Blog

Weekly Update – April 13, 2026

Apr 13, 2026

Copilot

It was a busy week in github/gh-aw — five releases shipped between April 6 and April 10, addressing everything from a critical Copilot CLI reliability crisis to shiny new workflow composition features. Here’s the full rundown.

Release Highlights

v0.68.1 — April 10

The headline of this patch is a critical Copilot CLI reliability hotfix. Workflows using the Copilot engine were hanging indefinitely or producing zero-byte output due to an incompatibility introduced in v1.0.22 of the Copilot CLI. v0.68.1 pins the CLI back to v1.0.21 — the last confirmed-working version — and gets everyone’s workflows running again (#25689).

Beyond the hotfix, this release also ships:

• engine.bare frontmatter field (#25661): Set bare: true to suppress automatic context loading — AGENTS.md and user instructions for Copilot, CLAUDE.md memory files for Claude. Great when you want the AI to start from a clean slate.
• Improved stale lock file diagnostics (#25571): When the activation job detects a stale hash, it now emits step-by-step [hash-debug] log lines and opens an actionable issue guiding you to fix it.
• actions/github-script upgraded to v9 (#25553): Scripts now get getOctokit as a built-in context parameter, removing the need for manual @actions/github imports in safe-output handlers.
• Squash-merge fallback in gh aw add (#25609): If a repo disallows merge commits, the setup PR now automatically falls back to squash merge instead of failing.
• Security: agent-stdio.log permissions hardened — Log files are now pre-created with 0600 permissions before tee writes, preventing world-readable exposure of MCP gateway bearer tokens.

v0.68.0 — April 10

This release brings distributed tracing improvements and a cleaner comment API:

• OpenTelemetry cross-job trace hierarchy (#25540): Parent span IDs now propagate through aw_context across jobs, giving you end-to-end distributed trace visibility for multi-job workflows in backends like Tempo, Honeycomb, and Datadog.
• Simplified discussion comment API (#25532): The deprecated add-comment.discussion boolean has been removed in favor of the clearer discussions: true/false syntax. Run gh aw fix --write to migrate existing workflows.
• Security: heredoc content validation (#25510): ValidateHeredocContent checks now cover five user-controlled heredoc insertion sites, closing a class of potential injection vectors.

v0.67.4 — April 9

This one led with five new agentic workflow templates: approach-validator, test-quality-sentinel, refactoring-cadence, architecture-guardian, and design-decision-gate. These expand the built-in library for code quality, ADR enforcement, and architectural governance. The release also included Copilot driver retry logic and a --runner-guard compilation flag.

v0.67.3 — April 8

The star of this release is the new pre-steps frontmatter field — inject steps that run before checkout and the agent inside the same job. This is the recommended pattern for token-minting actions (e.g., actions/create-github-app-token, octo-sts) that need to check out external repos. Because the minted token stays in the same job, it never gets masked when crossing a job boundary. Also shipped: ${{ github.aw.import-inputs.* }} expression support in the imports: section, and assignees support on create-pull-request fallback issues.

v0.67.2 — April 6

Reliability-focused: cross-repo workflow hash checks, checkout tokens no longer silently dropped on newer runners, curl/wget flag-bearing invocations now allowed in network.allowed workflows, and a timeout-minutes schema cap at 360.

Notable Merged Pull Requests

Beyond the releases, the past week also delivered:

• #25923: Image artifacts can now be uploaded without zip archiving using skip-archive: true, and the resulting artifact URLs are surfaced as outputs — enabling workflows to embed images directly in Markdown comments.
• #25908: A new scheduled cleanup-cache-memory job was added to the agentics maintenance workflow to prune outdated cache-memory entries automatically (and can be triggered on demand).
• #25914 + #25972: OTel exception span events now emit exception.type alongside exception.message and individual error attributes are queryable — no more digging through pipe-delimited strings in Grafana.
• #25960: Fixed a sneaky bug where push_repo_memory would run on every bot-triggered no-op because always() bypassed skip propagation.
• #25971: Raw subprocess output from gh aw compile --validate is now sanitized before being embedded into issue bodies, closing a Markdown injection vector.

Agent of the Week: auto-triage-issues

The quiet backbone of issue hygiene — reads every new issue and applies the right labels so the right people see it.

This week auto-triage-issues proved it’s doing its job almost too well. In the scheduled run on April 13, it scanned all open issues and found exactly zero unlabeled issues — reporting a 100% label coverage rate with zero action required. It had already handled the labeling in near-real-time as issues arrived, including one run on April 12 where it correctly tagged a freshly opened issue with enhancement, mcp, compiler, and security in a single pass. Four labels, zero hesitation.

That “security” label is doing a lot of work — the workflow spotted MCP and compiler concerns that genuinely deserved the tag, not just keyword-matched on it. We’ll take it.

Usage tip: Pair auto-triage-issues with label-based notification rules so your team gets automatically paged for security or critical issues without anyone having to babysit the issue tracker.

→ View the workflow on GitHub

Try It Out

Update to v0.68.1 today to get the Copilot CLI hotfix and the new engine.bare control. As always, contributions and feedback are welcome in github/gh-aw.

Weekly Update – April 6, 2026

Apr 6, 2026

Copilot

Ten releases landed in github/gh-aw between March 31 and April 6 — a relentless pace that delivered production-ready distributed tracing, new safe output signals, and a sweeping security cleanup. Here’s what shipped.

Release Highlights

v0.67.1 — OpenTelemetry Overhaul & Security Hardening (April 6)

The headline release of the week polishes the OTLP tracing story introduced in v0.67.0 and adds a wave of security fixes.

• Accurate span names and real job durations (#24823): Job lifecycle spans now use the actual job name (e.g. gh-aw.agent.conclusion) and record real execution time — previously spans always reported 2–5 ms due to a missing startMs.
• OTLP payload sanitization: Sensitive values (token, secret, key, auth, etc.) in span attributes are automatically redacted before sending to any OTLP collector.
• OTLP headers masking (#24805): OTEL_EXPORTER_OTLP_HEADERS is masked with ::add-mask:: in every job, preventing auth tokens from leaking into GitHub Actions debug logs.
• MCP Gateway OpenTelemetry (#24697): The MCP Gateway now receives OpenTelemetry config derived from observability.otlp frontmatter and the actions/setup trace IDs, correlating all MCP tool-call traces under the workflow root trace.
• report_incomplete safe output (#24796): A new first-class signal lets agents surface infrastructure or tool failures without being misclassified as successful runs. When an agent emits report_incomplete, the safe-outputs handler activates failure handling regardless of agent exit code.
• checks as a first-class MCP tool (#24818): The checks tool is now registered in the gh-aw MCP server, returning a normalized CI verdict (success, failed, pending, no_checks, policy_blocked).
• Token/secret injection prevention: 422 instances of ${{ secrets.* }} interpolated directly into run: blocks were moved to env: mappings across lock files.
• Claude Code 1.0.0 compatibility (#24807): Removed the --disable-slash-commands flag that was dropped in Claude Code 1.0.0.

v0.67.0 — OTLP Trace Export & GitHub API Rate Limit Analytics (April 5)

The milestone release that first shipped distributed tracing support:

• observability.otlp frontmatter: Workflows can now export structured OpenTelemetry spans to any OTLP-compatible backend (Honeycomb, Grafana Tempo, Sentry) with a single frontmatter block. Every job emits setup and conclusion spans; cross-job trace correlation is wired automatically with a single trace ID from the activation job.
• GitHub API rate limit analytics: gh aw audit, gh aw logs, and gh aw audit diff now show GitHub API quota consumed per run, per resource.
• Environment Variable Reference: A new comprehensive reference section covers all CLI configuration variables.

v0.66.1 — Richer gh aw logs & Breaking Change (April 4)

! Breaking change: gh aw audit report has been removed. Cross-run security reports are now generated directly by gh aw logs --format. The new --last flag aliases --count to ease migration.

• Flat run classification in gh aw logs --json: Each run now carries a top-level classification string ("risky", "normal", "baseline", or "unclassified"), eliminating null-guard gymnastics.
• Per-tool-call metrics in logs: Granular token usage, failure counts, and latency per tool — perfect for identifying which tools consume the most resources.

v0.66.0 — Token Usage Artifacts & Threat Detection Extensibility (April 3)

• Token Usage Artifact (#24315): Agent token usage is now uploaded as a workflow artifact, making it easy to track spend over time.
• Workflow reliability and threat detection extensibility improvements shipped alongside.

Earlier in the week

v0.65.7 through v0.65.2 (March 31–April 3) focused on cross-repo workflow reliability, MCP gateway keepalive configuration, safe-outputs improvements, and token optimization tooling.

---

Agent of the Week: agentic-observability-kit

The tireless watchdog that monitors your entire fleet of agentic workflows and escalates when things go sideways.

Every day, agentic-observability-kit pulls logs from all running workflows, classifies their behavior, and posts a structured observability report as a GitHub Discussion — then files issues when patterns of waste or failure cross defined thresholds. This past week it had a particularly eventful run: on April 6 it spotted that smoke-copilot and smoke-claude had each burned through 675K–1.7M tokens across multiple runs (flagged as resource_heavy_for_domain with high severity), and it filed an issue titled “Smoke Copilot and Smoke Claude repeatedly resource-heavy” before anyone on the team had noticed. It also caught that the GitHub Remote MCP Authentication Test workflow had a 100% failure rate across two runs — one of which completed at zero tokens, suggesting a config or auth problem rather than an agent misbehaving.

In a delightfully meta moment, the observability kit itself hit token-limit errors while trying to ingest its own log data — it made four attempts with progressively smaller count and max_tokens parameters before it could fit the output into context. It got there in the end.

Usage tip: Pair agentic-observability-kit with Slack or email notifications so escalation issues trigger an alert — otherwise the issues it files can sit unread while the token bill quietly grows.

→ View the workflow on GitHub

---

Try It Out

Update to v0.67.1 and start exporting traces from your workflows today — all it takes is an observability.otlp block in your frontmatter. Feedback and contributions are always welcome in github/gh-aw.

Weekly Update – March 30, 2026

Mar 30, 2026

Copilot

Six releases shipped in github/gh-aw between March 24 and March 30 — that’s almost one a day. From expanded audit tooling to integrity-isolated cache storage and a wave of security fixes, this was a dense week. Here’s the rundown.

Releases This Week

v0.64.4 — March 30

The freshest release ships with quality-of-life wins for workflow authors:

• runs-on-slim for compile-stable jobs (#23490): Override the runner for compile-stable framework jobs with a new runs-on-slim key, giving you fine-grained control over which machine handles compilation.
• Sibling nested imports fixed (#23475): ./file.md imports now resolve relative to the importing file’s directory, not the working directory. Modular workflows that import sibling files were silently broken before — now they’re not.
• Custom tools in <safe-output-tools> prompt (#23487): Custom jobs, scripts, and actions are now listed in the agent’s <safe-output-tools> prompt block so the AI actually knows they exist.
• Compile-time validation of safe-output job ordering (#23486): Misconfigured needs: ordering on custom safe-output jobs is now caught at compile time.
• MCP Gateway v0.2.9 (#23513) and firewall v0.25.4 (#23514) bumped for all compiled workflows.

v0.64.3 — March 29

A security-heavy release with one major architectural upgrade:

Integrity-aware cache-memory is the headline. Cache storage now uses dedicated git branches — merged, approved, unapproved, and none — to enforce integrity isolation at the storage level. A run operating at unapproved integrity can no longer read data written by a merged-integrity run, and any change to your allow-only guard policy automatically invalidates stale cache entries. If you upgrade and see a cache miss on your first run, that’s intentional — legacy data has no integrity provenance and must be regenerated.

patch-format: bundle (#23338) is the other highlight: code-push flows now support git bundle as an alternative to git am, preserving merge commits, authorship, and per-commit messages that were previously dropped.

Security fixes:

• Secret env var exclusion (#23360): AWF now strips all secret-bearing env vars (tokens, API keys, MCP secrets) from the agent container’s visible environment, closing a potential prompt-injection exfiltration path in pull_request_target workflows.
• Argument injection fix (#23374): Package and image names in gh aw compile --validate-packages are validated before being passed to npm view, pip index versions, uv pip show, and docker.

v0.64.2 — March 26

The gh aw logs command gained cross-run report generation via the new --format flag:

gh aw logs --format aggregates firewall behavior across multiple workflow runs and produces an executive summary, domain inventory, and per-run breakdown:

gh aw logs agent-task --format markdown --count 10    # Markdown
gh aw logs --format markdown --json                   # JSON for dashboards
gh aw logs --format pretty                            # Console output

This release also includes a YAML env injection security fix (#23055): all env: emission sites in the compiler now use %q-escaped YAML scalars, preventing newlines or quote characters in frontmatter values from injecting sibling env variables into .lock.yml files.

v0.64.1 — March 26

gh aw audit diff (#22996) lets you compare two workflow runs side-by-side — firewall behavior, MCP tool invocations, token usage, and duration — to spot regressions and behavioral drift before they become incidents:

gh aw audit diff <run1> <run2> --format markdown

Five new sections also landed in the standard gh aw audit report: Engine Configuration, Prompt Analysis, Session & Agent Performance, Safe Output Summary, and MCP Server Health. One report now gives you the full picture.

v0.64.0 — March 25

Bot-actor concurrency isolation: Workflows combining safe-outputs.github-app with issue_comment-capable triggers now automatically get bot-isolated concurrency keys, preventing the workflow from cancelling itself mid-run when the bot posts a comment that re-triggers the same workflow.

v0.63.1 — March 24

A focused patch adding the skip-if-check-failing pre-activation gate — workflows can now bail out before the agent runs if a named CI check is currently failing, avoiding wasted inference on a broken codebase. Also ships an improved fuzzy schedule algorithm with weighted preferred windows and peak avoidance to reduce queue contention on shared runners.

---

Agent of the Week: auto-triage-issues

The self-appointed gatekeeper of the issue tracker — reads every new issue and assigns labels so the right people see it.

This week, auto-triage-issues handled three runs. Two of them were textbook efficiency: triggered the moment a new issue landed, ran the pre-activation check, decided there was nothing worth labeling, and wrapped up in under 42 seconds flat. No fuss, no drama. Then came the Monday scheduled sweep. That run went a different direction: 18 turns, 817,000 tokens, and after all that contemplation… a failure. Somewhere between turn one and turn eighteen, the triage workflow decided this batch of issues deserved its most thoughtful analysis yet, burned through a frontier model’s patience, and still couldn’t quite close the loop.

It’s the classic overachiever problem — sometimes the issues that look the simplest turn out to be the ones that take all day.

Usage tip: If your auto-triage-issues scheduled runs are consistently expensive, the new agentic_fraction metric in gh aw audit can help you identify which turns are pure data-gathering and could be moved to deterministic shell steps.

→ View the workflow on GitHub

---

Try It Out

Update to v0.64.4 today with gh extension upgrade aw. The integrity-aware cache-memory migration will trigger a one-time cache miss on first run — expected and safe. As always, questions and contributions are welcome in github/gh-aw.

Weekly Update – March 23, 2026

Mar 23, 2026

Copilot

Another week, another flurry of releases in github/gh-aw. Eight versions shipped between March 18 and March 21, pushing security hardening, extensibility, and performance improvements across the board. Here’s what you need to know.

Releases This Week

v0.62.5 — March 21

The latest release leads with two important security fixes:

• Supply chain protection: The Trivy vulnerability scanner action was removed after a supply chain compromise was discovered (#22007, #22065). Scanning has been replaced with a safer alternative.
• Public repo integrity hardening (#21969): GitHub App authentication no longer exempts public repositories from the minimum-integrity guard policy, closing a gap where untrusted content could bypass integrity checks.

On the feature side:

• Timezone support for on.schedule (#22018): Cron entries now accept an optional timezone field — finally, no more mental UTC arithmetic when you want your workflow to run “at 9 AM Pacific”.
• Boolean expression optimizer (#22025): Condition trees are optimized at compile time, generating cleaner if: expressions in compiled workflows.
• Wildcard target-repo in safe-output handlers (#21877): Use target-repo: "*" to write a single handler definition that works across any repository.

v0.62.3 — March 20

This one is a standout for extensibility and speed:

• Custom Actions as Safe Output Tools (#21752): You can now expose any GitHub Action as an MCP tool via the new safe-outputs.actions block. The compiler resolves action.yml at compile time to derive the tool schema and inject it into the agent — no custom wiring needed. This opens the door to a whole ecosystem of reusable safe-output handlers built from standard Actions.
• ~20 seconds faster per workflow run (#21873): A bump to DefaultFirewallVersion v0.24.5 eliminates a 10-second shutdown delay for both the agent container and the threat detection container. That’s 20 free seconds on every single run.
• trustedBots support in MCP Gateway (#21865): Pass an allowlist of additional GitHub bot identities to the MCP Gateway, enabling safe cross-bot collaboration in guarded environments.
• gh-aw-metadata v3 (#21899): Lock files now embed the configured agent ID/model in the gh-aw-metadata comment, making audits much easier.

v0.62.2 — March 19

! Breaking change alert: lockdown: true is gone. It has been replaced by the more expressive min-integrity field. If you have lockdown: false in your frontmatter, remove it — it’s no longer recognized. The new integrity-level system gives you finer control over what content can trigger your workflows.

This release also introduces integrity filtering for log analysis — the gh aw logs command can now filter to only runs where DIFC integrity events were triggered, making security investigations much faster.

v0.62.0 — March 19

The GitHub MCP guard policy graduates to general availability. The policy automatically configures appropriate access controls on the GitHub MCP server at runtime — no manual lockdown configuration required. Also new: inline custom safe-output scripts, letting you define JavaScript handlers directly in your workflow frontmatter without a separate file.

v0.61.x — March 18

Three patch releases covered:

• Signed-commit support for protected branches (v0.61.1)
• Broader ecosystem domain coverage for language package registries (v0.61.2)
• Critical workflow_dispatch expression evaluation fix (v0.61.2)

Notable Pull Requests

Several important fixes landed today (March 23):

• Propagate assign_copilot failures to agent failure comment (#22371): When assign_copilot_to_created_issues fails (e.g., bad credentials), the failure context is now surfaced in the agent failure issue so you can actually diagnose it.
• Post failure comment when agent assignment fails (#22347): A follow-up to the above — the failure now also posts a comment directly on the target issue or PR for immediate visibility.
• Hot-path regexp and YAML parse elimination (#22359): Redundant regexp compilations and YAML re-parses on the hot path have been eliminated, improving throughput for high-volume workflow execution.
• blocked-users and approval-labels in guard policy (#22360): The tools.github guard policy now supports blocked-users and approval-labels fields, giving you more granular control over who can trigger guarded workflows.
• Pull merged workflow files after GitHub confirms readiness (#22335): A race condition where merged workflow files were pulled before GitHub reported the workflow as ready has been fixed.

Agent of the Week: contribution-check

Your tireless four-hourly guardian of PR quality — reads every open pull request and evaluates it against CONTRIBUTING.md for compliance and completeness.

contribution-check ran five times this week (once every four hours, as scheduled) and processed a steady stream of incoming PRs, creating issues for contributors who needed guidance, adding labels, and leaving review comments. Four of five runs completed in under 5 minutes with 6–9 turns. The fifth run, however, apparently found the task of reviewing PRs during a particularly active Sunday evening so intellectually stimulating that it worked through 50 turns and consumed 1.55 million tokens — roughly 5× its usual appetite — before the safe_outputs step politely called it a night. It still managed to file issues, label PRs, and post comments on the way out. Overachiever.

One earlier run also hit a minor hiccup: the pre-agent filter step forgot to write its output file, leaving the agent with nothing to evaluate. Rather than fabricating a list of PRs to review, it dutifully reported “missing data” and moved on. Sometimes the bravest thing is knowing when there’s nothing to do.

Usage tip: The contribution-check pattern works best when your CONTRIBUTING.md is explicit and opinionated — the more specific your guidelines, the more actionable its feedback will be for contributors.

→ View the workflow on GitHub

Try It Out

Update to v0.62.5 to pick up the security fixes and timezone support. If you’ve been holding off on migrating from lockdown: true, now’s the time — check the v0.62.2 release notes for the migration path. As always, contributions and feedback are welcome in github/gh-aw.

Weekly Update – March 18, 2026

Mar 18, 2026

Copilot

It’s been a busy week in github/gh-aw — seven releases shipped between March 13 and March 17, covering everything from a security model overhaul to a new label-based trigger and a long-overdue terminal resize fix. Let’s dig in.

Releases This Week

v0.61.0 — March 17

The freshest release focuses on reliability and developer experience:

• Automatic debug logging (#21406): Set ACTIONS_RUNNER_DEBUG=true on your runner and full debug logging activates automatically — no more manually adding DEBUG=* to every troubleshooting run.
• Cross-repo project item updates (#21404): update_project now accepts a target_repo parameter, so org-level project boards can update fields on items from any repository.
• GHE Cloud data residency support (#21408): Compiled workflows now auto-inject a GH_HOST step, fixing gh CLI failures on *.ghe.com instances.
• CI build artifacts (#21440): The build CI job now uploads the compiled gh-aw binary as a downloadable artifact — handy for testing PRs without a local build.

v0.60.0 — March 17

This release rewires the security model. Breaking change: automatic lockdown=true is gone. Instead, the runtime now auto-configures guard policies on the GitHub MCP server — min_integrity=approved for public repos, min_integrity=none for private/internal. Remove any explicit lockdown: false from your frontmatter; it’s no longer needed.

Other highlights:

• GHES domain auto-allowlisting (#21301): When engine.api-target points to a GHES instance, the compiler automatically adds GHES API hostnames to the firewall. No more silent blocks after every recompile.
• github-app: auth in APM dependencies (#21286): APM dependencies: can now use github-app: auth for cross-org private package access.

v0.59.0 — March 16

A feature-packed release with two breaking changes (field renames in safe-outputs.allowed-domains) and several new capabilities:

• Label Command Trigger (#21118): Activate a workflow by adding a label to an issue, PR, or discussion. The label is automatically removed so it can be reapplied to re-trigger.
• gh aw domains command (#21086): Inspect the effective network domain configuration for all your workflows, with per-domain ecosystem annotations.
• Pre-activation step injection — New on.steps and on.permissions frontmatter fields let you inject custom steps and permissions into the activation job for advanced scenarios.

Earlier in the Week

• v0.58.3 (March 15): MCP write-sink guard policy for non-GitHub MCP servers, Copilot pre-flight diagnostic for GHES, and a richer run details step summary.
• v0.58.2 (March 14): GHES auto-detection in audit and add-wizard, excluded-files support for create-pull-request, and clearer run command errors.
• v0.58.1 / v0.58.0 (March 13): call-workflow safe output for chaining workflows, checkout: false for agent jobs, custom OpenAI/Anthropic API endpoints, and 92 merged PRs in v0.58.0 alone.

Notable Pull Requests

• Top-level github-app fallback (#21510): Define your GitHub App config once at the top level and let it propagate to safe-outputs, checkout, MCP, APM, and activation — instead of repeating it in every section.
• GitHub App-only permission scopes (#21511): 31 new PermissionScope constants cover repository, org, and user-level GitHub App permissions (e.g., administration, members, environments).
• Custom Huh theme (#21557): All 11 interactive CLI forms now use a Dracula-inspired theme consistent with the rest of the CLI’s visual identity.
• Weekly blog post writer workflow (#21575): Yes, the workflow that wrote this post was itself merged this week. Meta!
• CI job timeout limits (#21601): All 25 CI jobs that relied on GitHub’s 6-hour default now have explicit timeouts, preventing a stuck test from silently burning runner compute.

Agent of the Week: auto-triage-issues

The first-ever Agent of the Week goes to the workflow that handles the unglamorous but essential job of keeping the issue tracker from becoming a swamp.

auto-triage-issues runs on a schedule and fires on every new issue, reading each one and deciding how to categorize it. This week it ran five times — three successful runs and two that were triggered by push events to a feature branch (which apparently fire the workflow but don’t give it much to work with). On its scheduled run this morning, it found zero open issues in the repository, so it created a tidy summary discussion to announce the clean state, as instructed. On an earlier issues-triggered run, it attempted to triage issue #21572 but hit empty results from GitHub MCP tools on all three read attempts — so it gracefully called missing_data and moved on rather than hallucinating a label.

Across its recent runs it made 131 search_repositories calls. We’re not sure why it finds repository searches so compelling, but clearly it’s very thorough about knowing its neighborhood before making any decisions.

Usage tip: Pair auto-triage-issues with a notify workflow on specific labels (e.g., security or needs-repro) so the right people get pinged automatically without anyone having to watch the inbox.

→ View the workflow on GitHub

Try It Out

Update to v0.61.0 to get all the improvements from this packed week. If you run workflows on GHES or in GHE Cloud, the new auto-detection and GH_HOST injection features are especially worth trying. As always, contributions and feedback are welcome in github/gh-aw.

Older posts