bug: gh-aw 0.68.1 bump merged without lock file recompilation — all agent workflows broken

[microsasa]

Summary

All four agent workflows (perf-analysis, feature-planner, issue-implementer, test-analysis) are failing because the Copilot CLI engine blocks both MCP servers (github and safeoutputs) by policy. Without MCP access, agents cannot call noop, create_pull_request, or any other safe-output tool, causing every run to be marked as a failure.

Root Cause

PR #920 (dependabot) bumped github/gh-aw from 0.66.1 → 0.68.1 and PR #919 bumped github/gh-aw-actions to match. Both were merged on April 13.

However, the .lock.yml files were never recompiled after the merge. They still contain:

# compiler_version: "v0.66.1"
uses: github/gh-aw-actions/setup@v0.66.1
GH_AW_INFO_CLI_VERSION: "v0.66.1"

This creates a version mismatch: the repository declares 0.68.1 as the gh-aw version, but the lock files (which are what GitHub Actions actually executes) still reference 0.66.1 actions/setup steps compiled by the 0.66.1 compiler. The 0.68.1 release included security hardening changes (agent-stdio.log permissions, MCP gateway token redaction) and Copilot CLI pinning that likely changed how the sandbox policy is evaluated — the stale lock files do not include these changes, producing a broken intermediate state.

Evidence

Every failed run since April 13 shows the same error in agent-stdio.log:

! 2 MCP servers were blocked by policy: 'github', 'safeoutputs'

Affected issues (all filed April 16, all showing this error):

• [aw] Performance Analysis failed #933 (perf-analysis, run 24490894263)
• [aw] Issue Implementer failed #934 (issue-implementer, run 24491030131)
• [aw] Feature Planner failed #935 (feature-planner, run 24491111049)
• [aw] Test Suite Analysis failed #936 (test-analysis, run 24491278184)

The lock file header confirms the stale version:

# This file was automatically generated by gh-aw (v0.66.1). DO NOT EDIT.
# gh-aw-metadata: {"compiler_version":"v0.66.1",...}

Fix

Run gh aw compile to regenerate all .lock.yml files with the 0.68.1 compiler, then commit and push both the .md and .lock.yml files.

Related

• PR build(deps): Bump github/gh-aw from 0.66.1 to 0.68.1 #920 — dependabot bump of gh-aw 0.66.1 → 0.68.1 (merged without recompile)
• PR build(deps): Bump github/gh-aw-actions from 0.66.1 to 0.68.1 #919 — dependabot bump of gh-aw-actions to 0.68.1 (merged without recompile)
• PR build(deps): Bump actions/github-script from 8.0.0 to 9.0.0 #917 — actions/github-script 8 → 9 (also merged same day, may contribute)