Upgrade all AWs to v0.85.4; add Team:Experience/Ingest labels to triage - #275
Merged
Conversation
…ue AWs The conclusion job in each issue triage/size workflow uses actions/cache/save to persist daily AIC usage data. Without actions:write the cache save step silently fails with "cache write denied: token has no writable scopes". The Team:Experience and Team:Ingest labels were referenced in docs-content's and docs-content-internal's additional-instructions but were missing from the safe-outputs allowed list, so the triage agent could never apply them. Both the .md source files and the compiled .lock.yml files are updated so the fix takes effect immediately without waiting for the next gh aw compile cycle. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Runs `gh aw upgrade` from v0.83.4 to v0.85.4 across all 14 compiled workflows. Key changes in this version range relevant to us: - v0.84.3: fix: use distinct XML marker for threat detection engine errors vs real threats — fixes the false-positive prompt-injection detection that was blocking label application on issue triage runs (gh-aw#49527) - v0.85.4: security hardening — expanded secret masking, MCP server secret protection, Zizmor CI gating, fixed add_labels silently applying no labels, retained jobs.*.permissions for built-in conclusion jobs - Firewall updated from v0.27.42 → v0.27.44, gh-aw-actions/setup from v0.83.4 → v0.85.4, actions/cache from v5 → v6.1.0, actions/checkout from v6 → v7.0.1, and other action pins Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
theletterf
changed the title
2 tasks
- Update version pin from v0.83.4 → v0.85.4 in scripts/run-gh-aw-compile.sh
and .github/workflows/pre-commit.yml so the pre-commit compile hook
regenerates lock files with the same version used to upgrade them
- Add persist-credentials: false to copilot-setup-steps.yml checkout step
to satisfy zizmor credential-persistence audit
- Add missing EOF newlines to gh-aw-issue-{triage,auto-triage,size}.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file is generated by maintenance_workflow.go, not by gh aw compile, so it was not updated by the earlier gh aw upgrade run. Update it now to match the v0.85.4 SHAs used by all other workflows. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
theletterf
enabled auto-merge (squash)
August 10, 2026 13:12
theletterf
added a commit
to elastic/docs-content
that referenced
this pull request
Aug 10, 2026
## Summary Changes `actions: read` → `actions: write` in `docs-triage.yml` and `docs-size.yml`. ## Why The `conclusion` job in the reusable workflows (`gh-aw-issue-triage`, `gh-aw-issue-size`) calls `actions/cache/save` to persist daily AIC usage data. A calling workflow can only grant permissions it holds — currently `actions: read` — so the cache save fails with: ``` cache write denied: token has no writable scopes ``` The reusable workflows in docs-actions are updated to request `actions: write` in elastic/docs-actions#275. ## Test plan - [ ] Trigger `/triage` on a test issue — confirm no cache-write error in the conclusion log. - [ ] Trigger `/size` on a test issue — same check. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
reakaleek
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gh aw upgrade.Team:ExperienceandTeam:Ingestto theadd-labelsallowed list in the two triage workflows (they were in the docs-content team mapping but missing from the safe-outputs allowlist).Changelog highlights (v0.83.4 → v0.85.4)
🐛 v0.84.3 — fixes the prompt-injection false positive
<system>block detection that was blocking label application on every triage run. Reported upstream in github/gh-aw#51782.🔒 v0.85.4 — security hardening
authHeadervalues, API-derived OTLP tokens.add_labelssilently applying no labels.jobs.*.permissionsfor built-in safe-outputs and conclusion jobs.Label fix
Team:ExperienceandTeam:Ingestare real labels in docs-content and docs-content-internal, and are referenced in theiradditional-instructionsteam mappings. They were missing from the safe-outputsadd-labels.allowedlist, so the triage agent could classify issues correctly but never apply the right team label.Team:SKIis kept — docs-content-internal uses it.Test plan
/triageon a Kibana/Discover-related issue in docs-content — verifyTeam:Experienceis applied and no false-positive detection fires./triageon a Fleet/Beats-related issue — verifyTeam:Ingestis applied./size— verify conclusion job completes cleanly.🤖 Generated with Claude Code