added Gemini 3.7 Flash and Grok 4.6 to the supported model list.
Extended confused-deputy protection (#52976) to pull_request_target triggers, plus removal of several vulnerable/deprecated container image pins (gh-aw-firewall, cli-proxy, Serena MCP).

Full details, including the dozens of new custom lint rules that shipped alongside this release, are in the v0.87.0 release notes.

Notable Pull Requests

Beyond the release, the past week saw a steady stream of merged fixes and improvements:

Migrate 30 more agentic workflows to the gh-aw-detection feature — continues the rollout of the shared detection framework across more of the repository’s workflows.
Fix Aider engine producing no safe outputs by pinning the diff edit format — resolves a silent failure mode where the Aider engine could complete a run without emitting any safe outputs.
Harden sandbox.mcp.env key encoding at emission and launch boundaries — tightens how MCP environment variables are encoded to avoid injection risks.
Fill documentation gaps found by Agent Persona Explorer run — adds missing docs for schedule-based compliance audits, PM digests, and multi-scenario comparisons, surfaced by an internal agent persona exploration run.
Handle bare Design Decision Gate workflow dispatch — fixes an edge case in manual dispatch handling for the Design Decision Gate workflow.

Agent of the Week: Issue Arborist

Every night at the crack of dawn (05:38 UTC, to be exact), Issue Arborist quietly analyzes the repository’s recent issues and links related ones together as sub-issues — building out the “family tree” of the issue tracker one branch at a time.

Over its last three scheduled runs, Issue Arborist has been remarkably consistent: each run completes in under 11 minutes, churns through around 15 GitHub API calls, and reliably produces 8–14 safe output items per run — all without a single error or missing tool across the board. It’s the kind of quiet, dependable background work that keeps the issue tracker organized without anyone having to lift a finger.

There’s something charmingly patient about a workflow whose entire job is to notice “hey, these two issues are actually talking about the same thing” — night after night, without complaint, and without ever needing a coffee break.

Usage tip: Schedule-based triage workflows like this one work best when paired with skip-if-match conditions (as Issue Arborist uses) to avoid redundant runs when there’s nothing new to organize.

→ View the workflow on GitHub

Try It Out

Check out v0.87.0 and give the new approve-workflow-run safe output a spin if you work with fork pull requests. As always, feedback and contributions are welcome over at github/gh-aw.

Weekly Update – August 10, 2026

Aug 10, 2026

Copilot

It’s been another busy week in github/gh-aw, with two notable releases and dozens of merged pull requests touching everything from compiler safety to CI stability. Here’s what shipped.

Release: v0.86.1

v0.86.1 landed on August 7th with a broad set of compiler safety fixes, new gh aw fix diagnostics, and expanded engine support.

What’s New

Guided gh aw fix diagnostics: The tool now offers a guided fix for restricted tools.bash allow-listing on engines that ignore it (#51102), plus tips for known external engines like opencode and crush missing their import (#51088).
Expanded engine support: Added new example workflows for the aider, cursor, and kiro definition-based engines (#51166).
PureLock initiative: Introduced a daily pure-function maximum-coverage test workflow (#51107) that is progressively locking down core compiler functions with dedicated test suites (#51167, #51119).
Safe-outputs improvements: Fixed add_labels failing on pull requests in issue-intent paths (#51168) and replaced loosely-typed bool-or-expression fields with *TemplatableBool for safer config typing (#51097).

Release: v0.86.0

v0.86.0 shipped earlier the same day as a heavy security and reliability hardening pass across secret redaction, MCP gateway logging, and threat-detection resilience.

Security & Redaction

Secrets can no longer leak through logs or artifacts. Redaction is now enforced in step summaries (#50777), patch/bundle artifacts (#50778), and MCP gateway diagnostic logs (#50961).
URL handling hardened: userinfo is now stripped from logged URLs and rejected URLs are no longer logged in full (#50776).
upload_artifact safe-output now restricts uploads to canonical allowed roots and rejects sensitive paths (#50779).

Notable Pull Requests

Beyond the releases, the team merged a steady stream of fixes and quality-of-life improvements:

Skip stale review-thread node IDs instead of failing safe_outputs — makes resolve_pull_request_review_thread more resilient to stale GraphQL node IDs.
Grant agentic engines read/write access to /tmp/gh-aw in AWF sandbox — smooths out sandboxed engine runs that need scratch space.
Fix recurring gh-aw-firewall digest-pin loss on DefaultFirewallVersion bumps — keeps firewall image pins from silently drifting on version bumps.
Add explicit end marker syntax for inline skills and sub-agents — clarifies where inline skill and sub-agent content ends in workflow markdown.
Fix Copilot path portability across runners — irons out cross-platform path handling for the Copilot engine.

Agent of the Week: PureLock

PureLock is the daily workflow that quietly locks down up to three uncovered pure Go functions per run, writing dedicated test suites so core compiler logic doesn’t regress unnoticed.

This week PureLock ran three times — once from its daily schedule and twice via manual dispatch — clocking in at 15 to 22 minutes per run and burning through roughly 60,000 tokens total. All three runs completed successfully and stayed strictly read-only until their final PR, methodically chipping away at coverage gaps. Its handiwork showed up directly in this week’s release notes, with #51586 locking down sameExpr, addAllowedToNetwork, and rpcEntryToTimelineEvent with pure-function test suites.

Give it a function name like simplifyDataSchemaNode and it will happily go write exhaustive tests for it without complaint — the kind of unglamorous, repetitive work that keeps a growing Go codebase honest one pure function at a time.

Usage tip: Pair a coverage-locking workflow like this with your CI’s coverage gate so newly written tests actually prevent regressions instead of just padding a report.

→ View the workflow on GitHub

Try It Out

Update to v0.86.1 today to get the latest diagnostics and security hardening. As always, feedback and contributions are welcome in github/gh-aw.

Weekly Update – August 3, 2026

Aug 3, 2026

Copilot

Another packed week in github/gh-aw: five releases (v0.83.4 through v0.84.2) and over 100 merged pull requests. This week’s theme was hardening — shell script safety, container security, and closing sneaky edge cases in the safe-outputs pipeline.

Release Highlights

v0.84.2 — August 1

A maintenance release focused on stability and security, with no breaking changes.

Fixed an argument injection vulnerability (CWE-88) in the git archive fallback path (#49500)
Hardened the PR Description Updater against one-shot safe-output exhaustion (#49463)
Stacked PR runs now default to top-of-stack, with a configurable on.pull_request.max-stack option extended to pull_request_review gating (#49420, #49453)
Explicit auto-merge strategies are now supported in safe-outputs.create-pull-request (#49412)
CLI version bumps across the board: Copilot 1.0.77, Pi 0.83.0, Playwright Browser v1.62.1, Syft v1.50.0, Grype v0.116.1 (#49521)

v0.84.0 and v0.84.1

These releases rolled out a shellcheck linting phase for generated run steps in the compile pipeline, plus continued security patching for third-party MCP containers.

Notable Pull Requests

feat: shellcheck disabled by default, opt-in via --shellcheck/--validate, parallel execution — the new shellcheck gate ships opt-in first, so teams can adopt it on their own schedule while the compiler still catches real script bugs when enabled.
fix(security): disable semgrep/semgrep container — Critical/High CVEs and security: remove mcp/markitdown container (849 CVEs) — proactive removal of MCP containers with unpatched vulnerabilities, keeping the default toolset safe by default.
Fix gh-aw-node brace-expansion patch (GHSA-mh99-v99m-4gvg) — replaced a brittle npm --prefix overlay with a temp-dir copy, closing a supply-chain gap.
Add first-class agent job gating via jobs.agent.needs and jobs.agent.if — workflow authors can now express fine-grained dependencies and conditions directly on the agent job.
Rescue completed watchdog-fired Copilot runs from false authentication_failed classification — one of several reliability fixes that reduce false-positive failure reports in the dashboards.

Agent of the Week: Dead Code Removal Agent

Every day, this quiet janitor scans the codebase for functions nobody calls anymore — and deletes them, no drama required.

This week it stayed characteristically productive: across its last three scheduled runs it logged zero errors and zero warnings, chewing through roughly 43K tokens total, and its August 1st run (#49801) walked away with four confirmed dead functions removed in a single pass. One earlier run did hit a rough patch — a merge-conflict-heavy branch tripped it into a “risky” classification — but it shrugged that off and came back clean the very next scheduled run.

It’s the kind of agent that never asks for credit: three runs, one clean PR, and a repo that’s just a little tidier than it was last Tuesday.

Usage tip: Schedule dead-code cleanup agents like this one on a low-traffic cadence (daily or every few days) so PRs stay small, reviewable, and easy to revert if a “dead” function turns out to have a reflection-based caller.

→ View the workflow on GitHub

Try It Out

Update to v0.84.2 and give the new shellcheck flags a spin with --validate. As always, bug reports, security findings, and PRs are welcome in github/gh-aw.

Weekly Update – July 27, 2026

Jul 27, 2026

Copilot

It was a busy week in github/gh-aw — four releases landed between Monday and Friday, each one stacking new capabilities on top of the last. Here’s a look at what shipped.

Releases This Week

v0.83.0 — July 22

A focused security and developer-experience release.

Three new ESLint rules ship in one go: stringsjoinone catches unnecessary single-element strings.Join calls, no-setfailed-then-exit-zero prevents masked CI failures, and require-execfilesync-try-catch enforces error handling around execFileSync.
Sub-30s make test-unit — tests now run impacted packages first, giving you fast feedback without waiting for the full suite.
close_issue state-reason — agents that close issues can now pick the closure reason dynamically (completed, not-planned, etc.), making your workflows more expressive.

v0.83.1 — July 23

This one expanded gh aw compile into a proper security pipeline.

Container vulnerability scanning with Grype (#47474) — compile now checks gh-* workflow container images for CVEs before deployment.
License auditing and YAML linting are also now part of the compile pass, catching problems before they hit production.

v0.83.2 — July 24

Reliability and security fixes.

Smarter gh aw add (#47690) — local skill references are now auto-rewritten to fully-qualified specs on gh aw add, so workflows stay portable when you share them.
Shell injection detection improvements and a WIF auth regression fix round out the security hardening.

v0.83.3 — July 25

The biggest release of the week.

Git argument injection fix (VULN-001) (#47957) — a security fix for unvalidated ref/path values in remote import fallbacks that could allow command injection via crafted ref names.
GraphQL injection fix (#47952) — resolved two code scanning alerts for GraphQL injection in getOwnerNodeId.
GitHub MCP Server v1.7.0 (#47923) — all workflows now get the latest MCP tool improvements out of the box.
stringsconcatloop linter (#47894) — a new Go analyzer catches string += inside loops and guides you toward strings.Builder.
Post-update SHA integrity validation (#47959) — actions-lock entries are now SHA-verified after updates, closing a supply-chain tampering vector.
WASM panic recovery (#47854) — playground users will no longer see stuck promises after a compile panic.

Agent of the Week: Daily GitHub Docs SEO Optimizer

The newest addition to the workflow roster — quietly making sure GitHub Docs can actually find gh-aw when you need it.

daily-github-docs-seo-optimizer was shipped in v0.83.3 (#47975) and immediately got to work. Its job is to scan GitHub Docs pages and identify minimal, targeted updates that would help Copilot CLI surface Agentic Workflows as solutions to repository automation tasks. It’s not trying to game search engines — it’s trying to make sure that when a developer asks Copilot “how do I automate issue triage?”, the answer actually mentions gh aw.

Fresh off the assembly line this week, it hasn’t accumulated a rich log history yet (give it time), but the design is interesting: it runs daily on gpt-5.4 with a bare driver and creates issues prefixed [github-docs-seo] when it finds documentation gaps worth flagging. No filesystem writes, no PR spam — just targeted observations filed as issues for humans to review.

Usage tip: If you’re maintaining a library or CLI tool, a similar workflow can continuously audit whether your documentation appears in the right Copilot/LLM context for common developer questions — without needing a dedicated SEO team.

→ View the workflow on GitHub

Try It Out

Upgrade to v0.83.3 to get the full set of security fixes, the new GitHub MCP Server v1.7.0, and the expanded linter suite. Questions and contributions are always welcome in github/gh-aw.

Weekly Update – July 20, 2026

Jul 20, 2026

Copilot

Another action-packed week in github/gh-aw! Between a fresh release, a firewall bump, improved rootless runner support, and a thoroughly redesigned workshop experience, there was plenty to keep the bots busy.

Release: v0.82.13

v0.82.13 landed on July 18th with smarter tooling, better defaults, and one breaking change to be aware of.

! Breaking Change

gh aw add now rejects packages with aw.yml config (#46273): If you maintain packages that include an aw.yml configuration file, update them before upgrading — the CLI will now refuse to install them outright.

What’s New

Auto-configure COPILOT_PROVIDER_WIRE_API from the model catalog (#46156): The CLI now resolves the provider wire API endpoint automatically, so you don’t have to set it by hand.
Default-on issue intent metadata (#46207): set_issue_type, set_issue_field, and add_labels now emit intent metadata by default — richer audit trails with zero extra config.
NO_COLOR support (#46197): The CLI now honours the NO_COLOR environment variable for cleaner output in CI and accessibility-focused terminals.
Stronger ESLint alias detection (#46365): The no-core-setoutput and exportvariable rules now catch aliased and destructured @actions/core bindings, closing a common bypass pattern.

Notable Pull Requests

Firewall bump to v0.27.37: The default gh-aw-firewall was updated from v0.27.35 to v0.27.37, bringing ANTHROPIC_AUTH_TOKEN credential isolation, ~/.local/bin added to sandbox PATH for rootless Copilot installs, and runner doctor catalog updates.
Rootless flag for ARC/DinD runners: install_copilot_cli.sh now accepts a --rootless flag for ARC and Docker-in-Docker runner environments — a welcome fix for teams running Copilot on custom runners.
New timenowsub linter: The linter-miner contributed another Go linter that flags time.Now().Sub(t) and auto-rewrites it to the idiomatic time.Since(t). Small but satisfying.
Workshop redesign: The workshop has been moved to /workshop/, simplified to match docs styling (#46593), and now shows step counts on entry and scenario cards (#46622) — making it much easier to gauge how much is left before you start.
MCP toolsets sync: GitHub MCP toolset mappings were synced with the upstream github-mcp-server main branch, keeping tool definitions up to date.

Agent of the Week: Avenger

The CI guardian who never sleeps — Avenger runs every hour, checks whether CI is passing, and if it’s not, merges main, runs recompile/fmt/lint/test, and opens a PR with any fixable issues.

This week, Avenger ran multiple times and achieved success across the board, quietly keeping the codebase tidy during the busy firewall bump and workshop refactor merge storm. Each run it faithfully pulled in the latest main, ran the full quality gauntlet, and — finding nothing broken — went back to sleep without making a fuss.

The highlight of Avenger’s week was its run right after the v0.27.37 firewall bump landed, where it dutifully checked that all 258 recompiled .lock.yml files hadn’t introduced any CI regressions. They hadn’t. Avenger nodded once and clocked out.

Usage tip: Avenger shines in repos where automated PRs (dependency bumps, codegen, lock file updates) can quietly break CI — it catches those regressions within the hour so humans don’t have to.

→ View the workflow on GitHub

Try It Out

Grab v0.82.13 and take the redesigned workshop for a spin. As always, feedback and contributions are welcome in github/gh-aw.