Update gh-aw to latest available version #1257

Activity

1. github-actions commented on Jun 11, 2026

   

   github-actionsBot

   on Jun 11, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue looks like a duplicate of #1249 and may be safe to close.

   Possible duplicates:

   • [gh-aw-upgrade] gh-aw upgrade available: v0.68.3 -> v0.79.3 #1249 — it requests the same upgrade to the newest gh-aw release, with the same required compile/compatibility validation scope.

   2 related issues

   • [gh-aw-upgrade] gh-aw upgrade available: v0.68.3 → v0.77.5 #1230 — it contains prior upgrade analysis and validation expectations for the same dependency, which provides historical context for how these upgrades were evaluated.
   • [gh-aw-upgrade] gh-aw upgrade available: v0.68.3 → v0.76.1 #1184 — it documents an earlier upgrade pass with concrete compatibility considerations that may still be useful as background.

   Note

   🔒 Integrity filter blocked 7 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • #92 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #15 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #46 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #441 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #115 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #232 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #206 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   ---

   What is this? | From workflow: Trigger Duplicate Issue Detector

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
2. v1v

   closed this as completedon Jun 11, 2026
3. github-actions commented on Jun 11, 2026

   

   github-actionsBot

   on Jun 11, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: Upgrading directly to gh-aw v0.79.4 is feasible, but it will fail to compile until three schema-breaking changes are addressed (sandbox.agent gating in two no-sandbox workflows, and network.firewall removal in one workflow).

   Recommendation

   Proceed with a new upgrade PR from main (do not build on stale #1180), bump GH_AW_VERSION, GH_AW_BUILD_VERSION, and GH_AW_COMPAT_VERSION to v0.79.4, then make the 3 required workflow-source fixes before recompiling.

   Findings

   1. Current gh-aw pin is still old:

      • Makefile:4-6 → all three vars are v0.68.3.

   2. Latest upstream release is v0.79.4 (published 2026-06-10):

      • https://github.com/github/gh-aw/releases/tag/v0.79.4
      • Breaking changes include:
        • sandbox.agent: false now requires features.dangerously-disable-sandbox-agent as a literal 20+ char justification string.
        • user-invokable and disable-model-invocation removed from schema.

   3. Concrete compatibility blockers in this repo:

      • .github/workflows/gh-aw-mention-in-issue-no-sandbox.md:75 (sandbox.agent: false)
      • .github/workflows/gh-aw-mention-in-pr-no-sandbox.md:87 (sandbox.agent: false)
      • .github/workflows/gh-aw-internal-gemini-cli-web-search.md:75 (network.firewall: false)

   4. Removed fields check:

      • No matches for user-invokable|disable-model-invocation in .github/workflows/*.md.

   5. Related history:

      • #1249 already flags the no-sandbox compile gate (v0.79.3).
      • #1180 (Update gh-aw to v0.76.1) is open but stale/blocked and targets an older release.

   Verification

   I ran targeted compile/lint checks in the workspace.

   $ GOTOOLCHAIN=auto go run github.com/github/gh-aw/cmd/gh-aw@v0.79.4 compile --action-mode release --action-tag v0.79.4 \
     .github/workflows/gh-aw-mention-in-issue-no-sandbox.md \
     .github/workflows/gh-aw-mention-in-pr-no-sandbox.md \
     .github/workflows/gh-aw-internal-gemini-cli.md
   ...
   error: Validation failed for field 'sandbox.agent' ... dangerously-disable-sandbox-agent feature is missing

   $ GOTOOLCHAIN=auto go run github.com/github/gh-aw/cmd/gh-aw@v0.79.4 compile --action-mode release --action-tag v0.79.4 \
     .github/workflows/gh-aw-internal-gemini-cli-web-search.md
   ...
   error: .github/workflows/gh-aw-internal-gemini-cli-web-search.md:75:3: Unknown property: firewall
   Valid fields are: allowed, allowed-input, blocked

   $ make lint
   ... (passes)

   Detailed Action Plan

   1. Update tool version pins in Makefile:

      • GH_AW_VERSION (Makefile:4)
      • GH_AW_BUILD_VERSION (Makefile:5)
      • GH_AW_COMPAT_VERSION (Makefile:6)
      • Set all to v0.79.4.

   2. Fix no-sandbox workflow frontmatter:

      • .github/workflows/gh-aw-mention-in-issue-no-sandbox.md
      • .github/workflows/gh-aw-mention-in-pr-no-sandbox.md
      • Add:

        features:
          dangerously-disable-sandbox-agent: "<operator-authored justification string >=20 chars>"
        sandbox:
          agent: false

   3. Fix network schema in:

      • .github/workflows/gh-aw-internal-gemini-cli-web-search.md:75
      • Replace deprecated network.firewall: false with current network schema (allowed / allowed-input / blocked) according to intended behavior.

   4. Recompile from source templates:

      • make compile

   5. Validate generated outputs and repo checks:

      • make lint
      • Optionally targeted sanity check on affected lock workflows.

   6. Open PR referencing both #1257 and #1249, and explicitly note that #1180 is superseded.

   Related Items

   Type	Link	Relevance
   Issue	#1257	Current triage target
   Issue	#1249	Prior automated upgrade analysis; same compatibility theme
   Issue	#1230	Earlier upgrade alert (older target)
   PR	#1180	Older/stale upgrade attempt (v0.76.1)
   Release notes	https://github.com/github/gh-aw/releases/tag/v0.79.4	Latest release + breaking changes
   File	Makefile:4-6	Current version pins
   File	.github/workflows/gh-aw-mention-in-issue-no-sandbox.md:75	sandbox.agent: false requires feature justification now
   File	.github/workflows/gh-aw-mention-in-pr-no-sandbox.md:87	Same sandbox gating issue
   File	.github/workflows/gh-aw-internal-gemini-cli-web-search.md:75	network.firewall no longer valid schema

   Note

   🔒 Integrity filter blocked 6 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • #937 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #599 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #697 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #705 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #504 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • #537 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   ---

   What is this? | From workflow: Trigger Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.