chore(deps): update github/gh-aw action to v0.71.5#369
chore(deps): update github/gh-aw action to v0.71.5#369renovate[bot] wants to merge 1 commit intomainfrom
Conversation
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Python |  |
May 6, 2026 11:42a.m. | Review ↗ |
| Secrets | |
May 6, 2026 11:42a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Merge Queue Status
This pull request spent 1 day 33 seconds in the queue, with no time running CI. ReasonThe pull request #369 has been manually updated HintIf you want to requeue this pull request, you can post a |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (2 files)
Notes: This PR updates GitHub Actions versions from Reviewed by ling-2.6-1t-20260423:free · 143,175 tokens Reviewed by ling-2.6-1t-20260423:free · 161,699 tokens |
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
962ccd6 to
12bb3e3
Compare
renovate
Bot
changed the title
Merge Queue Status
This pull request spent 2 days 16 hours 57 minutes 39 seconds in the queue, with no time running CI. ReasonThe pull request #369 has been manually updated HintIf you want to requeue this pull request, you can post a |
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
12bb3e3 to
989e44b
Compare
renovate
Bot
changed the title
Merge Queue Status
This pull request spent 2 hours 39 minutes 5 seconds in the queue, with no time running CI. ReasonThe pull request #369 has been manually updated HintIf you want to requeue this pull request, you can post a |
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
989e44b to
aa3aa42
Compare
renovate
Bot
changed the title
Merge Queue Status
This pull request spent 1 day 4 hours 53 minutes 29 seconds in the queue, with no time running CI. ReasonThe pull request #369 has been manually updated HintIf you want to requeue this pull request, you can post a |
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
aa3aa42 to
a1b536b
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
a1b536b to
f0226e8
Compare
renovate
Bot
changed the title
Merge Queue Status
This pull request spent 4 hours 34 minutes 17 seconds in the queue, with no time running CI. ReasonThe pull request #369 has been manually updated HintIf you want to requeue this pull request, you can post a |
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
f0226e8 to
45c1e61
Compare
renovate
Bot
changed the title
Merge Queue Status
This pull request spent 5 days 18 hours 45 minutes 48 seconds in the queue, with no time running CI. ReasonThe pull request #369 has been manually updated HintIf you want to requeue this pull request, you can post a |
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
45c1e61 to
cf17f3a
Compare
renovate
Bot
changed the title
Merge Queue Status
|
renovate
Bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
cf17f3a to
53b257c
Compare
renovate
Bot
changed the title
|
This PR contains the following updates:
v0.67.1→v0.71.5Release Notes
github/gh-aw (github/gh-aw)
v0.71.5Compare Source
🌟 Release Highlights
This release focuses on reliability and correctness across the
engine.envcompilation pipeline, the security check layer, and the Claude engine — with five community-reported issues resolved.🐛 Bug Fixes & Improvements
Claude engine stability — Workflows using the
claudeengine no longer crash mid-session with "Fast mode unavailable".CLAUDE_CODE_DISABLE_FAST_MODE=1is now set automatically to suppress an incompatible server-side flag introduced in Claude Code 2.1.120+.engine.envmulti-line values — Block-scalarengine.envvalues (written with>-and extra-indented continuation lines) previously compiled to broken YAML with embedded newlines. These now compile correctly into valid multi-lineenv:entries. (Reported by@jeffhandleyin #30204)engine.envneedsexpressions — Custom job references inengine.envvalues (e.g.${{ needs.my_job.outputs.value }}) were silently dropped from the agent job'sneedslist, causing those expressions to evaluate to empty strings at runtime. The compiler now correctly wires these dependencies. (Reported by@jeffhandleyin #30232)gh aw upgradefalse BYOK warning —gh aw upgradewas incorrectly warning "Remove unsafe secrets from engine.env" forCOPILOT_PROVIDER_API_KEYandCOPILOT_PROVIDER_BEARER_TOKEN, silently stripping legitimate BYOK configuration.gh aw upgradenow matchesgh aw compilein allowing these keys. (Reported by@MauroDruwelin #30178)pull_request_reviewactivation signal — Workflows triggered bypull_request_reviewevents no longer silently skip the 👀 reaction andrun-startedcomment. ThebuildReactionLikeConditionallowlist now includes this event type. (Reported by@mason-timin #30336)Confused-deputy false positive for bot-menu patterns — The security check introduced in v0.71.4 was blocking the legitimate pattern where a bot posts a checkbox-menu comment and a human maintainer edits it to tick a box (
issue_comment:edited). The check now automatically detects[bot]-authored comments and skips the guard for that path, while keeping all otherissue_comment:createdpaths fully protected. (Reported by@theletterfin #30327)✨ What's New
allow-bot-authored-trigger-commentfrontmatter option — For bots that don't follow the standard[bot]naming convention, you can now opt into the confused-deputy bypass explicitly:MCP progress notifications — The
logs,audit, andaudit-diffMCP tools now stream real-time progress updates to AI clients (Copilot, Claude) during long-running operations, eliminating silent 30+ second waits.MCP Gateway bump to v0.3.6 — The embedded MCP gateway has been updated to
ghcr.io/github/gh-aw-mcpg:v0.3.6with pinned digest for supply-chain safety.🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release!
@jeffhandleyengine.envvalues (direct issue)@mason-timpull_request_reviewtriggers —buildReactionLikeConditionallowlist is incomplete (direct issue)@MauroDruwel@theletterfFor complete details, see CHANGELOG.
What's Changed
$INSTRUCTIONassertion inTestEngineArgsIntegrationCodexby @Copilot in #30100metadatafield by @github-actions[bot] in #30099labelsfield by @github-actions[bot] in #30098actions: readpermission to smoke-water.yml (#investigate-smoke-water-failure) by @Copilot in #30197mcp list-toolstab completion offering completions for second positional arg by @Copilot in #30221apiProxy.modelsinstead of top-levelconfig.modelsby @Copilot in #30367agentic-opsworkflows by @mnkiefer in #30379MustBeWithin→ValidatePathWithinBaseinpkg/fileutilby @Copilot in #30421template_branch.cjsnull-else branch typing by @Copilot in #30424template_branch.cjsintegration gaps by @Copilot in #30425Full Changelog: github/gh-aw@v0.71.4...v0.71.5
v0.71.4Compare Source
🌟 Release Highlights
This release delivers a major A/B experimentation infrastructure, significant performance optimizations, improved security hardening, and a growing set of engine/model improvements.
✨ What's New
🧪 A/B Experiments CLI & Infrastructure
A full experiment lifecycle is now supported: define variants, run them round-robin, collect per-run state, and analyze results statistically. New commands include
gh aw experimentsto read experiment state from storage branches andgh aw experiments analyzefor statistical computation (significance testing, sample-size tracking). Workflows can now store experiment state in either cache or a dedicated repo branch.experimentscommand for reading experiment stateexperiments analyzewith statistical computationcache|repo, defaultrepo) to experiments🤖 Codex Engine: Default Harness with Retry Logic
Codex workflows now get a default
codex_harness.cjswith built-in retry logic, making Codex-engine workflows more resilient out of the box. (#30035)🔬 AWF /reflect Endpoint Integration
Agent harnesses now fetch the
/reflectendpoint before and after running the agent, surfacing model introspection data in step summaries for better observability. (#29420, #30028)🔐 Pull Request Security: pwn-request Detection
The compiler now validates
pull_request_targetworkflows and detects patterns that could expose secrets to untrusted code — protecting repositories from confused-deputy attacks. (#29433)📊 Multiple OTLP Endpoints
The
endpointfield in OTLP observability config is now polymorphic — supply a single endpoint string or an array to fan out telemetry to multiple backends simultaneously. (#30021)🏷️ Model Aliases & Validation
New builtin aliases
gpt-4.1,reasoning(o1/o3/o4 families), andgpt-5-nano; fixedgpt-5-minimultiplier placeholder (was0). Model aliases are now validated against the Model Alias Format spec. GitHub Actions expressions are now supported in alias parsers. (#30003, #30000, #29995)🔒 Minimal Secrets Inheritance by Default
Workflows no longer use
secrets: inheritby default — the compiler now infers the minimal set of secrets actually needed, reducing the blast radius of any token compromise. (#29455)⏱️
--cool-downFlag forupdateCommandgh aw updatenow accepts--cool-down(default7d) to avoid re-updating workflows that were recently refreshed. (#29454)🖼️
<img>Tags in Safe OutputsSafe-outputs HTML rendering now allows
<img>tags, enabling richer formatted output in issue/PR comments. (#29401)⚡ Performance
buildJobs(#29410)🐛 Bug Fixes & Improvements
UpdateActionsno longer pins actions to older SHAs (#29477)mcp-cli-bridgenow supports multiline tool arguments via stdin (#29446)📚 Documentation
gh-proxymode (#29412)🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release!
@bartulUpload activation artifactstep missinginclude-hidden-files: true— silently drops.claude/.githubfrom activation snapshot (direct issue)@MauroDruwel@sg650<img>to safe-outputs HTML tag allowlist (direct issue)@szabta89For complete details, see CHANGELOG.
What's Changed
{{#import}}with{{#runtime-import}}in workflow files by @Copilot in #29399<img>to safe-outputs HTML tag allowlist by @Copilot in #29401include-hidden-files: trueto activation artifact upload step by @Copilot in #29510botsfrom main JSON schema by @Copilot in #29592{{#if}}/{{#else}}/{{#endif}}template syntax in instructions files by @Copilot in #29637coolDownarg inresolveLatestRefcalls by @Copilot in #29643## agent: \name`` / H2 boundary delimiters with per-engine placement (experimental) by @Copilot in #29668Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.