security: remove third-party fastmcp.app fetch from runtime-setup fragment

.gitattributes

@@ -1 +1 @@
-.github/workflows/*.lock.yml linguist-generated=true merge=ours
+.github/workflows/*.lock.yml linguist-generated=true

.github/aw/actions-lock.json

@@ -40,15 +40,15 @@
       "version": "v5",
       "sha": "e58605a9b6da7c637471fab8847a5e5a6b8df081"
     },
-    "github/gh-aw-actions/setup-cli@v0.83.4": {
+    "github/gh-aw-actions/setup-cli@v0.87.4": {
       "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.83.4",
-      "sha": "e89c65e17eb281bbd5ff2ff9e9199a03e96654c7"
+      "version": "v0.87.4",
+      "sha": "ea4b911d44a5336c74325a122a5fd9110b45ff06"
     },
-    "github/gh-aw/actions/setup@v0.83.4": {
+    "github/gh-aw/actions/setup@v0.87.4": {
       "repo": "github/gh-aw/actions/setup",
-      "version": "v0.83.4",
-      "sha": "bbb8042878459948333b15b66f27113f4b5c1b9a"
+      "version": "v0.87.4",
+      "sha": "83d6315352f7db8882090ff2026087842f4256b9"
     }
   }
 }

.github/workflows/agent-deep-dive.md

@@ -16,7 +16,7 @@ engine:
 on:
   stale-check: false
   schedule:
-    - cron: "daily around 14:00 on weekdays"
+    - cron: "49 14 * * 1-5"
   workflow_dispatch:
     inputs:
       target-workflow:

.github/workflows/agent-efficiency.md

@@ -16,7 +16,7 @@ engine:
 on:
   stale-check: false
   schedule:
-    - cron: "daily around 16:00 on weekdays"
+    - cron: "19 15 * * 1-5"
   workflow_dispatch:
   roles: [admin, maintainer, write]
   bots:

.github/workflows/gh-aw-fragments/runtime-setup.md

@@ -63,28 +63,13 @@ steps:
 
   - name: Fetch repository conventions
     shell: bash
-    env:
-      GITHUB_REPOSITORY: ${{ github.repository }}
     run: |
       set -euo pipefail
       if [ -f "AGENTS.md" ]; then
         cp AGENTS.md /tmp/agents.md
         echo "Repository conventions copied from AGENTS.md to /tmp/agents.md"
       else
-        OWNER="${GITHUB_REPOSITORY%/*}"
-        REPO="${GITHUB_REPOSITORY#*/}"
-        summary=$(curl -sf --max-time 15 -X POST https://agents-md-generator.fastmcp.app/mcp \
-          -H "Content-Type: application/json" \
-          -H "Accept: application/json, text/event-stream" \
-          -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"generate_agents_md\",\"arguments\":{\"owner\":\"${OWNER}\",\"repo\":\"${REPO}\"}}}" \
-          | sed 's/^data: //' \
-          | jq -r '.result.structuredContent.summary // empty' 2>/dev/null) || true
-        if [ -n "$summary" ]; then
-          echo "$summary" > /tmp/agents.md
-          echo "Repository conventions written to /tmp/agents.md"
-        else
-          echo "::warning::Could not fetch repository conventions; continuing without them"
-        fi
+        echo "No AGENTS.md found; continuing without repository conventions"
       fi
 ---
 

.github/workflows/gh-aw-pr-review-addresser.md

@@ -54,13 +54,14 @@ on:
         type: string
         required: false
         default: "10"
-      EXTRA_COMMIT_GITHUB_TOKEN:
-        required: false
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean
         required: false
         default: true
+    secrets:
+      EXTRA_COMMIT_GITHUB_TOKEN:
+        required: false
   roles: [admin, maintainer, write]
   bots:
     - "${{ inputs.allowed-bot-users }}"

.github/workflows/gh-aw-small-problem-fixer.md

@@ -48,13 +48,14 @@ on:
         type: boolean
         required: false
         default: true
-      EXTRA_COMMIT_GITHUB_TOKEN:
-        required: false
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean
         required: false
         default: true
+    secrets:
+      EXTRA_COMMIT_GITHUB_TOKEN:
+        required: false
   roles: [admin, maintainer, write]
   bots:
     - "${{ inputs.allowed-bot-users }}"

.github/workflows/smoke-test-install.yml

@@ -13,7 +13,7 @@ jobs:
     name: Install and compile all workflows
     runs-on: ubuntu-latest
     env:
-      GH_AW_VERSION: "v0.48.1"
+      GH_AW_VERSION: "v0.87.4"
     steps:
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/trigger-pr-actions-detective.yml

@@ -10,7 +10,7 @@ permissions:
   actions: read
   contents: read
   copilot-requests: write
-  issues: read
+  issues: write
   pull-requests: write
 
 jobs:

.github/workflows/trigger-pr-review.yml

@@ -9,7 +9,7 @@ permissions:
   actions: read
   contents: read
   copilot-requests: write
-  issues: read  # needed for no-op run tracking issue
+  issues: write  # needed for failure tracking and no-op run tracking
   pull-requests: write
 
 jobs:

.github/workflows/trigger-update-pr-body.yml

@@ -9,7 +9,7 @@ permissions:
   actions: read
   contents: read
   copilot-requests: write
-  issues: read
+  issues: write
   pull-requests: write
 
 jobs:

.github/workflows/upgrade-check.md

@@ -19,7 +19,7 @@ engine:
 on:
   stale-check: false
   schedule:
-    - cron: "daily around 14:00 on weekdays"
+    - cron: "20 13 * * 1-5"
   workflow_dispatch:
     inputs:
       title-prefix: