build(deps): bump github/gh-aw/actions/setup from 0.81.6 to 0.82.14 - #8398

Sourced from github/gh-aw/actions/setup's releases.

v0.82.14

🌟 Release Highlights

This release focuses on safe-outputs reliability, workshop UX polish, a new top-level model field, and a wave of new linters and security guardrails.

✨ What's New

• Top-level model field — You can now specify the model at the top level of your workflow (e.g., model: claude-sonnet-4-5), deprecating the nested engine.model path. Reference docs
• auto_upgrade_cron in aw.json — Configure a custom auto-upgrade schedule directly in your project manifest instead of relying on defaults.
• Evals enabled across 64 agentic workflows — Broader evaluation coverage improves regression detection and workflow quality assurance.
• --rootless flag for install_copilot_cli.sh — ARC/DinD runners can now install the Copilot CLI without root privileges.
• Mode-specific intent guidance for safe-output tools — Mutation tools now surface targeted guidance based on the current workflow mode, reducing misuse and improving agent decision quality.
• Fail-fast guardrail for schema file changes — The compiler now rejects schema changes that were made without a rebuild, preventing subtle runtime mismatches.
• Workshop: journey/adventure filtering, GFM alerts & task lists — Workshop steps now support filtering by journey/adventure tags, render GitHub-flavored alerts (> [!NOTE]), and display task-list checkboxes.
• Workshop URL hash navigation — Browser back/forward now restores workshop state via URL hash encoding.
• DeepSec & VulnHunter security scan workflows — On-demand and daily security scanning workflows added for continuous vulnerability detection.
• errgroup for structured concurrency in MCP inspector — Replaces ad-hoc goroutine management with proper error propagation.

🐛 Bug Fixes & Improvements

• tools.startup-timeout now propagates to gateway.startupTimeout — Fixes safeoutputs eviction on slow runners where the gateway was timing out before the tool server was ready.
• OTEL_SERVICE_NAME respected — User-defined OpenTelemetry service names are no longer overridden when OTLP observability is enabled.
• MCP CLI prompt list reflects --disable-builtin-mcps — The listed MCP servers now accurately reflect which servers are actually mounted.
• logs tool fixed for missing workflow_name filter — Previously caused a context deadline exceeded error; now handled gracefully.
• safe.directory trust bridged via GIT_CONFIG_* env vars — Fixes git operations in safe-outputs on restrictive runners.
• partial_execution + terminal safe-output treated as success — Prevents false failure signals when an agent completes its final safe-output action after a partial execution state.
• Stable cron schedule in make recompile — Pins --schedule-seed to eliminate drift in auto-upgrade lock files across recompiles.
• #nosec justification separators normalized — - and — variants are now normalised to -- for consistent security annotation parsing.
• close_issue and assign_to_agent payloads — Issue-intent metadata is now correctly nested in the payload structure.
• update_issue MCP body length regression coverage — Added tests to guard against silent truncation above 10 KB.

⚡ Performance

• parseEngineDefinitionFromJSON cached — Eliminates a per-compile JSON→YAML round-trip, reducing compilation overhead for workflows with engine definitions.
• Reduced ambient context token usage — 4 workflows updated to use narrower context windows, lowering AI-credit burn.
• Scheduled workflow staggering — Midnight batch workflows staggered to reduce peak AI-credit consumption.

🔒 Security

• SHA-256 checksum pinned for sentrux binary install — Resolves RGS-018 supply-chain finding.
• no-exec-interpolated-command ESLint rule — Flags shell commands constructed from interpolated strings.
• no-github-request-interpolated-route extended — Now recognises global.getOctokit() aliases.
• Cross-repo regex tightened (SEC-005) — Eliminates false positive on frontmatter_hash_pure.cjs.

🔧 New Linters

• timenowsub — Flags time.Now().Sub(t) patterns that should be time.Since(t).
• trimleftright — Detects distinct-character prefix/suffix bugs from strings.TrimLeft/TrimRight misuse.
• appendoneelement — Catches single-element append patterns that could use assignment.
• no-core-error-then-process-exit (ESLint) — Prevents error-then-exit anti-patterns in GitHub Scripts.

... (truncated)

• 8b820ae fix: propagate tools.startup-timeout to gateway.startupTimeout (prevents safe...
• bd3f5d9 fix: mode-specific intent guidance for all intent-aware safe-output mutations...
• cdd7b86 [WIP] Fix failing GitHub Actions job for CLI completion (#46859)
• deea8a4 Recognize global.getOctokit() aliases in `no-github-request-interpolated-ro...
• 0d16d68 feat: mode-specific intent guidance for all safe-output mutation tools (#46861)
• f1220ce chore: remove dead functions — 1 function removed (#46860)
• 3ceb8ec feat(init): make --codespaces optional-value; grant discussions/issues write ...
• 9dc71fb fix: nest issue-intent metadata correctly in close_issue and assign_to_agent ...
• e03203a [eslint-factory] core-method-resolve: recognize function-parameter core bin...
• f9ecca5 Replace in-doc workshop experience with external workshop repository link (#4...
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)