Migrate 30 agentic workflows to the cloud-hypervisor sandbox runtime

[Copilot]

Broadens exercise of the preview cloud-hypervisor microVM runtime by switching 30 workflows to it, chosen for spread across engines, triggers, and prior runtime profiles rather than convenience.

Changes

• Set sandbox.agent.runtime: cloud-hypervisor on 30 workflows under .github/workflows/, regenerating their .lock.yml files.
• Selection mix:
  • Engines: copilot (implicit and explicit), claude, codex, and custom engine: / sandbox.agent.id: awf blocks
  • Triggers: daily/weekly schedules, workflow_dispatch, issues, pull requests, slash and label commands
  • Prior runtime: unset (implicit docker), gvisor, docker-sbx
• Workflows the compiler rejects for this runtime (notably tools.github.mode: gh-proxy, which requires the CLI proxy sidecar cloud-hypervisor does not attach) were excluded and left on their existing runtime.

Shape of the edit

sandbox:
  agent:
    id: awf
    runtime: cloud-hypervisor   # was: gvisor / docker-sbx / unset

Notes for review

Each of these workflows now runs on the privileged KVM preview path (GitHub-hosted Ubuntu x86_64, 2 vCPU / 4096 MiB), which the compiler flags as warranting explicit security sign-off. Reviewers may want to confirm the selected set is acceptable to move onto a preview runtime, and that no workflow here has latency or resource expectations incompatible with microVM startup.

Workflows updated: agentic-token-trend-audit, api-consumption-report, architecture-guardian, archivx-agentic-workflows-analyzer, audit-workflows, blog-auditor, bot-detection, cli-consistency-checker, cli-version-checker, cloclo, daily-agentrx-trace-optimizer, daily-architecture-diagram, daily-astrostylelite-markdown-spellcheck, daily-cli-tools-tester, daily-credit-limit-test, daily-experiment-report, daily-malicious-code-scan, daily-semgrep-scan, daily-squid-image-scan, duplicate-code-detector, grumpy-reviewer, issue-triage-agent, mcp-inspector, notion-issue-summary, pr-nitpick-reviewer, python-data-charts, repo-tree-map, schema-feature-coverage, super-linter, video-analyzer

[Copilot]

Pull request overview

Migrates 30 agentic workflows to the preview Cloud Hypervisor microVM runtime and regenerates their compiled definitions.

Changes:

• Selects sandbox.agent.runtime: cloud-hypervisor.
• Adds KVM preflight, verified bundle setup, and microVM execution.
• Removes obsolete gVisor/docker-sbx setup where applicable.

Show a summary per file

File	Description
agentic-token-trend-audit.md	Selects Cloud Hypervisor.
agentic-token-trend-audit.lock.yml	Regenerates runtime setup.
api-consumption-report.md	Selects Cloud Hypervisor.
api-consumption-report.lock.yml	Regenerates runtime setup.
architecture-guardian.md	Selects Cloud Hypervisor.
architecture-guardian.lock.yml	Regenerates runtime setup.
archivx-agentic-workflows-analyzer.md	Selects Cloud Hypervisor.
archivx-agentic-workflows-analyzer.lock.yml	Regenerates runtime setup.
audit-workflows.md	Selects Cloud Hypervisor.
audit-workflows.lock.yml	Regenerates runtime setup.
blog-auditor.md	Selects Cloud Hypervisor.
blog-auditor.lock.yml	Regenerates runtime setup.
bot-detection.md	Selects Cloud Hypervisor.
bot-detection.lock.yml	Regenerates runtime setup.
cli-consistency-checker.md	Selects Cloud Hypervisor.
cli-consistency-checker.lock.yml	Regenerates runtime setup.
cli-version-checker.md	Selects Cloud Hypervisor.
cli-version-checker.lock.yml	Regenerates runtime setup.
cloclo.md	Selects Cloud Hypervisor.
cloclo.lock.yml	Regenerates runtime setup.
daily-agentrx-trace-optimizer.md	Selects Cloud Hypervisor.
daily-agentrx-trace-optimizer.lock.yml	Regenerates runtime setup.
daily-architecture-diagram.md	Replaces docker-sbx.
daily-architecture-diagram.lock.yml	Regenerates microVM execution.
daily-astrostylelite-markdown-spellcheck.md	Replaces docker-sbx.
daily-astrostylelite-markdown-spellcheck.lock.yml	Regenerates microVM execution.
daily-cli-tools-tester.md	Selects Cloud Hypervisor.
daily-cli-tools-tester.lock.yml	Regenerates runtime setup.
daily-credit-limit-test.md	Replaces docker-sbx.
daily-credit-limit-test.lock.yml	Regenerates microVM execution.
daily-experiment-report.md	Replaces docker-sbx.
daily-experiment-report.lock.yml	Regenerates microVM execution.
daily-malicious-code-scan.md	Selects Cloud Hypervisor.
daily-malicious-code-scan.lock.yml	Regenerates runtime setup.
daily-semgrep-scan.md	Selects Cloud Hypervisor.
daily-semgrep-scan.lock.yml	Regenerates runtime setup.
daily-squid-image-scan.md	Selects Cloud Hypervisor.
daily-squid-image-scan.lock.yml	Regenerates runtime setup.
duplicate-code-detector.md	Selects Cloud Hypervisor.
duplicate-code-detector.lock.yml	Regenerates runtime setup.
grumpy-reviewer.md	Selects Cloud Hypervisor.
grumpy-reviewer.lock.yml	Regenerates runtime setup.
issue-triage-agent.md	Selects Cloud Hypervisor.
issue-triage-agent.lock.yml	Regenerates runtime setup.
mcp-inspector.md	Selects Cloud Hypervisor.
mcp-inspector.lock.yml	Regenerates runtime setup.
notion-issue-summary.md	Selects Cloud Hypervisor.
notion-issue-summary.lock.yml	Regenerates runtime setup.
pr-nitpick-reviewer.md	Selects Cloud Hypervisor.
pr-nitpick-reviewer.lock.yml	Regenerates runtime setup.
python-data-charts.md	Selects Cloud Hypervisor.
python-data-charts.lock.yml	Regenerates runtime setup.
repo-tree-map.md	Selects Cloud Hypervisor.
repo-tree-map.lock.yml	Regenerates runtime setup.
schema-feature-coverage.md	Selects Cloud Hypervisor.
schema-feature-coverage.lock.yml	Regenerates runtime setup.
super-linter.md	Selects Cloud Hypervisor.
super-linter.lock.yml	Regenerates runtime setup.
video-analyzer.md	Selects Cloud Hypervisor.
video-analyzer.lock.yml	Regenerates runtime setup.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 60/60 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1