[actions] Update GitHub Actions versions - 2026-07-30

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Overview

Routine GitHub Actions and container-image pin refresh, combined with optimizations to the gh aw update command to reduce redundant GitHub API calls, clearer failure summaries, and hardened CI tests that were flaky due to golden-file drift and auth-dependent gh CLI calls.

What changed

Action & container pin updates

• Bumped astral-sh/setup-uv v8.3.2 → v9.0.0, docker/login-action v4.4.0 → v4.6.0 (including in .github/workflows/release.md), github/codeql-action/upload-sarif v4.37.3 → v4.37.4, ruby/setup-ruby v1.314.0 → v1.321.0.
• Removed stale gh-aw-firewall 0.27.41 container pins (agent-act, agent, api-proxy, cli-proxy, squid) now superseded by 0.27.42, and removed gh-aw-mcpg v0.4.5 (superseded by v0.4.6).
• Updated container digests for grafana/mcp-grafana, mcp/markitdown, mcp/notion, node:lts-alpine, python:alpine, semgrep/semgrep:latest.
• Applied identically to both pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json, which are kept in lockstep.

API request caching in update command

• Added newCachedActionUpdateDeps (pkg/cli/update_actions.go): a sync.Mutex-protected memoization wrapper around getLatestRelease, runGHReleasesAPI, getActionSHAForTag, and checkCoolDown, keyed by repo/version/tag. RunUpdateWorkflows now builds one shared instance and threads it through both the actions-lock.json update path and the workflow Markdown action-ref update path (renamed updateActions/updateActionsInWorkflowFiles, the latter now taking an updateActionsOptions struct).
• validateUpdateSHAEntriesWithResolvers (pkg/cli/update_validation.go) now deduplicates verifyActionCommitExists and resolveActionVersionToSHA calls via in-memory maps keyed by base-repo+SHA and base-repo+version, so subpath variants sharing the same repo (e.g. actions/cache, actions/cache/restore, actions/cache/save) are checked once instead of once per entry.
• getRepoDefaultBranchCached and getLatestBranchCommitInfoCached (pkg/cli/update_workflows.go) now cache errors as well as successes (cachedDefaultBranch, cachedBranchCommit structs), so a repeatedly-erroring repo lookup no longer re-hits the network on every call within a run.
• New printUpdateInfoOnce + updateNoticeCache suppress duplicate cooldown-skip info messages within a single update run.

Failure summary / messaging improvements

• showUpdateSummary (pkg/cli/update_display.go) gained a noCompile bool parameter, prints "Updated" vs "Updated and compiled N workflow(s)" accordingly, and now groups failed updates via new groupUpdateFailures/compactUpdateFailureReason into a compact table (via console.RenderStruct) instead of one raw line per failure. SAML-and-rate-limit failures are collapsed into a single reason: "SAML-restricted authenticated access; anonymous GitHub API fallback is rate-limited".
• Warning messages in RunUpdateWorkflows reworded from "Warning: Failed to update X" to "Could not update X" for actions-lock.json, workflow action refs, container pins, and post-pin recompilation.
• Removed a now-redundant explicit "All workflow updates skipped due to GitHub API rate limiting" print (the caller already returns nil silently in that case).

Test hardening

• TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent and TestFallbackAWFilesMatchesLocalAWDirectory (pkg/cli/copilot_agents_test.go) now auto-write out-of-sync golden files (checked-in SKILL.md, fallback AW file list JSON) and fail with a message telling the developer to commit and re-run, instead of only failing with a diff.
• New setupFakeGHForViewing helper (pkg/cli/view_command_test.go) installs a no-op fake gh binary on PATH for view-command tests, preventing real gh CLI auth failures in CI when tests use synthetic run IDs.
• TestApplyContainerPins (pkg/workflow/docker_pin_test.go) now derives its expected node:lts-alpine pin from getEmbeddedContainerPin instead of a hardcoded digest literal, so it no longer breaks on every pin bump.
• Added TestCachedActionUpdateDepsCachesResultsAndErrors and TestValidateUpdateSHAEntries_DeduplicatesActionSubpathChecks covering the new caching/dedup behavior.

Why

Regular dependency-pin maintenance, plus reducing repeated GitHub API calls during gh aw update runs (which was causing SAML/rate-limit failures on large workflow sets), clearer failure reporting, and eliminating CI test flakiness caused by golden-file drift and unauthenticated gh CLI calls in test environments.

Generated by PR Description Updater for #49097 · auto · 119.4 AIC · ⊞ 6.8K · ◷

[pelikhan]

@copilot run pr-finisher skill

[Copilot]

@copilot run pr-finisher skill

PR finisher complete. Here's what was done:

Issue found and fixed: The original PR commit updated the docker/login-action key in actions-lock.json from v4.4.0 → v4.6.0, but release.md still referenced @v4.4.0. This caused check-workflow-drift to fail (SHA resolution falls through without the cache key). Fixed by updating release.md to docker/login-action@v4.6.0 and regenerating release.lock.yml with the pinned SHA (dbcb813823bdd20940b903addbd779551569679f).

Also committed:

• All 266 workflow lock files regenerated with updated container image pins (0.27.41→0.27.42, mcpg v0.4.5→v0.4.6)
• pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json synced from updated actions-lock.json

Local validations: make fmt ✅ · make lint ✅ · make test-unit (full suite) ✅ · make check-workflow-drift (all 266 workflows in sync) ✅

---

• ✅ Reviews — no open review threads
• ✅ Checks (local) — all make targets green
• ❓ Checks (CI) — stale after agent push; needs human re-trigger. Prior failures: not applicable (checks were in-progress before this run)
• ✅ Mergeable — open, not draft, no conflicts

Hand-off: CI must be re-triggered by a maintainer (close/reopen PR, workflow_dispatch, or push) before merge.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Merge conflicts resolved. Merged origin/main into the branch — all 266 .lock.yml conflicts were resolved by accepting main's version and then regenerating with make recompile so the updated action pins from actions-lock.json are properly reflected. All workflows compile clean (266/266) and make check-workflow-drift passes.

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot please run the pr-finisher skill, then resolve the merge conflicts on this branch, refresh the PR so it is mergeable again, and rerun any needed checks.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 19.4 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

The PR is already in a merge-ready state from the previous passes:

• Reviews — no open review threads
• Checks (local) — make fmt / make lint / make test-unit / make recompile all pass; 266/266 workflows compile with 0 errors, lock files in sync with markdown sources
• Checks (CI) — stale after agent push; a CI run appears to have started (copilot job #90825446396). Once it completes it will reflect the current HEAD. Prior to this run, no CI failures were actionable.
• Mergeable — open, not draft, branch is up to date with main (merged in the previous pass at 04a3ad8)

The threat detection engine error in the PR Sous Chef comment is a tooling failure (not a security finding) and does not block merge.

Hand-off: A maintainer needs to confirm CI passes and approve before merging.

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Hey 👋 — thanks for keeping our GitHub Actions and container pins up-to-date! Here are some observations:

What looks good:

• ✅ Clear, detailed PR description with version mappings and rationale
• ✅ Properly focused on dependency updates (actions-lock.json and workflow lock files)
• ✅ Comprehensive notes on process and pre-existing drift issues

Things to consider:

• New dependencies — This PR updates action versions and container image pins (astral-sh/setup-uv v9.0.0, docker/login-action v4.6.0, etc.). Since these are dependency updates, any breaking changes should be verified.
• No test coverage — Consider whether this should include a smoke test or verification step in your CI to ensure the updated versions do not cause workflow failures.

For the team: This appears to be an automated maintenance PR from the Daily Workflow Updater workflow, so the standard contribution process does not apply. If this is a regular, trusted automation, consider documenting it in your workflow docs so reviewers understand its automated nature.

Generated by ✅ Contribution Check · auto · 48.3 AIC · ⊞ 8.7K · ◷

[pelikhan]

@copilot review tests ni https://github.com/github/gh-aw/actions/runs/30532134929/job/90837024084?pr=49097 and harden them so that they are resilient to actions lock changes

[Copilot]

@copilot review tests ni https://github.com/github/gh-aw/actions/runs/30532134929/job/90837024084?pr=49097 and harden them so that they are resilient to actions lock changes

Done in commit fix: harden skill/fallback tests to auto-update golden files when out of sync.

Root cause of the CI failure: TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent failed because the merge from main brought in 3 new .github/aw/*.md files (github-mcp-server-pagination.md, syntax-engine.md, token-optimization-caching-budgets.md) that weren't reflected in the checked-in SKILL.md or the fallback JSON at the time CI ran.

Two changes made:

1. pkg/cli/data/agentic_workflows_fallback_aw_files.json — updated to include the 3 new files (was 61 entries, now 64).

2. Both golden-file tests hardened to auto-update their checked-in files when out of sync, instead of failing with only a comparison dump:

   • TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent: auto-writes .github/skills/agentic-workflows/SKILL.md when stale, then fails with "was out of sync and has been regenerated; commit … and re-run"
   • TestFallbackAWFilesMatchesLocalAWDirectory: auto-writes pkg/cli/data/agentic_workflows_fallback_aw_files.json when stale, with an equivalent message

Both tests still fail when there is drift (CI will catch it), but the fix is now self-applying — a developer just commits the auto-updated file and re-runs.

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot please run the pr-finisher skill, address the failing checks below, and push any required fixes.

Failed checks:

• impacted-go-tests
• Unit tests (A-C)
• Unit tests (S-Z and other)

Please summarize the root cause and remediation in your follow-up.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.69 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Fixed in commit fix: harden audit/view tests with fake gh binary to prevent CI auth failures.

Root cause: TestAuditCachingBehavior and the four TestViewWorkflowRun_* tests were reaching the gh run download call inside downloadRunArtifacts, which failed with "GitHub CLI authentication required" in CI where synthetic run IDs don't exist. The expected early-return path (dir non-empty → skip download) was not consistently triggered due to parallel test execution (-parallel=8) and tmpfs behaviour in CI runners.

Fix: Added a setupFakeGHForViewing(t) helper to view_command_test.go and inline fake gh setup to TestAuditCachingBehavior in audit_test.go. Both install a no-op gh binary (exits 0 for any command) into a temp dir prepended to PATH via t.Setenv, matching the existing pattern in logs_download_test.go. This ensures downloadRunArtifacts completes without error regardless of which path is taken.

Local validation: all 5 previously-failing tests now pass · make agent-report-progress green (fmt ✅ lint ✅ test-unit ✅ recompile ✅ 266/266 workflows).

Still needed: a maintainer to re-trigger CI after this push to confirm the fix in the CI environment.

[gh-aw-bot]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot please run the pr-finisher skill, address the failing checks below, and rerun the necessary tests once the branch is up to date.

Failed checks:

• impacted-go-tests
• Build & Test on macos-latest
• Unit tests (A-C)
• Unit tests (M-R)

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.6 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

[!WARNING]
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding....

Fixed in commit fix: harden tests to be resilient to container pin and branch cache changes.

Root causes and fixes:

1. TestApplyContainerPins/embedded_pin_used_when_cache_is_absent (pkg/workflow): Hardcoded SHA sha256:2bdb65... for node:lts-alpine was stale after actions-lock.json updated the digest to sha256:a0b9bf.... Fixed by using getEmbeddedContainerPin("node:lts-alpine") to look up the pin dynamically, matching the pattern already used for the firewall agent test case.

2. TestResolveRedirectedUpdateLocation/resolves_default_branch_via_API_when_source_omits_ref (pkg/cli): Test stored a plain string "trunk" in defaultBranchCache, but getRepoDefaultBranchCached type-asserts to cachedDefaultBranch struct. The assertion silently failed, causing a real API call that returned "main" as fallback. Fixed by storing cachedDefaultBranch{branch: "trunk"}.

3. Build & Test on macos-latest: scripts/sync-compat.sh used grep -oP (GNU/Perl regex), which macOS BSD grep rejects with invalid option -- P, breaking make build. Fixed by replacing with a portable sed -n 's/…/\1/p' expression.

Local validation: make fmt ✅ · make lint ✅ · make test-unit ✅ · make recompile ✅ · 266/266 workflows in sync.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.1