v0.88.0

🌟 Release Highlights

This release focuses on hardening the sandbox runtime, simplifying browser automation with a new Playwright CLI approach, and fixing dependency resolution for nested workflow imports.

⚠️ Breaking Changes

• Removed built-in Playwright MCP support (#57521). Browser automation now goes through the new Playwright CLI guidance instead of the bundled MCP server — update workflows that relied on the built-in Playwright MCP tool.

✨ What's New

• Sandbox security settings replaced with runtime profiles (#57692) — legacy sandbox security flags are now expressed as declarative runtime profiles, making sandbox configuration easier to reason about. See the sandbox reference.
• Playwright CLI guidance and browser provisioning (#57731, #57691, #57594) — new AWF-aware policy prompts, configuration, and a shared smoke test make it easier to provision and use Playwright safely from agentic workflows.
• gh-aw-firewall v0.28.12 integration (#57514) — pulls in attested Cloud Hypervisor artifacts for stronger supply-chain guarantees on the firewall image.
• Operational value report evaluator and history (#57503) — new tooling to evaluate and track the operational value of agentic workflow runs over time.

🐛 Bug Fixes & Improvements

• Fixed dependency ordering and cycle detection for nested imports (#57746) — resolves incorrect ordering and undetected cycles when shared workflow files import each other transitively. See the imports reference.
• Codex custom tools now classified as invalid-model failures (#57578) — clearer error reporting when Codex is configured with unsupported custom tools.
• Fixed stale skill docs and repo-path guard (#57579) for the action-based JS architecture.
• Super-Linter restricted to Go modules (#57465), reducing noise from linting unrelated file types.
• Added a daily Windows Defender release scan (#57768) to catch malware false positives early.

Generated by 🚀 Release · copilot · auto · 20.7 AIC · ⊞ 11.8K

---

What's Changed

• [blog] Weekly blog post – 2026-08-31 by @github-actions[bot] in #57327
• [compiler-threat-spec] Daily threat spec optimizer: confirm CTR-004 coverage for duplicate Playwright --no-sandbox emission by @github-actions[bot] in #57321
• [code-simplifier] Simplify query-discussions.py: extract shared subprocess error handling by @github-actions[bot] in #57333
• [community] Update community contributions in README by @github-actions[bot] in #57320
• [log] Add debug logging to add_package_ownership.go by @github-actions[bot] in #57334
• chore: update drain3 default log pattern weights by @github-actions[bot] in #57346
• Restrict Super-Linter to Go modules by @pelikhan with @Copilot in #57465
• [spec-extractor] docs: correct stale source-file count in workflow package README by @github-actions[bot] in #57406
• [docs] Update glossary - weekly full scan by @github-actions[bot] in #57413
• [blog] Agent of the Day – 2026-08-31 by @github-actions[bot] in #57457
• [caveman] Optimize instruction verbosity — memory-stateful-patterns.md (2026-08-31) by @github-actions[bot] in #57509
• Remove built-in Playwright MCP support by @pelikhan with @Copilot in #57521
• Fix stale skill docs and repo-path guard for the action-based JS architecture by @pelikhan with @Copilot in #57579
• Classify unsupported Codex custom tools as invalid-model failures by @pelikhan with @Copilot in #57578
• Add AWF-aware Playwright CLI policy prompt by @lpcox with @Copilot in #57594
• [evoskill] Refine resolve-merge-conflicts skill: detect leftover conflict markers by @github-actions[bot] in #57601
• [docs] Update glossary - daily scan by @github-actions[bot] in #57673
• [instructions] Sync instruction files with release v0.87.10 by @github-actions[bot] in #57654
• [actions] Update GitHub Actions versions - 2026-09-01 by @github-actions[bot] in #57639
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #57661
• Add operational value report evaluator and history functionality by @mnkiefer in #57503
• Replace legacy sandbox security settings with runtime profiles by @pelikhan with @Copilot in #57692
• Add Playwright configuration and usage guidance by @pelikhan with @Copilot in #57691
• Integrate gh-aw-firewall v0.28.12 attested Cloud Hypervisor artifacts by @lpcox with @Copilot in #57514
• [ci-coach] fix(cli): sync embedded fallback aw files list by @github-actions[bot] in #57710
• [blog] Agent of the Day – 2026-09-01 by @github-actions[bot] in #57715
• Add shared Playwright title smoke test by @pelikhan with @Copilot in #57721
• [safe-output-integrator] Add missing test-copilot-steer.md fixture for steer safe output by @github-actions[bot] in #57763
• Improve Playwright CLI guidance and browser provisioning by @lpcox with @Copilot in #57731
• Add daily Windows Defender release scan by @pelikhan with @Copilot in #57768
• Fix dependency ordering and cycle detection for nested imports by @pelikhan with @Copilot in #57746
• [caveman] Optimize instruction verbosity — network.md (2026-09-01) by @github-actions[bot] in #57777

Full Changelog: v0.87.10...v0.88.0

v0.87.10

🌟 Release Highlights

This release focuses on scheduling controls, trajectory-based agent evaluation, and hardened MCP Gateway/validation behavior.

✨ What's New

• on.cooldown workflow gating (#56998) lets workflows enforce a minimum interval between runs, reducing noisy or redundant triggers.
• Typed on.stop-after field (#56983) now supports GitHub Actions expressions, giving finer control over when scheduled/triggered workflows should stop running.
• Trajectory graders expanded with new implementations for policy-near-miss, exploitation-error, exploration-error, lempel-ziv-trajectory-complexity, skill-constraint-coverage, and tool-output-consumption-rate (#56996, #57152, #57087, #56972, #57055, #57252), plus OpenTelemetry span reporting for grader and eval results (#57015, #57166).
• MCP Gateway bumped to v0.4.14 (#57188) and its compiler output migrated to agentId (#56990), with mutually exclusive agentId/agentIds fields now validated in the gateway schema (#56939).
• Agentic Workflow Firewall bumped to v0.28.10 (#56914).

🐛 Bug Fixes & Improvements

• Fixed Codex harness handling of unsupported-model tool-schema failures with a clearer error message (#57256).
• Fixed trajectory grader duplicate detection (#57255) and prevented oversized MCP query payloads from exceeding argument limits (#57253).
• Fixed remote MCP authentication canary tool check (#57081) and Codex MCP environment fallback rendering (#56924).
• Fixed Playwright MCP TOML sandbox configuration (#56800) and added validation for Playwright mode expressions (#56933).
• Fixed require-getexecoutput-exitcode-check false positive on destructuring assignments (#57088) and improved manualpathconcat/prefer-actions-exec-over-child-process linter detection (#57056, #56985).
• Now requires positive max-runs values in workflow schema (#56911) and rejects top-level roles: per schema validation (#56981).
• Fixed missing Undici dependency in Copilot SDK workflows (#57057) and aligned the Copilot SDK tool catalog with compiled workflow tools (#56976).
• Normalized disabled failure-issue expiry in lockfiles (#56901) and stripped bot footer noise from prompt clustering inputs (#56910).

📚 Documentation

• Fixed invalid YAML example in Job Outputs docs (#56977), broken gallery links in multi-device docs testing (#57082), and stale Daily Firewall Report scope in the metrics glossary (#56979).
• Added documentation on intent-driven workflow design (#57005).

Learn more about on.cooldown and on.stop-after in the reference docs.

Generated by 🚀 Release · copilot · auto · 21.1 AIC · ⊞ 11.8K

---

What's Changed

• [test-parallel] test: add missing t.Parallel() in codemod_mcp_network_addallowed_test.go by @github-actions[bot] in #56714
• [WIP] Fix failing GitHub Actions job Integration: Workflow Infra by @pelikhan with @Copilot in #56688
• Pi engine: route OpenAI/Codex backend through the Responses API by @pelikhan with @Copilot in #56692
• Allow conclusion in on.workflow_run frontmatter schema by @pelikhan with @Copilot in #56743
• [caveman] Optimize instruction verbosity — evals.md (2026-08-28) by @github-actions[bot] in #56727
• Avoid CodeQL false positive in manifest path validation by @pelikhan with @Copilot in #56690
• [docs-diagram] Add Safe Outputs permission-isolation diagram by @github-actions[bot] in #56828
• Fix Playwright MCP TOML sandbox configuration by @pelikhan with @Copilot in #56800
• [spec-enforcer] Enforce specifications for jsonutil, scanfindings by @github-actions[bot] in #56878
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #56871
• [test-parallel] test: add t.Parallel() to safe schedule calendar tests by @github-actions[bot] in #56813
• [WIP] Fix failing GitHub Actions job for misc part 2 by @pelikhan with @Copilot in #56689
• [docs] docs: consolidation v9.24 - fix vague enhanced tone issues, link 3 uncovered spec files by @github-actions[bot] in #56898
• [actions] Update GitHub Actions versions - 2026-08-29 by @github-actions[bot] in #56859
• [code-simplifier] Simplify duplicated payload validation in add_reaction_and_edit_comment.cjs by @github-actions[bot] in #56819
• [purelock] Lock down selectHistoricalOperationalValueGrader, extractHostFromRemoteURL, extractOTLPAttributesFromObsMap with pure
  [Content t by @github-actions[bot] in https://github.com//pull/56895
• Avoid CodeQL bad-redirect-check false positives in path validation guards by @pelikhan with @Copilot in #56691
• Normalize disabled failure-issue expiry in lockfiles by @pelikhan with @Copilot in #56901
• Strip bot footer noise from prompt clustering inputs by @pelikhan with @Copilot in #56910
• Require positive max-runs values in workflow schema by @pelikhan with @Copilot in #56911
• Bump Agentic Workflow Firewall to v0.28.10 by @lpcox with @Copilot in #56914
• Validate Playwright mode expressions by @pelikhan with @Copilot in #56933
• [test-parallel] test: add t.Parallel() to safe table-driven subtests in pkg/cli by @github-actions[bot] in #56954
• Warn when compiled workflows share a display name by @pelikhan with @Copilot in #56937
• Fix Codex MCP environment fallback rendering by @pelikhan with @Copilot in #56924
• [test-parallel] test: add t.Parallel() to TestCompileWorkflowWithActionRef by @github-actions[bot] in #56962
• Expand Codex and Pi workflow coverage by @pelikhan with @Copilot in #56965
• Specify mutually exclusive gateway agentId and agentIds fields by @lpcox with @Copilot in #56939
• Implement lempel-ziv-trajectory-complexity grader (Tier 1, rank 11) by @pelikhan with @Copilot in #56972
• Fix invalid YAML example in Job Outputs docs by @pelikhan with @Copilot in #56977
• Convert trajectory grader workflow to feature grower (all-you-can-eat) pattern by @pelikhan with @Copilot in #56988
• Allow GitHub network access for maintenance workflows by @pelikhan with @Copilot in #56978
• Add regression test confirming top-level roles: is rejected by schema validation by @pelikhan with @Copilot in #56981
• Fix stale Daily Firewall Report scope in metrics glossary by @pelikhan with @Copilot in #56979
• Fix invalid Smoke Copilot discussion temporary IDs by @pelikhan with @Copilot in #56973
• Resolve identifier-referenced options in require-getexecoutput-exitcode-check by @pelikhan with @Copilot in #56984
• prefer-actions-exec-over-child-process: flag hidden async-conversion cost in sync contexts by @pelikhan with @Copilot in #56985
• Optimize ambient context in moderation and test workflows by @pelikhan with @Copilot in #56974
• Enforce explicit job and step timeouts on Visual...

v0.87.9

🌟 Release Highlights

This release focuses on Windows runner support, safe-output hardening, and expanded workflow authoring capabilities for agentic workflows.

✨ What's New

• Windows runner support expands — Bash and PowerShell now work on Windows runners, with a new wiki agentic workflow and a daily windows-grower workflow that automatically probes and fixes Windows compatibility issues (#56508, #56667, #56501).
• Optional intent field for workflows — Workflow front matter now supports an intent field, paired with new intent-driven workflow design guidance to help authors express the "why" behind a workflow (#56599, #56611).
• Private repository Agent Plugin installs — Authenticated installation of Agent Plugins from private repositories is now supported (#56505).
• Target-only checkout for MultiRepoOps — Sidecar workflows can now perform target-only checkouts, reducing unnecessary clone overhead (#56504).
• GitHub Issues read access for enclaves — Agent enclaves can now be granted read-only access to GitHub Issues (#55531), contributed by @lpcox.
• New workflow patterns — Added the "Feature Farmer" pattern (#56614) and documented the "All You Can Eat" scheduled workflow pattern (#56466).

🐛 Bug Fixes & Improvements

• Preserved GitHub expression operators in safe-output JSON to prevent corruption of generated payloads (#56653).
• Fixed runtime-import interpolation for needs output expressions (#56503).
• Prevented Git LFS hook failures during safe-output bundle creation (#56499).
• Fixed actionlint failures on generated maintenance workflow operation inputs (#56506).
• Fixed broken documentation redirect links (#56654).
• Engine domain sets are now explicit opt-in, tightening default network posture (#56447).
• Added an npm registry allowlist to affected workflows for supply-chain safety (#56592).
• Required try/catch around fs.realpathSync calls to avoid unhandled exceptions (#56612).
• Upgraded Go tooling to the latest releases (#56596).

📚 Documentation

• Documented the "All You Can Eat" scheduled workflow pattern and intent-driven workflow design guidance.
• Refreshed the glossary, fixed redirect links, and applied several self-healing documentation fixes from issue analysis.

No community-labeled issues were closed in this release window.

Generated by 🚀 Release · copilot · auto · 15.3 AIC · ⊞ 11.8K

---

What's Changed

• [test-parallel] test: add t.Parallel() to TestFormatWorkingTreeBlockers by @github-actions[bot] in #56453
• Implement event-entropy-rate trajectory grader by @pelikhan with @Copilot in #56464
• Document the "All You Can Eat" scheduled workflow pattern by @pelikhan with @Copilot in #56466
• [docs] Self-healing documentation fixes from issue analysis - 2026-08-28 by @github-actions[bot] in #56471
• Migrate Design Decision Gate to Pi and Copilot GPT-5.4 by @pelikhan with @Copilot in #56467
• Make engine domain sets explicit opt-in by @pelikhan with @Copilot in #56447
• [code-scanning-fix] Fix js/http-to-file-access: use correct CodeQL suppression syntax by @github-actions[bot] in #56500
• Add "wiki" agentic workflow to exercise Windows runner integration by @pelikhan with @Copilot in #56501
• Add read-only GitHub Issues access to agent enclaves by @lpcox in #55531
• Prevent LFS hook failures during safe-output bundle creation by @pelikhan with @Copilot in #56499
• [compiler-threat-spec] docs: extend CTR-004 mapping for enclave GitHub proxy trust surface by @github-actions[bot] in #56521
• [docs] docs: fix spelling of 'architecture' in gemini.md by @github-actions[bot] in #56527
• [log] Add debug logging to under-instrumented add-init/add-package-manifest paths by @github-actions[bot] in #56528
• [docs-diagram] Add editing-workflows recompile diagram by @github-actions[bot] in #56541
• [community] Update community contributions in README by @github-actions[bot] in #56515
• Add npm registry allowlist to affected workflows by @pelikhan with @Copilot in #56592
• Add optional intent field to workflow front matter by @pelikhan with @Copilot in #56599
• [instructions] Instructions Sync with release v0.87.8 by @github-actions[bot] in #56604
• [test-parallel] test: add t.Parallel() to safe pkg/cli audit tests (daily batch) by @github-actions[bot] in #56607
• [eslint-miner] Require try/catch around fs.realpathSync calls by @pelikhan with @Copilot in #56612
• Fix runtime-import interpolation for needs output expressions by @pelikhan with @Copilot in #56503
• [docs] Update glossary - daily scan by @github-actions[bot] in #56623
• Support target-only checkout for MultiRepoOps sidecar workflows by @pelikhan with @Copilot in #56504
• Add the Feature Farmer workflow pattern by @pelikhan with @Copilot in #56614
• [docs] Update documentation for features from 2026-08-28 by @github-actions[bot] in #56626
• Add intent-driven workflow design guidance by @pelikhan with @Copilot in #56611
• Fix actionlint failure on generated maintenance workflow operation input by @pelikhan with @Copilot in #56506
• Support authenticated Agent Plugin installation from private repositories by @pelikhan with @Copilot in #56505
• Upgrade Go tooling to latest releases by @pelikhan with @Copilot in #56596
• [test-parallel] Add t.Parallel() to safe tests in bootstrap_profile_runner_test.go by @github-actions[bot] in #56658
• Fix broken documentation redirect links by @pelikhan with @Copilot in #56654
• Add Bash support for Windows runners by @pelikhan with @Copilot in #56508
• [blog] Agent of the Day – 2026-08-28 by @github-actions[bot] in #56669
• Preserve GitHub expression operators in safe-output JSON by @pelikhan with @Copilot in #56653
• Remove Dashboard Language specification and review workflow by @pelikhan with @Copilot in #56674
• Add daily windows-grower workflow that probes and fixes Windows runner support by @pelikhan with @Copilot in #56667

Full Changelog: v0.87.8...v0.87.9

v0.87.8

🌟 Release Highlights

This release focuses on hardening safe-outputs and MCP gateway reliability, expanding the graders/audit toolchain, and shipping a wave of security and dependency fixes across the agentic workflow engine.

✨ What's New

• Graders & audit clustering — Added a daily grader audit workflow, cross-run audit clustering for graders/evals, and pattern analysis surfaced in logs and audit commands (#56359, #56146, #56072, #56066). See the graders specification.
• Safe-outputs improvements — add-labels gained a create-if-missing option, and remove-labels now supports issue-only permission controls (#56055, #56270).
• Shell linting for workflows — Shell scripts declared in workflow frontmatter are now linted automatically (#56150).
• Dashboard language — Deterministic dashboard custom-link semantics and expanded YAML dashboard specification (#56056, #55841).

🐛 Bug Fixes & Improvements

• Fixed MCP gateway startup failures on non-PR events and extended gateway readiness timeout (#56425, #56315).
• Fixed safe-output updates for fork pull request branches and used an explicit PR head baseline for fork branch updates (#56341, #56119).
• Fixed pricing discrepancies for gpt-5.6-sol and gemini-3.6-flash in models.json (#56272).
• Fixed step summary rendering by moving the WSRF block out of token usage details (#56264).
• Fixed visibility for organization and enterprise variable creation, and resolved dispatch workflow refs from PR comments (#56267, #56266).
• Fixed user-rate-limit alias schema/event fallback and jsonschema format enforcement (#56328, #56325).

🔒 Security Hardening

• Hardened Docker scanner exec paths against argv/path injection, and hardened uv/grype exec argument boundaries (#56333, #55675).
• Added a depguard rule blocking imports of the unmaintained x/crypto/openpgp, and added a govulncheck gate to Go CI (#55882, #55889).
• Enforced the gh-aw v0.85.3 security compatibility floor (#55796).
• Treated primitive decodeURI arguments as statically safe and replaced a template-injection grep check with a parsed workflow check (#56331, #55863).

📚 Documentation

• Added a workflow sharing/distribution diagram to the Using at Scale guide (#56283).
• Documented the graders CLI command and expanded the Troubleshooting section in the mcp-scripts reference (#55794, #55883).
• Clarified prerelease upgrade/downgrade guidance and advanced frontmatter configuration options (#56351, #56090).

Generated by 🚀 Release · copilot · auto · 21.5 AIC · ⊞ 11.8K

---

What's Changed

• Add diagnostics for GitHub release creation failures by @pelikhan with @Copilot in #56413
• Enforce jsonschema formats and structural error path lookup by @pelikhan with @Copilot in #56325
• Design Decision Gate: prevent runaway agent loops from nonexistent skill/tool drift by @pelikhan with @Copilot in #56314
• Fix visibility for organization and enterprise variable creation by @pelikhan with @Copilot in #56267
• Enforce gh-aw v0.85.3 security compatibility floor by @pelikhan with @Copilot in #55796
• Remove symlinked Go bind mount from Avenger by @pelikhan with @Copilot in #56426
• Fix MCP gateway startup failure on non-PR events (Daily Go Test Parallelizer) by @pelikhan with @Copilot in #56425
• [WIP] Fix failing GitHub Actions job Integration: Workflow Misc Part 2 by @pelikhan with @Copilot in #56430
• Fix Codex threat-detection config pointing at the Anthropic api-proxy port by @davidslater with @Copilot in #56404
• Update gh-aw-threat-detection pin to v0.5.1 by @pelikhan with @Copilot in #56441
• Ensure Aider workflows always emit safe outputs by @pelikhan with @Copilot in #56442
• Reduce Ponytail Reviewer ambient context with proxy tooling by @pelikhan with @Copilot in #56446

Full Changelog: v0.87.7...v0.87.8

v0.87.5

🌟 Release Highlights

This release delivers 226 merged pull requests focused on hardening the compiler, expanding safe-output tooling, and strengthening the automated linting and grading systems that keep gh-aw's self-maintaining workflows healthy.

✨ What's New

• gh aw models adds a catalog command for pricing, alias resolution, and observed automation models (#55148).
• Experimental schema-aware gh aw edit enables structured, validated editing of workflow frontmatter (#55475).
• PR steering is now available for compatible create-pull-request workflows, replacing the legacy pre-create flow (#55171, #55249, #55285, #55250).
• daily-storify workflow adds episode-based daily narrative analysis (#55248), and a new daily harness experiment proposer automates experiment ideation (#55120).
• Generated footers now render the agentic engine used and improved spacing/consistency (#55192, #55372).
• Added secret-scanning-alerts permission scope and attestations/models permission documentation (#54904, #54856).
• New drive-backed workflow memory support for persistent state across runs (#54662, #54892).

🐛 Bug Fixes & Improvements

• Fixed Codex credential check crashes and 401 errors by disabling WebSocket transport (#55106, #55089).
• Hardened Cloud Hypervisor sandboxing: fixed Copilot SDK crashes and cache-memory write failures (#55495, #55427).
• Corrected conclusion job permission derivation and skip-dominated workflow health metrics (#55529, #54729).
• Fixed github-discussion-query payload scaling to avoid jq argument growth (#55560).
• Improved MCP CLI wrapper script permissions (0o700 instead of 0o755) for tighter security (#55587).
• Numerous CodeQL and static-analysis findings addressed, including allocation-size guards and actionlint fixes (#55480, #55011).

🔧 Internal & Quality

• Continued rollout of custom linters (eslint-factory rules, Go analyzers) catching duplicate scene IDs, unsafe string fallbacks, path-join misuse, and more across the codebase.
• Large-scale test parallelization effort (t.Parallel()) applied across dozens of Go test files to speed up CI.
• Ongoing refactors split oversized files (awf_config.go, progress.go, safe-output handler registries) into focused modules for maintainability.
• Migrated dozens of internal agentic workflows to sandboxed/codex engine runtimes for improved isolation.

📚 Documentation

• Unbloated and refreshed docs for custom agents, GitHub tools reference, glossary, and frontmatter conventions.
• Clarified quick-start install instructions and cache-memory retention semantics.

No community-labeled issues were closed in this release window.

Generated by 🚀 Release · copilot · auto · 28.1 AIC · ⊞ 11.8K

---

What's Changed

• [test-parallel] Add t.Parallel() to TestExtractGitHubToolsets by @github-actions[bot] in #54723
• Fix skip-dominated workflow health metrics by @pelikhan with @Copilot in #54729
• Normalize mixed-type workflow run IDs by @pelikhan with @Copilot in #54731
• Add accessible name to docs home logo link by @pelikhan with @Copilot in #54748
• Fix sync exec timeout detection for defaulted option spreads by @pelikhan with @Copilot in #54749
• lenstringzero: report the actual expression in diagnostic messages by @pelikhan with @Copilot in #54721
• Make error-message lint advisory by @pelikhan with @Copilot in #54800
• Rename panic-in-library-code internals for intent-driven discoverability by @pelikhan with @Copilot in #54795
• Fix impacted test selection under shallow (fetch-depth 1) checkouts by @pelikhan with @Copilot in #54793
• Make Serena Go workflows mount runner tool cache for in-container go resolution by @pelikhan with @Copilot in #54794
• Detect ternary-selected HTTP module bindings by @pelikhan with @Copilot in #54796
• Add experimental drive-backed workflow memory by @pelikhan with @Copilot in #54662
• [purelock] Lock down hasOpenShellArithmeticExpression, parseClaudeJSONArrayBuffer, parseEventTypes with pure-function test suite
  [Content t by @github-actions[bot] in https://github.com//pull/54797
• Clarify cache-memory defaults and retention semantics by @pelikhan with @Copilot in #54805
• Ignore ADR changes in docs workflow by @pelikhan with @Copilot in #54808
• Skip built-in framework jobs when creating conclusion failed-jobs issues by @pelikhan with @Copilot in #54809
• [dead-code] chore: remove dead functions — 1 function removed by @github-actions[bot] in #54835
• Validate drive-memory disk-size syntax at compile time and suggest 100M by @pelikhan with @Copilot in #54831
• Fix Dependabot ignores for gh-aw action subpaths by @pelikhan with @Copilot in #54812
• Give stringbytesroundtrip.isExactString its own exactness logic by @pelikhan with @Copilot in #54722
• Unify job-name normalizers and split grab-bag stringutil.go by @pelikhan with @Copilot in #54702
• Split threat_detection_test.go, copilot_engine_test.go, maintenance_workflow_test.go by functional area by @pelikhan with @Copilot in #54681
• ci: resolve base commit so golangci-lint runs incrementally on PRs by @pelikhan with @Copilot in #54844
• Compute orphan-rate baseline dynamically in copilot-session-insights by @pelikhan with @Copilot in #54842
• Refresh GitHub Actions schema and preserve drives permission by @pelikhan with @Copilot in #54845
• Reuse shared workflow types for Copilot setup scaffolding by @pelikhan with @Copilot in #54804
• Refactor overlong functions in pkg/console/progress.go and pkg/cli/mcp_tools_privileged.go by @pelikhan with @Copilot in #54705
• Harden setup JavaScript input and I/O boundaries by @pelikhan with @Copilot in #54691
• Centralize safe-output footer configuration by @pelikhan with @Copilot in #54703
• parser: adopt structured duplicate-name validation errors for inline skills and sub-agents by @pelikhan with @Copilot in #54715
• Split CGO unit tests into 5 shards by @pelikhan with @Copilot in #54848
• Refactor compiler job assembly by @pelikhan with @Copilot in #54847
• Introduce a shared Finding/SeverityLevel type across scanner integrations by @pelikhan with @Copilot in #54690
• Add initial deterministic trace grading framework by @pelikhan with @Copilot in #54678
• Fix SC2015 ambiguous shell pattern in generated firewall log copy step by @pelikhan with @Copilot in #54747
• Introduce typed enums for workflow fixed-value fields by @pelikhan with @Copilot in #54803
• Bound generated agent and detection jobs with configurable timeouts by @pelikhan with @Copilot in #54816
• Document attestations, models, and secret-scanning-alerts permission scopes by @pelikhan with @Copilot in #54856
• Re-diagnose q workflow success rate as command gating, not execution failure by @pelikhan with @Copilot in #54854
• Prevent compute_text log output from triggering GitHub Actions error annotations by @pelikhan with @Copilot in #54870
• Address daily SPDD spec compliance gaps by @pelikhan with @Copilot in #54853
• Add custom engine implementation skill by @pelikhan with @Copilot in #54874
• Fix samples-mode replay: forward workflow input env vars and stop server.error crash by @dsyme with @Copilot in #54814
• Instructions: prefer built-in skills:/plugins: frontmatter over on-the-fly installs by @pelikhan with @Copilot in #54880
• Add daily Primer-styled documentation diagram workflow by @pelikhan with @Copilot in #54873
• Enforce positive-integer jobs.*.timeout-minutes in compiled lock files by @pelikhan with @Copilot in #54884
• Bump default gh-aw-firewall (AWF) version to v0.28.5 by @lpcox with @Copilot in #54894
• Add secret-scanning-alerts to workflow permissions schema by @pelikhan with @Copilot in #54904
• Unify safe-output outcome status enums by @pelikhan with @Copilot in #54846
• Unify create-* close-older fields via shared CloseOlderConfig embed by @pelikhan with @Copilot in #54656
• Add shared long-horizon memory workflow by @pelikhan with @Copilot in https://github.com/githu...

v0.87.4

🌟 Release Highlights

This release focuses on compiler robustness, safe-output validation, and internal tooling/observability improvements across the agentic workflow pipeline.

✨ What's New

• Stricter safe-outputs validation: compilation now fails fast when a safe-outputs step-output token can't resolve in a consuming job, and generic tools are no longer duplicated for renamed dynamic safe-output tools (#54632, #54631).
• Pinned Agent Plugins support added for more reproducible workflow builds (#54288).
• Approve-workflow-run safe output now supports comments (#54504).
• Engine flexibility: engine.model can now override the top-level model per engine instance, and custom-provider models pass through verbatim for OPENAI_BASE_URL/ANTHROPIC_BASE_URL endpoints (#54366, #54363).
• gh aw update now refreshes upstream skills/plugins and package-managed assets automatically (#54417).

🐛 Bug Fixes & Improvements

• Fixed Copilot orphan-escalation assignee detection and threat-detection summary initialization (#54716, #54370).
• Corrected create_issue fields handler to use valid GraphQL fragments, and fixed no-math-minmax-array-spread/schema diff/workflow-key extraction lint checks (#54361, #54498, #54647).
• Hardened checkout/credential handling: shallow checkout for CGO/CJS/CWI jobs, and GH_TOKEN no longer persists in repo-memory clone's .git/config (#54709, #54701).
• Derived the conclusion job's issues:write permission directly from resolved safe-outputs config, and scoped deny-only blocking in signed-commit file-protection validation (#54630, #54628).
• Flipped hide-comment discussions default to opt-in for least privilege (#54380).

📚 Documentation

• Clarified frontmatter redirect behavior/missing fields and CLAUDE_CODE_OAUTH_TOKEN failure modes (#54400, #54590).
• Documented previous-result strategies for scheduled workflows and the panic() contract for embed-guarded lazy-load sites (#54568, #54599).

🔧 Internal

• Continued rollout of Working-Set Rebuild Factor (WSRF) observability across audits and step summaries (#54416, #54591, #54603).
• Broad test-parallelization and lint hardening sweep (t.Parallel(), errormessage/RGS/CodeQL fixes) across the compiler and CI packages.

No community-labeled issues were closed in this release window.> Generated by 🚀 Release · auto · 17.9 AIC · ⊞ 11.7K

---

What's Changed

• [test-parallel] test: add t.Parallel() to safe subtests in audit_expanded_test.go by @github-actions[bot] in #54694
• Add guarded continual harness experiments by @pelikhan with @Copilot in #54526
• Stop persisting GH_TOKEN in repo-memory clone's .git/config by @pelikhan with @Copilot in #54701
• Embed AgentMetadataInfo in LockMetadata instead of duplicating 7 fields by @pelikhan with @Copilot in #54670
• Use shallow checkout for CGO/CJS/CWI checkout-cache jobs by @pelikhan with @Copilot in #54709
• [log] Add debug logging to add_package_manifest files by @github-actions[bot] in #54712
• Fix error-safety and observability lint findings in actions/setup/js by @pelikhan with @Copilot in #54689
• Fix actions/setup/js regex and API-safety mechanical lint slice by @pelikhan with @Copilot in #54671
• Fix Copilot orphan-escalation assignee detection by @pelikhan with @Copilot in #54716

Full Changelog: v0.87.3...v0.87.4

v0.87.2

🌟 Release Highlights

This release strengthens sandbox security defaults, improves package/workflow update reliability, and ships a batch of linter, docs, and CI reliability fixes.

✨ What's New

• External threat detection enabled by default (#54111) — workflows now get proactive threat-detection coverage out of the box, improving baseline security posture without extra configuration.
• Cloud Hypervisor adopted across 58 agentic workflows (#54346) — broader migration improves sandbox isolation and reliability for agentic runs.
• Scoped ownership for package resources (#54120) and re-resolved manifests during workflow updates (#54119) — package dependencies stay accurate and correctly scoped as workflows evolve.
• New manualpathconcat linter (#54307) flags manual / path concatenation, catching a common class of path-handling bugs at compile time.
• Support for runner groups in custom safe jobs (#53977) gives more control over where custom safe-output jobs execute.

🐛 Bug Fixes & Improvements

• Fixed the logs MCP tool silently truncating explicit date-range queries to a single stale day with no warning (#54110).
• Fixed safe-output inline-backtick neutralization (#54103) and JSON-array expressions in approve-workflow-run safe outputs (#53812).
• Fixed a false-positive heredoc detection on bare (( )) arithmetic in the generatedyamlheredoc linter (#53991).
• Hardened command argument validation for pip/uv checks and npm lockfile execution (#53957), and added regression coverage for pip argv validation before exec (#54282).
• Fixed schedule-triggered workflow false positives and improved root-cause surfacing for disabled workflows in the health monitor (#53881).
• Fixed approve_workflow_run handler load failure caused by an npm minimatch require (#54281).
• Fixed actionlint error from an agent job referencing needs.approval_allowlist without a declared dependency (#54028).
• Restored GHES-compatible artifact action pins (#53966) and hardened post-agent cache Git commits (#53879).

📚 Documentation

• Clarified lock files and workflow setup commands (#54342), documented compiler-generated job authentication (#54100), and made Copilot auth docs easier to scan (#54337).
• Documented PR fast-track triage criteria (#53880) and closed non-Copilot engine parity gaps for gh aw init and custom engine frontmatter (#53834).
• Added workflow wizard links to documentation (#53862) and unbloated the network and safe-outputs PR references (#54104, #53875).> Generated by 🚀 Release · auto · 16.2 AIC · ⊞ 11.7K

---

What's Changed

• Redirect Astro wizard docs to hosted wizard by @pelikhan with @Copilot in #53815
• [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe pkg/cli subtests by @github-actions[bot] in #53822
• Add review-agentic-workflows skill for security-first workflow review and optimization triage by @pelikhan with @Copilot in #53775
• Remove hidden README and docs navigation text by @pelikhan with @Copilot in #53816
• Add workflow wizard links to documentation by @pelikhan with @Copilot in #53862
• [test-parallel] test: add t.Parallel() to TestCLIProxyBashDisabledCodemod subtests by @github-actions[bot] in #53845
• pr-sous-chef: document GraphQL fetch for reviewThreads (fixes invalid gh pr view field) by @pelikhan with @Copilot in #53833
• docs: close non-Copilot engine parity gaps for gh aw init and custom engine frontmatter by @pelikhan with @Copilot in #53834
• Fix JSON-array expressions in approve workflow run safe outputs by @pelikhan with @Copilot in #53812
• [docs] docs: unbloat safe outputs PR reference by @github-actions[bot] in #53875
• Fix chronic Smoke Copilot AOAI dispatch failure and cap per-run AI credits by @pelikhan with @Copilot in #53817
• [test-parallel] Add t.Parallel() to safe codemod test files (batch after codemod_factory_test.go) by @github-actions[bot] in #53887
• Infer GitHub App permissions and events from resolved package workflows in add-wizard bootstrap by @pelikhan with @Copilot in #53766
• Document PR fast-track triage criteria by @pelikhan with @Copilot in #53880
• Fix schedule-triggered workflow false positives and surface disabled-workflow root cause in health monitor by @pelikhan with @Copilot in #53881
• [community] Update community contributions in README by @github-actions[bot] in #53893
• [test-parallel] test: add t.Parallel() to safe pkg/cli tests (daily batch) by @github-actions[bot] in #53931
• [eslint-miner] eslint: extend no-exec-interpolated-command to cover execApi parameter-alias calls by @github-actions[bot] in #53947
• Split oversized test files compiler_jobs_test.go and compiler_safe_outputs_config_test.go by @pelikhan with @Copilot in #53818
• [docs] docs: fix British-English spellings in frontmatter-full.md by @github-actions[bot] in #53898
• [docs] Update glossary - daily scan by @github-actions[bot] in #53961
• Align workflow step names with glossary terminology by @pelikhan with @Copilot in #53968
• [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to 6 safe test files by @github-actions[bot] in #53967
• Update charmbracelet golden test helper dependency by @pelikhan with @Copilot in #53970
• eslint-factory: resolve destructured bindings precisely in resolveInitializer by @pelikhan with @Copilot in #53960
• Document threat-detection-suppress and max-runs deprecation; fix stale check-for-updates link by @pelikhan with @Copilot in #53990
• [purelock] Lock down validateCopilotSetupStepsRunsOn, extractGitHubToolsets, buildConnectionString with pure-function test suite
  [Content truncated due to length] by @github-actions[bot] in #54004
• [test-parallel] test: add t.Parallel() to safe top-level tests in pkg/cli batch by @github-actions[bot] in #54002
• [WIP] Fix failing GitHub Actions job Integration: Workflow Compiler by @pelikhan with @Copilot in #54008
• [blog] Agent of the Day – 2026-08-19 by @github-actions[bot] in #54022
• Improve pre-created pull request title and body by @pelikhan with @Copilot in #53956
• Harden command argument validation for pip/uv checks and npm lockfile execution context by @pelikhan with @Copilot in #53957
• Harden post-agent cache Git commits by @pelikhan with @Copilot in #53879
• [test-parallel] test: add t.Parallel() to safe pkg/cli tests (batch 2) by @github-actions[bot] in #54024
• [WIP] Fix failing GitHub Actions job Integration: Workflow Infra by @pelikhan with @Copilot in #54032
• Fix gvisor+privileged sandbox codemod gap and add missing tools.bash codemod for min-integrity: none by @pelikhan with @Copilot in #53964
• [test-parallel] Add t.Parallel() to safe pkg/cli tests (batch 12) by @github-actions[bot] in #54078
• Restore GHES-compatible artifact action pins by @pelikhan with @Copilot in #53966
• Exclude package registries from engine default network domains by @lpcox in #54055
• [dead-code] chore: remove dead functions — 2 functions removed by @github-actions[bot] in #54023
• Remove phantom permission factory documentation by @pelikhan with @Copilot in #54015
• [WIP] Fix failing GitHub Actions job Integration: Workflow Misc Part 2 b...

v0.87.1

🌟 Release Highlights

This release focuses on hardening the workflow compiler and sandbox runtime, expanding safe-output capabilities (stacked pull requests, pre-created PR mode), and shipping a big batch of security, reliability, and documentation improvements across the agentic workflow ecosystem.

✨ What's New

• Stacked pull request support for the create-pull-request safe output, enabling multi-commit workflows to build PR chains.
• Pre-created pull request safe output mode, giving workflows more flexibility in how PRs are opened and managed.
• Source-to-destination mappings in aw.yml includes, making shared workflow imports more flexible.
• gh aw init now validates generated copilot-setup-steps.yml, catching setup issues earlier.
• Continued rollout of the cloud-hypervisor sandbox runtime across dozens of agentic workflows for improved isolation.
• New secret-scanning-alerts permission support in tools.github.github-app.permissions, with automatic token input.
• Polished workflow prompt wizard, plus docs now redirect to the hosted wizard experience.

🐛 Bug Fixes & Improvements

• Fixed gh aw update dropping object-form (uses/with) imports.
• Fixed Timeout type drift between BoundedQueriesConfig and AWFBoundedQueriesConfig.
• Hardened git argument construction against option injection and path traversal.
• Fixed silent truncation of the Agent Job Health Monitor's 24h log cache due to a default --count cap.
• Fixed Copilot CLI toolcache hits not creating /usr/local/bin/copilot.
• Fixed transient curl connection-reset failures in setup install scripts.
• Hardened Copilot CLI release installation against transient CDN failures.
• Rejected digest-qualified container pin references for tighter supply-chain safety.
• Numerous safe-output reliability fixes (PR trigger context forwarding, stdin JSON payload validation, MCP tool guidance, artifact upload fallback survival).

📚 Documentation

• Reconciled contradictory max-turns engine-support tables in engines.md.
• Expanded WIF (Workload Identity Federation) guidance and clarified frontmatter ordering.
• Documented explicit Docker sandbox runtime behavior and repository shorthand for secrets bootstrap.
• Added review-agentic-workflows skill for security-first workflow review and optimization triage.

🔧 Internal

• Large-scale refactors: decomposed safe-output compiler helpers, split the custom job compiler into focused modules, refactored the experiments CLI, and hoisted duplicated linter analyzer helpers into shared utilities.
• Continued Go test parallelization (t.Parallel()) across pkg/cli and codemod test suites for faster CI.> Generated by 🚀 Release · auto · 26.4 AIC · ⊞ 11.7K

---

What's Changed

• Add experimental DeepSeek Harness engine by @pelikhan with @Copilot in #53002
• Refactor AWF command builders to reduce function-length lint backlog by @pelikhan with @Copilot in #52999
• Fix ECONNREFUSED driver_exit failures in Copilot SDK engine by gating on api-proxy listener readiness by @pelikhan with @Copilot in #52994
• [docs] docs: unbloat cost management reference by @github-actions[bot] in #53001
• Fix DeepSeek smoke harness npm install cooldown by @pelikhan with @Copilot in #53009
• Avenger: enforce 8-minute runtime budget and failure-driven repair flow by @pelikhan with @Copilot in #53021
• Add restricted-tool triage guidance for tool denials by @pelikhan with @Copilot in #53025
• Use cached logs for daily firewall reporting by @pelikhan with @Copilot in #53024
• Fix tool denial guardrail failure in Daily Regression Audit workflow by @pelikhan with @Copilot in #53030
• [compiler-threat-spec] docs: sync CTR-025 framework self-prompt misattribution spec by @pelikhan with @Copilot in #53037
• Gate mapclearloop findings on loop-body coverage by @pelikhan with @Copilot in #53034
• Eliminate shared mutable builtin virtual FS state in parser registration path by @pelikhan with @Copilot in #53019
• [code-simplifier] Simplify purity_scan.go by extracting resolveObj and ensureDir helpers by @pelikhan with @Copilot in #53036
• Fix Code Scanning Fixer tool denials by @pelikhan with @Copilot in #53038
• Increase Safe Output Health Monitor turn budget by @pelikhan with @Copilot in #53042
• Increase Step Name Alignment turn budget to prevent guardrail-aborted runs by @pelikhan with @Copilot in #53035
• Use run-scoped authentication for Aider workflows by @pelikhan with @Copilot in #53044
• Harden Avenger against transient Claude harness failure exhaustion by @pelikhan with @Copilot in #53043
• Refactor shared value formatting and unify GitHub error/SHA classification paths by @pelikhan with @Copilot in #53018
• Use default runtime for GitHub Docs SEO optimizer by @pelikhan with @Copilot in #53047
• Make agent failure log rendering ::add-mask:: aware by @pelikhan with @Copilot in #53048
• Document ESLint factory rules and prevent README drift by @pelikhan with @Copilot in #53061
• Detect split-index numeric parses wrapped in fallbacks and ternaries by @pelikhan with @Copilot in #53063
• Accept unavailable upstream Grafana MCP vulnerability fixes by @pelikhan with @Copilot in #53079
• [test-parallel] Add t.Parallel() to safe Go test subtests (batch 1) by @github-actions[bot] in #53083
• [instructions] Sync instruction files with release v0.87.0 by @github-actions[bot] in #53092
• Refresh Serena MCP container pin by @pelikhan with @Copilot in #53078
• [rendering-scripts] Render message/reason fields in safe-outputs step-summary preview by @github-actions[bot] in #53087
• Fix TestFormal_TestIDFormatWellFormed for shared CTR test ID allocation by @pelikhan with @Copilot in #53108
• Update approve-workflow-run safe output description by @pelikhan with @Copilot in #53115
• Increase memory headroom for Daily Evals report agent by @pelikhan with @Copilot in #53111
• Handle cold cache state in Claude docs review by @pelikhan with @Copilot in #53122
• Sync GitHub MCP toolset mappings by @pelikhan with @Copilot in #53121
• Enable cloud-hypervisor sandbox runtime for copilot, claude, and gemini smoke workflows by @pelikhan with @Copilot in #53133
• Add ESLint guard for stalled while (true) pagination by @pelikhan with @Copilot in #53120
• Pre-fetch workflow logs for Workflow Normalizer by @pelikhan with @Copilot in #53128
• Allow target in safe-outputs.create-check-run frontmatter schema by @pelikhan with @Copilot in #53113
• [purelock] Lock down recommendAuditComparisonAction, prepareNestedMapValueForYAML, gatewayEntryToTimelineEvent with pure-functio
  [Content truncated due to length] by @github-actions[bot] in #53123
• [WIP] Debug package specification librarian workflow failure by @pelikhan with @Copilot in #53135
• [avenger] Add required allowed-workflows to approve-workflow-run test fixture by @github-actions[bot] in #53138
• Harden Copilot CLI release installation against transient CDN failures by @pelikhan with @Copilot in #53112
• Stage Pi CLI in the docker-sbx-visible path so Pi agents run under microVM sandboxes by @pelikhan with @Copilot in #53110
• Reject digest-qualified container pin references by @pelikhan with @Copilot in #53139
• Add fallback artifact so safe outputs survive agent artifact upload failures by @pelikhan with @Copilot in #53109
• Don't fail safe_outputs job when a resolve-review-thread ID hits an unrelated repo by @pelikhan with @Copilot in #53124
• [dead-code] chore: remove dead functions — 1 function removed by @github-actions[bot] in #53141
• Fix JSONL corruption in daily CLI performance benchmark history by @pelikhan with @Copilot in #53146
• Fill documentation gaps found by Agent Persona Explorer run (schedule-based compliance audits, PM digests, multi-scenario comparisons) by @pelikhan with @Copilot in #53155
• Fix transient curl connection-reset failures in setup install scripts by @pelikhan with @Copilot in #53154
• Fix Aider engine producing no safe outputs by pinning the diff edit format by ...

v0.87.0

🌟 Release Highlights

This release is a major internal hardening pass — dozens of custom linters, security fixes, and refactors — plus one new safe output capability for handling fork pull requests.

✨ What's New

• Approve fork pull request workflow runs — a new experimental approve-workflow-run safe output lets agents unblock GitHub's fork PR approval gate programmatically, with strict guardrails (protected-file checks, allowed-workflow/PR scoping, and required external tokens). See ADR-52541.
• Cloud-hypervisor agent runtime enabled on eligible agentic workflows for improved isolation.
• Model inventory refreshed to include Gemini 3.7 Flash and Grok 4.6.

🔧 Internal & Security

• Extended confused-deputy protection to pull_request_target triggers.
• Removed several vulnerable/deprecated container image pins (gh-aw-firewall, cli-proxy, Serena MCP) and expanded Grant license/CVE exception policies.
• Hardened cache-memory git restore by scrubbing persisted .git config/info state.
• Added numerous new custom lint rules (empty-catch handling, invalid-date checks, dynamic regex patterns, hardcoded file paths, mutable slice/map fields) and fixed several existing rule false positives/negatives.
• Refactored long functions and parameter-heavy APIs (dependabot.go, SafeUpdate, package resolution) to reduce lint backlog.
• Fixed inline review comments on centralized reviewer reruns.
• Removed deprecated SkipInstructions from CompileConfig.
• Dependency bumps: golang.org/x/mod to v0.40.0, charmbracelet golden pseudo-version.

No community-labeled issues were closed in this release window.> Generated by 🚀 Release · auto · 16.6 AIC · ⊞ 11.6K

---

What's Changed

• Enable cloud-hypervisor agent runtime on eligible agentic workflows by @pelikhan with @Copilot in #52932
• Remove vulnerable cli-proxy 0.27.44 container pin by @pelikhan with @Copilot in #52934
• Complete AI crawler allow list in docs robots.txt by @pelikhan with @Copilot in #52930
• Add packagelevelmutableslicemap custom linter by @pelikhan with @Copilot in #52920
• Add repository-level grype ignore policy for no-fix libc6 CVEs by @pelikhan with @Copilot in #52924
• [WIP] Fix failing GitHub Actions job 'Integration: CLI Completion & Other' by @pelikhan with @Copilot in #52927
• Add conformance coverage for spec safeguards and threat optimizer failures by @pelikhan with @Copilot in #52922
• Expand Grant license exceptions for gh-aw-mcpg container scan findings by @pelikhan with @Copilot in #52933
• Remediate vulnerable Serena MCP container image by @pelikhan with @Copilot in #52923
• Remove vulnerable gh-aw-firewall agent 0.27.44 container image pin by @pelikhan with @Copilot in #52947
• Allow Ubuntu 22.04 base OS packages in Grant policy for the gh-aw-firewall agent image by @pelikhan with @Copilot in #52949
• Cover untested Resolver branches in pkg/intent/resolver_test.go by @pelikhan with @Copilot in #52941
• Enforce regexpdynamicpattern linter in CI (cgo.yml) by @pelikhan with @Copilot in #52954
• hardcodedfilepath: include same-package unexported consts in reuse suggestions by @pelikhan with @Copilot in #52948
• Remove deprecated SkipInstructions from CompileConfig and all call sites by @pelikhan with @Copilot in #52955
• fix(httpnoctx): stop enclosing-scope walk at plain FuncLit boundaries by @pelikhan with @Copilot in #52958
• Fast-fail Copilot "No model available" policy error instead of exhausting retries by @pelikhan with @Copilot in #52953
• Detect Date.parse(...) comparisons in require-invalid-date-check-before-compare by @pelikhan with @Copilot in #52961
• deps: bump golang.org/x/mod to v0.40.0 by @pelikhan with @Copilot in #52962
• Fix named string round-trip diagnostic guidance by @pelikhan with @Copilot in #52963
• Harden cache-memory git restore by scrubbing persisted .git config/info state by @pelikhan with @Copilot in #52944
• Type SafeJobConfig.RunsOn as RunsOnValue instead of any by @pelikhan with @Copilot in #52940
• Consolidate RunSummary and DownloadResult analysis fields by @pelikhan with @Copilot in #52957
• Recognize Number.isFinite(d.getTime()) as a valid invalid-date guard by @pelikhan with @Copilot in #52968
• Fix embedded error-code detection in thrown-error rule by @pelikhan with @Copilot in #52972
• deps: update charmbracelet golden pseudo-version by @pelikhan with @Copilot in #52977
• Require positive timeouts for synchronous child processes by @pelikhan with @Copilot in #52978
• Fix inline review comments on centralized reviewer reruns by @pelikhan with @Copilot in #52960
• eslint-factory: extend no-empty-catch-block to empty Promise .catch handlers by @pelikhan with @Copilot in #52979
• eslint-factory: narrow require-fetch-response-body-try-catch diagnostic to actual failure mode by @pelikhan with @Copilot in #52981
• Broaden empty-catch intent comment recognition by @pelikhan with @Copilot in #52983
• Refactor dependabot.go long functions to reduce function-length lint backlog by @pelikhan with @Copilot in #52971
• Extend confused deputy protection to pull_request_target by @pelikhan with @Copilot in #52976
• Consolidate duplicate runs-on normalization helpers across config parsers by @pelikhan with @Copilot in #52975
• Refactor parameter-heavy safe-update and package resolution APIs by @pelikhan with @Copilot in #52982
• Add safe output for approving fork pull request workflow runs by @pelikhan with @Copilot in #52541
• Update model inventory for Gemini 3.7 Flash and Grok 4.6 by @pelikhan with @Copilot in #52993
• Fix daily-code-debt-aider workflow failure by removing docker-sbx runtime by @pelikhan with @Copilot in #52995

Full Changelog: v0.86.3...v0.87.0

v0.86.3

🌟 Release Highlights

This release focuses on hardening AWF sandbox runtimes, tightening security around dynamic exec/CLI calls, and trimming legacy engine support, alongside a steady stream of internal reliability and code-quality improvements.

⚠️ Breaking Changes

• Pydantic engine removed — the Pydantic AI integration, its smoke workflow, and related docs/registry entries have been removed (#52843). Workflows using engine: pydantic should migrate to a supported engine.
• Firecracker support removed (#52774) — superseded by the Cloud Hypervisor runtime work below.

✨ What's New

• Cloud Hypervisor runtime (preview) — gh-aw now supports sandbox.agent.runtime: cloud-hypervisor as a preview microVM runtime alongside docker-sbx/gvisor, including release-asset digest verification and scoped /dev/kvm access (#52119, #52588).
• AWF firewall bumped to v0.28.1, pulling in the Cloud Hypervisor prerequisites and refreshed container digests (#52607).
• More resilient MCP gateway — a single unreachable non-critical MCP server no longer aborts the whole gateway startup (#52075), MCP log queries return partial results instead of timing out (#52412), and engine-filtered log queries get a longer timeout (#52063).
• New Agent Job Health Monitor workflow to track fleet-wide agent-job failure rates (#52108).

🐛 Bug Fixes & Improvements

• Hardened exec.Command/child-process call sites against shell-flag and CWE-78/89 style injection across pkg/cli and linter rules (#52401, #52909, #52905, #52707).
• Removed vulnerable container digest pins for the AWF api-proxy and squid images (#52900, #52829).
• Fixed the Linter Miner crashing on model: inherited inline sub-agents (#52133).
• Fixed Claude Code CLI abnormal exits and cold-start connection refusals via improved harness retry classification (#52837, #52198).
• Documented license policy exceptions for Debian/Alpine base OS packages in container images (#52912, #52904).

📚 Documentation

• Clarified gh aw init docs for Copilot-only agent/MCP artifacts (#52581).
• Unbloated the troubleshooting/common-issues guide and refreshed the glossary (#52189).
• Documented harness watchdog and retry runtime settings (#52511).> Generated by 🚀 Release · auto · 25.3 AIC · ⊞ 11.6K

---

What's Changed

• [purelock] Lock down extractExperimentVariantStubs, isValidToolName, validateObjectInput with pure-function test suites by @github-actions[bot] in #52048
• Allow repository_dispatch user rate limits by @pelikhan with @Copilot in #52101
• Report terminal Claude failures after recovered continue retries by @pelikhan with @Copilot in #52057
• Add Agent Job Health Monitor to own fleet-wide agent-job failure rate by @pelikhan with @Copilot in #52108
• [slides] Fix layout overflow on security slides by @github-actions[bot] in #52114
• Compile unified AWF enclaves through mcpg by @lpcox in #50920
• Address Persona Explorer findings: trigger ambiguity, digest grouping, compliance example by @pelikhan with @Copilot in #52121
• Trim unused Matt Pocock skills from skills-reviewer workflow by @pelikhan with @Copilot in #52122
• Consolidate JobStep/JobStepData identical structs in pkg/cli by @pelikhan with @Copilot in #52120
• Allow jq in Breaking Change Checker by @pelikhan with @Copilot in #52128
• Add preview Cloud Hypervisor runtime support for sandbox.agent.runtime with docker-sbx parity by @lpcox with @Copilot in #52119
• Fix Linter Miner crash: unsupported model: inherited on inline sub-agents by @pelikhan with @Copilot in #52133
• Extend MCP logs timeout for engine-filtered queries by @pelikhan with @Copilot in #52063
• Add formal RS-05a checkout gate coverage by @pelikhan with @Copilot in #52103
• Split pkg/workflow/compiler_types.go by lifecycle: options, mutators, types by @pelikhan with @Copilot in #52109
• Tighten SPDD compliance specs and fixtures by @pelikhan with @Copilot in #52111
• Degrade unreachable non-critical MCP servers instead of aborting gateway startup by @pelikhan with @Copilot in #52075
• Improve test quality in compiler_file_size_test.go by @pelikhan with @Copilot in #52129
• Fix error message compliance in runs_on_validation, frontmatter_extraction_metadata, reactions, call_workflow_validation, and ambient_folders by @pelikhan with @Copilot in #52177
• Fix error message compliance in 5 pkg/workflow files by @pelikhan with @Copilot in #52180
• Fix error message compliance: pre-activation jobs, GitHub tools validation, evals config, spec, and package manifest files by @pelikhan with @Copilot in #52179
• Raise error-message compliance for sandbox and workflow run validation paths by @pelikhan with @Copilot in #52176
• [docs] docs: unbloat troubleshooting common issues by @github-actions[bot] in #52189
• Give the four log-entry structs a shared LogEntry interface by @pelikhan with @Copilot in #52107
• Deduplicate declarative constraint builders in tool_description_enhancer.go by @pelikhan with @Copilot in #52157
• Deduplicate safe-output parser wrapper boilerplate with parseConfigScaffoldWithPostProcess by @pelikhan with @Copilot in #52158
• [model-inventory] Add missing MAI-Code model entry and correct Copilot cache-read pricing by @pelikhan with @Copilot in #52191
• Fix error message compliance in 5 low-scoring pkg/workflow files by @pelikhan with @Copilot in #52178
• Raise error-message compliance for workflow validation batch (5 files) by @pelikhan with @Copilot in #52174
• Base full-mode patch/bundle on GITHUB_SHA when running from a non-default branch by @pelikhan with @Copilot in #52164
• Fix package README error lint failure by @pelikhan with @Copilot in #52196
• Add direct Ollama inference preflight and failure diagnostics by @pelikhan with @Copilot in #52197
• Fix PR context renderer test assertion by @pelikhan with @Copilot in #52201
• Retry cold-start Claude connection refusals as fresh runs by @pelikhan with @Copilot in #52198
• [docs] docs: trim repetitive sections in cost management reference by @github-actions[bot] in #52393
• docs: note that non-default labels must exist before running the triage workflow by @pelikhan with @Copilot in #52376
• Route PR code-quality reviews through the Copilot gateway by @pelikhan with @Copilot in #52377
• [instructions] Sync instruction files with release v0.86.2 by @github-actions[bot] in #52262
• [eslint-miner] eslint-factory: add require-sync-exec-timeout rule by @github-actions[bot] in #52265
• [spec-extractor] Update package specifications: pkg/cli README type coverage by @github-actions[bot] in #52271
• [docs] Update glossary - daily scan by @github-actions[bot] in #52274
• [purelock] Lock down parseSamplesValue, ErrorSeverity.Heading, ErrorSeverity.Icon with pure-function test suites by @github-actions[bot] in #52295
• Reduce pkg/workflow largefunc backlog via frontmatter parser helper extraction by @pelikhan with @Copilot in #52219
• Use static GraphQL query constants in project_command.go by @pelikhan with @Copilot in #52378
• Use ctxutil for nil context fallbacks by @pelikhan with @Copilot in #524...