Skip to content

ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.87.3 - #90

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github/gh-aw/actions/setup-0.87.3
Open

ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.87.3#90
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github/gh-aw/actions/setup-0.87.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps github/gh-aw/actions/setup from 0.81.6 to 0.87.3.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.87.2

🌟 Release Highlights

This release strengthens sandbox security defaults, improves package/workflow update reliability, and ships a batch of linter, docs, and CI reliability fixes.

✨ What's New

  • External threat detection enabled by default (#54111) — workflows now get proactive threat-detection coverage out of the box, improving baseline security posture without extra configuration.
  • Cloud Hypervisor adopted across 58 agentic workflows (#54346) — broader migration improves sandbox isolation and reliability for agentic runs.
  • Scoped ownership for package resources (#54120) and re-resolved manifests during workflow updates (#54119) — package dependencies stay accurate and correctly scoped as workflows evolve.
  • New manualpathconcat linter (#54307) flags manual / path concatenation, catching a common class of path-handling bugs at compile time.
  • Support for runner groups in custom safe jobs (#53977) gives more control over where custom safe-output jobs execute.

🐛 Bug Fixes & Improvements

  • Fixed the logs MCP tool silently truncating explicit date-range queries to a single stale day with no warning (#54110).
  • Fixed safe-output inline-backtick neutralization (#54103) and JSON-array expressions in approve-workflow-run safe outputs (#53812).
  • Fixed a false-positive heredoc detection on bare (( )) arithmetic in the generatedyamlheredoc linter (#53991).
  • Hardened command argument validation for pip/uv checks and npm lockfile execution (#53957), and added regression coverage for pip argv validation before exec (#54282).
  • Fixed schedule-triggered workflow false positives and improved root-cause surfacing for disabled workflows in the health monitor (#53881).
  • Fixed approve_workflow_run handler load failure caused by an npm minimatch require (#54281).
  • Fixed actionlint error from an agent job referencing needs.approval_allowlist without a declared dependency (#54028).
  • Restored GHES-compatible artifact action pins (#53966) and hardened post-agent cache Git commits (#53879).

📚 Documentation

  • Clarified lock files and workflow setup commands (#54342), documented compiler-generated job authentication (#54100), and made Copilot auth docs easier to scan (#54337).
  • Documented PR fast-track triage criteria (#53880) and closed non-Copilot engine parity gaps for gh aw init and custom engine frontmatter (#53834).
  • Added workflow wizard links to documentation (#53862) and unbloated the network and safe-outputs PR references (#54104, #53875).> Generated by 🚀 Release · auto · 16.2 AIC · ⊞ 11.7K

What's Changed

... (truncated)

Commits
  • 466b8ad Add npm registry access to daily-rendering-scripts-verifier network allowlist...
  • 734f391 Add actionable guidance to shell completion rc-path errors (#54672)
  • d52203c Add step-level failure attribution to Detection Analysis Report (Rule 3) (#54...
  • 6d315d0 Include file path in pkg/parser wrapper errors (#54648)
  • d11b06c [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe subtests...
  • 8dcf606 Paginate daily performance data through its 90-day window (#54679)
  • 2512707 docs: unbloat workflow structure reference (#54676)
  • 80a44d7 [WIP] Fix failing GitHub Actions job js-integration-live-api (#54650)
  • 03f65d8 Add regression coverage for CLI strict-mode default (#54657)
  • 0923f14 Fail compilation when safe-outputs step-output token references cannot resolv...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/gh-aw/actions/setup](https://github.com/github/gh-aw) from 0.81.6 to 0.87.3.
- [Release notes](https://github.com/github/gh-aw/releases)
- [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw@eed4304...466b8ad)

---
updated-dependencies:
- dependency-name: github/gh-aw/actions/setup
  dependency-version: 0.87.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: area/ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the type/chore Maintenance and housekeeping label Aug 24, 2026
@dependabot
dependabot Bot requested a review from zircote as a code owner August 24, 2026 16:24
@dependabot dependabot Bot added the type/chore Maintenance and housekeeping label Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type/chore Maintenance and housekeeping

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants