[bootc-bot]

This PR contains the following updates:

Package	Type	Update	Change
github/gh-aw	uses-with	major	v0.93.5 → v1.0.1

---

Release Notes

github/gh-aw

v1.0.1

Compare Source

🌟 Release Highlights

v1.0.1 focuses on safer pull request outputs, smoother compile and update workflows, and improved observability.

✨ What's New

• Lock-safe pull request outputs: code-producing workflows now use lock-safe PR outputs, with a suggested lock exclusion when workflow permission pushes fail (#​72396, #​72423).
• Actions-lock integration: compile can now optionally integrate with actions-lock (#​72395).
• Guided pull_request_target fixes: guided remediation with safe role restriction (#​72412).
• Interactive org and enterprise update rollouts (#​72418).
• Native Actions expression grammar replaces legacy expression parsing (#​72413).
• Richer unified sessions: safe-output, safe job/script, and memory-save outcomes are now recorded (#​72146, #​72138, #​72133), plus harness retry telemetry in spans and usage artifacts (#​71934).
• Copilot CLI upgraded to 1.0.103 with a reviewed checksum pin (#​72099).

🐛 Bug Fixes & Improvements

• Preserve cancelled startup failure diagnostics and suppress noisy startup-failure reports for cancelled jobs (#​72432, #​72405).
• Fix privileged AWF environment forwarding on sudo-rs (#​72409).
• Merge imported job outputs with main workflow precedence (#​72407).
• Honor newer cached action pins in runtime setup (#​72272).
• Trust same-repository bot PRs triggered by labels (#​72074).
• Enforce ubuntu-slim timeout limits and upgrade default runners for longer jobs (#​72131).
• Fill model pricing gaps and accept none/max for pinned Codex routing (#​72414, #​70952).
• Harden AWF release download retries and fix work-queue provisioning recovery (#​72157, #​72400).

📚 Documentation

• New explanation of the activation gate and CAO integration (#​72379) and a leaner troubleshooting guide (#​72280).

Generated by 🚀 Release · copilot · auto · ~15 AIC · ⊞ 12.9K

---

What's Changed

• Trust same-repository bot PRs triggered by labels by @pelikhan with @Copilot in #​72074
• Upgrade Copilot CLI to 1.0.103 with reviewed checksum pin by @pelikhan with @Copilot in #​72099
• [blog] Agent of the Day – 2026-10-26 by @github-actions[bot] in #​72127
• Soften container pin update failure messages by @dsyme in #​72093
• Use Gonum helpers for grader descriptive statistics by @pelikhan with @Copilot in #​72100
• Correct map tool usage in built-in ledger smoke workflow by @pelikhan with @Copilot in #​72095
• Make setup action reference tests deterministic by @pelikhan in #​72155
• Enforce ubuntu-slim timeout limits and upgrade default runners for longer jobs by @pelikhan with @Copilot in #​72131
• Record memory save outcomes in unified sessions and conclusion data by @pelikhan with @Copilot in #​72133
• Model routing: accept none/max for pinned Codex and add routed Codex smoke by @SivaKesava1 with @Copilot in #​70952
• Preserve harness retry telemetry in spans and usage artifacts by @pelikhan with @Copilot in #​71934
• Record safe job and script outcomes in unified sessions by @pelikhan with @Copilot in #​72146
• Record privacy-preserving safe-output outcomes in unified sessions by @pelikhan with @Copilot in #​72138
• Fix Aider Go test stub package declarations by @pelikhan in #​72164
• Harden AWF release download retries and diagnostics by @pelikhan in #​72157
• Preview Notices by @salilsub in #​72217
• Revert "Preview Notices (#​72217)" by @pelikhan in #​72281
• Retry transient PR Sous Chef API failures by @pelikhan in #​72282
• [docs] docs: unbloat troubleshooting/common-issues.md by @github-actions[bot] in #​72280
• [log] Add debug logging to unlogged branches in cli package-manifest/actionlint code by @github-actions[bot] in #​72299
• [instructions] Sync instruction files with release v0.93.5 by @github-actions[bot] in #​72363
• Honor newer cached action pins in runtime setup by @pelikhan with @Copilot in #​72272
• docs: explain the activation gate and CAO integration by @pelikhan in #​72379
• chore: update action and container pins by @pelikhan in #​72377
• build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 in /actions/setup/js in the npm_and_yarn group across 1 directory by @dependabot[bot] in #​71506
• build(deps): bump undici from 6.29.0 to 6.29.1 in /actions/setup/js in the npm_and_yarn group across 1 directory by @dependabot[bot] in #​72384
• build(deps): bump library/alpine from 294b683 to be26560 by @dependabot[bot] in #​72393
• Refactor arXiv paper memory to use a built-in ledger by @pelikhan in #​72394
• build(deps): apply pending Dependabot updates by @pelikhan in #​72397
• [docs] Update documentation for features from 2026-10-27 by @github-actions[bot] in #​72406
• Fix work-queue provisioning transport recovery by @pelikhan in #​72400
• fix: fill model pricing gaps and restore 1ES-compatible Vite by @pelikhan in #​72414
• feat: add optional actions-lock integration to compile by @pelikhan in #​72395
• Suppress startup-failure reports for cancelled agent jobs by @pelikhan with @Copilot in #​72405
• Add guided pull_request_target fixes and safe role restriction by @pelikhan in #​72412
• Merge imported job outputs with main workflow precedence by @pelikhan in #​72407
• Add lock-safe pull request outputs and migrate code-producing workflows by @pelikhan in #​72396
• Add interactive org and enterprise update rollouts by @pelikhan in #​72418
• Replace legacy expression parsing with native Actions grammar by @pelikhan in #​72413
• Suggest lock exclusion for workflow permission push failures by @pelikhan in #​72423
• fix: refresh vendored Node image pin to patched build by @pelikhan in #​72382
• [blog] Agent of the Day – 2026-10-27 by @github-actions[bot] in #​72460
• Preserve cancelled startup failure diagnostics by @pelikhan in #​72432
• [dead-code] chore: remove dead functions — 3 functions removed by @github-actions[bot] in #​72463
• Refactor issue and comment Markdown into report trees by @pelikhan in #​72415
• Fix privileged AWF environment forwarding on sudo-rs by @pelikhan in #​72409

Full Changelog: github/gh-aw@v1.0.0...v1.0.1

v1.0.0

Compare Source

🔧 Maintenance Release

v1.0.0 focuses on housekeeping: documentation refreshes, GitHub Actions version updates, improved debug logging, and expanded schema coverage.

📚 Documentation

• Added an AI Transparency Notice (#​71520).
• Refreshed the glossary, architecture diagram, and synced instruction files.

🔧 Under the Hood

• Added debug logging to agentdrain and actionpins for easier troubleshooting.
• Added a schema coverage demo for the work-queue-policy field.
• Updated the Safe Outputs conformance checker for recent spec changes.

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.6K

---

What's Changed

• [docs] Update glossary - weekly full scan by @​github-actions[bot] in #​72068
• [architecture] Update architecture diagram - 2026-10-26 by @​github-actions[bot] in #​72054
• [instructions] Sync instruction files with release v0.93.5 by @​github-actions[bot] in #​72051
• [spec-review] Update Safe Outputs conformance checker for recent spec changes by @​github-actions[bot] in #​72004
• [log] Add debug logging to remaining unlogged functions in agentdrain and actionpins by @​github-actions[bot] in #​71993
• [schema-coverage] feat: Add schema coverage demo for work-queue-policy field by @​github-actions[bot] in #​72028
• [actions] Update GitHub Actions versions - 2026-10-26 by @​github-actions[bot] in #​72037
• AI Transparency Notice by @​salilsub in #​71520

Full Changelog: github/gh-aw@v0.93.6...v1.0.0

v0.93.6

Compare Source

🌟 Release Highlights

A focused release strengthening infrastructure dependencies, compile/audit reliability, and validation.

✨ What's New

• Updated runtime stack: MCP Gateway bumped to v0.5.0 and the firewall to v0.29.0.
• Better expression validation: missing step references in Actions/AW expressions are now detected at compile time.
• Resilient MCP tooling: compile and audit timeouts now return stage-aware partial results instead of failing outright.

🐛 Bug Fixes & Improvements

• Threat detection that is skipped no longer reports inherited agent tokens.
• Fixed a compile-progress file permission policy violation.
• Hardened fetch-script portability and structured lint reporting.
• Cached state is now read before workflow analysis, and title-parsing benchmarks are separated from file I/O costs.

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.6K

---

What's Changed

• Separate workflow title parsing from file-I/O benchmark costs by @​pelikhan with @​Copilot in #​71927
• Read cached state before workflow analysis by @​pelikhan with @​Copilot in #​71878
• Detect missing step references in Actions/AW expressions by @​pelikhan with @​Copilot in #​71926
• Return stage-aware partial results for MCP compile and audit timeouts by @​pelikhan with @​Copilot in #​71886
• Fix compile-progress file permission policy violation by @​pelikhan with @​Copilot in #​71947
• Prevent skipped threat detection from reporting inherited agent tokens by @​pelikhan with @​Copilot in #​71933
• Harden fetch-script portability and structured lint reporting by @​pelikhan with @​Copilot in #​71932
• Bump MCPG to v0.5.0 and firewall to v0.29.0 by @​lpcox with @​Copilot in #​71957
• [blog] Weekly blog post – 2026-10-26 by @​github-actions[bot] in #​71984
• [community] Update community contributions in README by @​github-actions[bot] in #​71976

Full Changelog: github/gh-aw@v0.93.5...v0.93.6

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.