Update github/gh-aw action to v0.68.3#27334
Merged
renovate[bot] merged 1 commit intomainfrom Apr 18, 2026
Merged
Conversation
github-actions
bot
added
the
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #27334 +/- ##
==========================================
- Coverage 73.39% 73.39% -0.01%
==========================================
Files 1553 1553
Lines 125017 125017
Branches 15097 15097
==========================================
- Hits 91761 91757 -4
- Misses 32232 32255 +23
+ Partials 1024 1005 -19
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
renovate
bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
5 times, most recently
from
cc44eef to
68b128f
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
10 times, most recently
from
2454881 to
5b10c33
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
3 times, most recently
from
a9227ff to
ece0cf9
Compare
Contributor
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 24506367937 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
renovate
bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
7 times, most recently
from
3427efb to
67c9412
Compare
renovate
bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
6 times, most recently
from
2b08f5b to
5354fed
Compare
Contributor
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 24573600298 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
renovate
bot
force-pushed
the
renovate/github-gh-aw-0.x
branch
from
5354fed to
7e011fe
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.67.1→v0.68.3Release Notes
github/gh-aw (github/gh-aw)
v0.68.3Compare Source
🌟 Release Highlights
This release delivers a major overhaul of
push_signed_commits.cjsfor edge-case reliability, significant improvements to shared workflow imports, smarter AI model error handling, and a wave of community-driven fixes.✨ What's New
checkoutfield in shared imports — Shared importable workflows now support acheckoutfield, giving you control over which ref is checked out when importing a shared workflow. (#26292)envfield in shared imports — You can now pass environment variables viaenv:in shared import blocks, eliminating the need for workarounds when shared workflows require custom env context. (#26113)gh aw auditandgh aw logsnow report Time Between Turns, a key indicator of whether LLM prompt caching is effective for your workflows. (#26321)🐛 Bug Fixes & Improvements
push_signed_commits.cjs— five targeted fixes:--topo-orderand merge commits are handled with agit pushfallback. (#26306)git pushinstead of erroring. (#26298)Other notable fixes:
on.github-tokenpropagated to activation job — Cross-orgworkflow_callsetups no longer fail because the GitHub token was missing from checkout and hash-check steps. (#26137)copilot-driver --resumeauth recovery — Authentication failures during--continue/--resumeare now handled instead of crashing the driver. (#26146)add_commentgainsreply_to_id— Thereply_to_idparameter is now documented in the MCP tool schema so agents reliably pass it when threading replies. (#26288)safe-outputs.actionstools exposed — Custom action tools defined insafe-outputs.actionsare now included in the agent's MCP toolset. (#26291)engine.max-turnspreserved through shared imports — Themax-turnssetting no longer silently drops when the engine config is sourced from a shared import. (#26122)gh aw compile --validate— Validation now skips Docker image checks when Docker is unavailable; opt in with--validate-imageswhen needed. (#26074)GH_HOSTenv var used for GH CLI calls —gh repo viewandgh pr createnow respectGH_HOST, fixing failures in GHES and cross-org contexts. (#26311)resolveIssueNumberstrips stray quotes — Item numbers wrapped in quotes no longer cause resolution failures. (#26114)--safe-updaterenamed to--approve— The flag name now more clearly conveys its intent. (#26160)📚 Documentation
github-appdocumented as a top-level Allowed Import Field in the imports reference. (#26119)working-directorynavigation example in the side-repo-ops pattern. (#26123)🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release!
@arthurfvives@bbonafed@corygehradd-comment:reply_to_idnot documented in tool schema, causing agents to skip it (direct issue)@susmahadsafe-outputs.actionscustom action tools not exposed to agent MCP toolset (direct issue)@tadelesh@wtgodbeitem_numbervalues (direct issue)@yskopetsgh aw compile --validate(direct issue)For complete details, see CHANGELOG.
What's Changed
gh pr checkoutfailing with GH_HOST mismatch in issue_comment workflows by @Copilot in #26037hippo --versioncheck by @Copilot in #26112github-appto Allowed Import Fields in imports reference by @Copilot in #26119envfield in shared imports by @Copilot in #26113gh pr checkoutwithgit fetch refs/pullto avoid GH_HOST issues by @dsyme in #26136reply_to_idtoadd_commentMCP tool schema by @Copilot in #26288compiler_safe_outputs_config.goby concern by @Copilot in #26297gateway_logs.gointo concern-aligned files by @Copilot in #26296frontmatter_types.gointo types, parsing, and serialization files by @Copilot in #26305Full Changelog: github/gh-aw@v0.68.2...v0.68.3
v0.68.2Compare Source
🌟 Release Highlights
This release delivers a focused wave of reliability improvements: compiler fixes that were blocking real workflows, expanded strict-mode flexibility, deeper temporary ID support, and a new
integrity-reactionsfeature for fine-grained trust control. A huge batch of community-reported bugs across Copilot engine, safe-outputs, cross-org workflows, and MCP Gateway are now resolved.✨ What's New
Reaction-based integrity control — The new
integrity-reactionsfeature flag (requires MCPG ≥ v0.2.18, now bundled as v0.2.19) lets maintainers promote or demote tool-use integrity via 👍/❤️ and 👎/😕 GitHub reactions in proxy mode. Configurable endorsement and disapproval reaction sets with sensible defaults. Learn moreTemporary ID resolution now reaches further —
#temporary_idreferences are now resolved insidedispatch_workflowinput values,update_issue/add_commenttargets, andgit ampatch content — closing three long-standing gaps that required manual workarounds.Strict mode secrets unlocked — Strict mode now permits
secrets.*in step-levelwith:bindings for action steps in pre-agent custom steps, and in stepenv:bindings — giving workflows a secure path to external secret managers without disabling strict mode entirely.slash_commandevent scoping — A newscopeoption lets workflows restrict which event types (issue comment, PR comment, etc.) trigger slash commands, reducing noise from unintended contexts.assign_to_agentmulti-platform support — Copilot can now be assigned to the same issue multiple times when each assignment targets a differentpull_request_repo(e.g., separate iOS and Android repositories), enabling true cross-platform agentic workflows.workflows: writeauto-inferred — The compiler now automatically infers theworkflows: writepermission when a GitHub App token'sallowed-filestargets.github/workflows/, eliminating a confusing manual step.🐛 Bug Fixes & Improvements
create_issuerate-limit resilience — Added retry with jitter to thecreate_issuesafe-output handler, preventing HTTP 403 failures when multiple daily workflows complete simultaneously and burst the API rate limit.create_pull_requestENOBUFS crash — Fixed aspawnSyncbuffer overflow that causedcreate_pull_requestto fail on large diffs; the safe-output handler no longer crashes on oversized payloads.create_pull_request_review_commenttool not found — Resolved a runtime registration issue where thecreate_pull_request_review_commentsafe-output tool was declared but not discoverable at runtime.Copilot engine workflows restored — Fixed two distinct failures introduced in v0.67.2–v0.67.4 that broke Copilot-engine workflows; plus resolved silent
exit code 1errors in the compiled Copilot CLI.Compiler:
--allow-domainsquoting fixed — The compiler no longer single-quotes--allow-domainsvalues, which was breaking$\{\{ }}GitHub Actions expressions and causing HTTP 422 errors on workflow dispatch.inputs.*expressions inworkflow_call— Expressions usinginputs.*in prompt bodies are now properly resolved when a workflow is invoked viaworkflow_call.OIDC env vars forwarded to MCP Gateway — The compiler now forwards
ACTIONS_ID_TOKEN_REQUEST_URLand related OIDC env vars to thedocker runcommand for the MCP Gateway, enabling OIDC-based authentication flows.MCP servers on GitHub Enterprise Server — Improved documentation and policy guidance for organizations where the "MCP servers in Copilot" policy is not visible in GHE settings.
SARIF upload permissions — Fixed
Resource not accessible by integrationerrors during SARIF upload by correctly provisioning the requiredsecurity-events: writepermission.Cross-org
workflow_call— Resolved failures inresolve_host_repo, checkout, and hash checks when invoking workflows across organization boundaries.push_repo_memorybot-comment guard — Fixed a bug where thepush_repo_memoryjob ran even when the workflow was triggered by a bot comment that skippedpre_activation.ParseWorkflow ~18% faster — Eliminated a JSON round-trip in schema validation and optimized node traversal, reducing workflow parse time by ~18% with ~22% fewer allocations.
🌍 Community Contributions
A huge thank you to the community members who reported issues that were resolved in this release!
@apenab@bbonafeddocker runcommand (direct issue)@benvillalobosinputs.*expressions in prompt body not resolved when called viaworkflow_call(direct issue)@bryanchen-d--allow-domainsbreaking$\{\{ }}GA expressions, causing HTTP 422 on workflow dispatch (direct issue)@camposbrunocampos@corygehr@devantlerworkflows: writeon GitHub App tokens whenallowed-filestargets.github/workflows/(direct issue)update_issueandadd_commenttargeting (direct issue)@JanKrivanek@johnpreed@kbreit-insight@neta-vega@susmahad@theletterf@wtgodbegit am(direct issue)@yskopetsFor complete details, see CHANGELOG.
What's Changed
inputs.*expressions not resolved when workflow invoked viaworkflow_callby @Copilot in #25718--allow-domainsargs containing${{ }}expressions by @Copilot in #25721logsMCP tool writing cache to inaccessible/tmp/gh-aw-logs-cache/by @Copilot in #25777buildInputSchemahelper to deduplicate input-schema generation by @Copilot in #25795allow-workflowsfield for GitHub Appworkflows:writepermission on safe-outputs by @Copilot in #25817engine:types by @Copilot in #25821gh-aw.event_namespan attribute to OTel setup and conclusion spans by @Copilot in #25856git amby @Copilot in #25899integrity-reactionsfeature flag for MCPG reaction-based integrity promotion/demotion by @Copilot in #25948logs-token-checkjob, standardize artifact retention by @Copilot in #26046Configuration
📅 Schedule: (in timezone Etc/UTC)
* * * * 0,6)* 0-12 * * 1)* 21-23 * * 1-5)* 0-4 * * 2-6)* * * * 0,6)* 0-12 * * 1)* 22-23 * * 1-5)* 0-4 * * 2-6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.