[product-manager-impersonator] Publish installable Workflow Upgrade Check detector

[github-actions]

Feature Idea

Summary: Add a customer-facing workflow-upgrade-check scheduled detector that reuses the existing internal upgrade-check logic to flag deprecated workflow refs and version drift in consumer repos.

Why a Customer Would Want This

Teams install workflows once and then drift behind rename/deprecation changes over time. A periodic advisory issue would give maintainers early, actionable upgrade guidance before workflows break or accumulate migration debt.

Rough Implementation Sketch

• Add a new reusable workflow source (for example .github/workflows/gh-aw-workflow-upgrade-check.md) that packages the existing upgrade-check.md logic for workflow_call consumers.
• Add gh-agent-workflows/workflow-upgrade-check/{README.md,example.yml} so users can install it like other detectors.
• Keep it report-only (create-issue/noop) with dedupe controls; no auto-edits or auto-PRs.
• Link it from upgrade and workflow catalog docs.

Why It Won't Be That Hard

Most of the product logic already exists in .github/workflows/upgrade-check.md (release comparison, impact assessment, issue reporting format). This is mainly surfacing and packaging an internal workflow into the existing published detector pattern.

Evidence

• Internal upgrade capability already exists: .github/workflows/upgrade-check.md (name/description and scheduled report behavior at lines 3-4, 49-56, 60-69).
• Repo docs explicitly classify upgrade-check as internal-only and non-installable: docs/developing.md:11, gh-agent-workflows/DEVELOPING.md:80.
• Public workflow catalog/quick setup do not offer any upgrade-check detector today: gh-agent-workflows/README.md:56-80, scripts/quick-setup.sh:120-142.
• Upgrade churn is already a real maintenance task in this repo: open issue #998 ([gh-aw-upgrade] ...).
• Nearest existing PM issue is different: #757 proposes an auto-migration assistant that opens PRs, while this proposal is a report-only detector that continuously warns about drift.

Note

🔒 Integrity filter blocked 20 items

The following items were blocked because they don't meet the GitHub integrity level.

• Issue Triage allows issue labelling #1029 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Issue Fixer can use Ephemeral Token #1025 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Issue Triage can use Ephemeral Token #1024 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #359 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #937 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #392 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #704 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #694 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #684 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #875 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #676 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #235 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #225 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #240 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #703 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 4 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Trigger Product Manager Impersonator

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.