Add PowerShell installer path for gh-aw and cover it in Windows CI

[Copilot]

Windows installation relied on the bash installer path even though the project already ships Windows binaries. This change adds a native PowerShell installer, routes the setup action through it on Windows, and exercises that path in CI.

• Installer

  • Add install-gh-aw.ps1 as the PowerShell equivalent of install-gh-aw.sh
  • Preserve the same install contract: version selection, optional gh extension install fast path, checksum verification, latest-release fallback, and post-install verification
  • Sync the canonical script into actions/setup-cli/install.ps1 during make build

• Setup action

  • Update actions/setup-cli/action.yml to use:
    • install.ps1 on Windows runners
    • install.sh on non-Windows runners
  • Keep the existing action inputs and outputs unchanged

• CI coverage

  • Extend .github/workflows/install.yml with a dedicated Windows PowerShell install job
  • Exercise both:
    • dry-run/platform-detection behavior
    • full install flow for the Windows binary

• Repo wiring

  • Mark actions/setup-cli/install.ps1 as generated in .gitattributes
  • Extend setup-cli integration coverage to assert the new script exists, is synced, and is referenced by the action
  • Document PowerShell install usage, including pinned-version invocation

Example PowerShell usage:

Invoke-WebRequest https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.ps1 -OutFile install-gh-aw.ps1
pwsh -File ./install-gh-aw.ps1 v0.1.0

---

Generated by 👨‍🍳 PR Sous Chef · 4.72 AIC · ⌖ 6.03 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

[github-actions]

Thanks for the detailed PR — the Windows installer path and CI coverage are clearly relevant to gh-aw. However, this repository's contribution process requires pull requests to be opened by core team members (MEMBER/OWNER/COLLABORATOR). This PR is authored by a non-core contributor account (CONTRIBUTOR), so it is off-guidelines for this project.

Please move the proposal into an issue or hand it off to a core team member to open and implement via the project's agentic workflow. The PR description and test coverage are helpful and can be reused in that issue.

Please convert this PR into an issue-oriented agentic plan for github/gh-aw.
Include:
1. Problem statement and why Windows needs a native PowerShell installer path.
2. Proposed implementation scope:
- add install-gh-aw.ps1
- sync to actions/setup-cli/install.ps1 during build
- route setup action by platform
- extend Windows CI coverage
- update related docs/tests
3. Acceptance criteria and validation steps.
4. Any risks or follow-up questions for the core team.
Do not open a PR directly; prepare the issue so a core team member can pick it up.

Generated by ✅ Contribution Check · 76.5 AIC · ⌖ 16.5 AIC · ⊞ 6.2K · ◷

[Copilot]

Pull request overview

Adds native PowerShell installation support and routes Windows setup-action usage through it.

Changes:

• Adds and synchronizes the PowerShell installer.
• Adds Windows-specific action routing and CI coverage.
• Updates installer documentation and integration checks.

Show a summary per file

File	Description
install-gh-aw.ps1	Implements the canonical PowerShell installer.
actions/setup-cli/install.ps1	Generated installer copy for the action.
actions/setup-cli/action.yml	Selects PowerShell on Windows.
.github/workflows/install.yml	Adds Windows installer CI coverage.
pkg/cli/setup_cli_action_integration_test.go	Checks PowerShell script wiring and synchronization.
Makefile	Synchronizes both installer scripts.
.gitattributes	Marks the generated PowerShell script.
docs/src/content/docs/setup/cli.md	Documents PowerShell installation.
actions/setup-cli/README.md	Documents generated installer development.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 9/9 changed files
• Comments generated: 10
• Review effort level: Medium

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #44953 does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (60 additions, threshold 100).

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

[github-actions]

🧪 Test Quality Sentinel Report

⚠️Test Quality Score: 73/100 — Acceptable

Analyzed 6 test(s): 5 design, 1 implementation, 0 violation(s).

📊 Metrics (6 tests)

Metric	Value
Analyzed	6 (Go: 6, JS: 0)
✅ Design	5 (83%)
⚠️ Implementation	1 (17%)
Edge/error coverage	2 (33%)
Duplicate clusters	0
Inflation	No
🚨 Violations	0

Test	File	Classification	Issues
powershell_script_supports_input_version_env	setup_cli_action_integration_test.go	design_test	Happy-path only
powershell_script_has_gh_extension_install_logic	setup_cli_action_integration_test.go	design_test	Happy-path only
powershell_script_has_checksum_validation	setup_cli_action_integration_test.go	implementation_test	String-literal match on cmdlet name
powershell_script_synced_from_install_gh_aw	setup_cli_action_integration_test.go	design_test	✅ Catches sync regressions
TestSetupCLIActionYAML — Windows runner	setup_cli_action_integration_test.go	design_test	✅ Verifies Windows CI path
TestSetupCLIActionYAML — install.ps1 reference	setup_cli_action_integration_test.go	design_test	✅ Verifies action configuration

⚠️ Flagged Tests (1)

powershell_script_has_checksum_validation (setup_cli_action_integration_test.go) — implementation_test. Checks for the string Get-FileHash (a specific PowerShell cmdlet name) rather than verifying the security invariant behaviorally. Consider asserting on the functional contract (e.g., that checksum mismatch causes the script to exit with a non-zero code) or at minimum assert on a higher-level token that describes intent rather than implementation.

Verdict

✅ Passed. 17% implementation tests (threshold: 30%). The new tests cover the PowerShell installer path adequately — INPUT_VERSION support, gh extension install logic, and sync-with-root invariants are all meaningful behavioral contracts. Edge-case coverage is limited (no failure-path assertions), but acceptable for an integration test suite. No build-tag violations or mock-library usage detected.

References:§29154650935

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "awmgmcpg"

See Network Configuration for more information.

🧪 Test quality analysis by Test Quality Sentinel · 30.4 AIC · ⌖ 12.9 AIC · ⊞ 6.8K · ◷
_{Comment /review to run again}

[github-actions]

✅ Test Quality Sentinel: 73/100. 17% implementation tests (threshold: 30%).

[github-actions]

Review: Add PowerShell installer for gh-aw

The overall approach is solid — native PowerShell installer with feature parity to the bash script, proper platform detection, checksum verification, and Windows-specific timeout handling.

Blocking Issue

$output -notmatch on an array is not a boolean check (.github/workflows/install.yml, dry-run test step).

When & ./install-gh-aw.ps1 v999.999.999 2>&1 is assigned to $output, the variable is a PowerShell array (strings + ErrorRecord objects). Applying -notmatch to an array filters elements rather than returning a boolean. Since many output lines will not contain "Detected OS:", the filter returns a non-empty array — which is always truthy — so the throw fires unconditionally even when detection succeeds. This makes the dry-run test permanently broken.

Fix: join $output into a single string before the -notmatch checks:

$outputStr= ($output|Out-String)
if ($outputStr-notmatch"Detected OS:") { throw"OS detection failed" }
if ($outputStr-notmatch"Detected architecture:") { throw"Architecture detection failed" }
if ($outputStr-notmatch"Platform:") { throw"Platform string construction failed" }

Non-blocking Notes

• The PowerShell script itself (install-gh-aw.ps1) is well-structured with good error handling, retry logic, checksum verification, and Windows Defender timeout awareness.
• The action.yml routing (runner.os == 'Windows' → PowerShell, otherwise Bash) is correct.
• The Go integration tests for install.ps1 are reasonable sanity checks.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · 69.5 AIC · ⌖ 4.55 AIC · ⊞ 4.8K

[github-actions]

Skills-Based Review 🧠

Applied /tdd, /codebase-design, and /grill-with-docs — requesting changes on 4 issues.

📋 Key Findings & Highlights

Issues to Address

1. installed_version reports "latest" verbatim (install-gh-aw.ps1, end of file) — the gh-extension fast-path correctly emits the resolved semver; the manual-download fallback does not. Consumers of the action output will receive the literal string "latest" instead of a tag like v0.4.2.

2. Asymmetric TryGhInstall activation (install-gh-aw.ps1, line ~20) — INPUT_VERSION auto-enables the gh-extension fast path; a positional version argument does not. Direct callers miss the fast path entirely.

3. PowerShell lines inside a bash fence (docs/src/content/docs/setup/cli.md, lines 56–57) — incorrect syntax highlighting, misleads copy-pasters.

4. Duplicated timeout helper in CI (.github/workflows/install.yml, lines 75–97) — Invoke-WithTimeout duplicates Invoke-ProcessWithTimeout from the installer, creating a maintenance burden.

Positive Highlights

• ✅ Checksum verification with graceful degradation
• ✅ Retry with exponential backoff
• ✅ Thoughtful Windows Defender timeout handling
• ✅ Integration tests verify sync, feature presence, and action wiring
• ✅ make sync-action-scripts keeps canonical and action copies consistent

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 63 AIC · ⌖ 4.87 AIC · ⊞ 6.6K
_{Comment /matt to run again}

Comments that could not be inline-anchored

install-gh-aw.ps1:430

[/tdd]installed_version outputs the string "latest" instead of the resolved semver tag when no version is pinned — breaking consumers that parse the action output.

<details>
<summary>💡 Fix: resolve the tag before writing the output</summary>

The gh-extension fast-path already resolves the actual version and writes $installedVersion. The manual-download path should do the same. $LatestTag is already fetched from the API earlier in the script:

if ($env:GITHUB_OUTPUT…
</details><details><summary>install-gh-aw.ps1:20</summary>**[/tdd]** When `INPUT_VERSION` is set,`TryGhInstall` is silently forced to `true`, but passing a version as a positional argument does not enable the gh-extension fast path. This asymmetry means the behaviour of `./install-gh-aw.ps1 v1.2.3` differs from`INPUT_VERSION=v1.2.3 ./install-gh-aw.ps1`, which can surprise users calling the standalone script directly.
&lt;details&gt;
&lt;summary&gt;💡 Suggestion&lt;/summary&gt;
Either always set `TryGhInstall =$true` when any version is specified (positional or env…
</details><details><summary>docs/src/content/docs/setup/cli.md:57</summary>**[/grill-with-docs]** PowerShell commands are placed inside a `bash wrap` code fence — they will be syntax-highlighted and linted as Bash, confusing readers and tooling.
&lt;details&gt;
&lt;summary&gt;💡 Suggestion: split into separate fences by language&lt;/summary&gt;
```markdown
```bash
curl -sL https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.sh | bash

Invoke-WebRequest https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.ps1 -OutFile install-gh-aw.ps1
pwsh…
</details><details><summary>.github/workflows/install.yml:75</summary>**[/codebase-design]**`Invoke-WithTimeout`in the CI step is a near-copy of `Invoke-ProcessWithTimeout` inside the installer. Duplicating the function means any bug fix (e.g. in`Kill($true)`) must be applied in two places.
&lt;details&gt;
&lt;summary&gt;💡 Suggestion&lt;/summary&gt;
The CI verification step can simply call the installed binary directly — since the timeout function already lives inside the installer script, a thin wrapper at the CI level is sufficient:
```yaml
- name: Verify installed binary…
</details>

[github-actions]

REQUEST_CHANGES — Multiple blocking issues across the installer, the composite action output wiring, and the CI verification logic.

Blocking themes (must fix before merge)

Critical / High

1. Set-StrictMode crash (install-gh-aw.ps1 line 419): ($null + $null).Trim() throws PropertyNotFoundException whenever gh extension install produces no stdout/stderr. Crashes the installer in its own error-handling path.

2. CI dry-run is broken (install.yml line 45): Write-Host emits to PS stream 6; 2>&1 does not capture it. $output is always empty, so every -notmatch guard always fires — the dry-run step is permanently broken.

3. installed-version action output is always empty (action.yml line 190): composite action outputs require a value: mapping; neither install step has an id nor maps its output. The documented installed-version output resolves to empty string on all platforms.

4. No HTTP timeout (install-gh-aw.ps1 line 377): Invoke-WebRequest/Invoke-RestMethod calls have no -TimeoutSec, so stalled connections bypass all retry logic and hang indefinitely.

5. Checksum failure silently skips verification (install-gh-aw.ps1 line 536): a failed checksums.txt download is treated as a warning and the binary is installed unverified. An attacker can suppress checksums.txt to bypass integrity checks.

6. GITHUB_OUTPUT writes literal "latest" (install-gh-aw.ps1 line 632): when API tag resolution fails, the manual-install path writes installed_version=latest instead of a real semver tag.

Medium

7. Kill/read race (install-gh-aw.ps1 line 344): redirect files read before killed process fully exits — partial output risk on Windows.
8. CI accepts timeout as success (install.yml line 100): exit code 124 (timeout) is treated equivalently to exit 0, making binary verification vacuous.

Low

9. PowerShell commands in a Bash fence (docs line 641): wrong syntax highlighting.

🔎 Code quality review by PR Code Quality Reviewer · 101.6 AIC · ⌖ 5.65 AIC · ⊞ 5.4K
_{Comment /review to run again}

Comments that could not be inline-anchored

install-gh-aw.ps1:419

NullReferenceException crash under Set-StrictMode when gh produces no output: .Trim() is called on the result of $null + $null, which throws under Set-StrictMode -Version Latest (set at line 6), crashing the installer whenever gh runs silently.

<details>
<summary>💡 Suggested fix</summary>

Get-Content -Raw on an empty redirect file returns $null, not "". Under Set-StrictMode -Version Latest, calling .Trim() on $null throws PropertyNotFoundException. The same patter…

install-gh-aw.ps1:45

CI dry-run check will always fail: Write-Host emits to PowerShell's information stream (stream 6), but $output = & ./install-gh-aw.ps1 v999.999.999 2>&1 only redirects stdout (stream 1) and stderr (stream 2). The $output variable will be empty, making every -notmatch check evaluate against $null, and the if ($output -notmatch "Detected OS:") guard will always throw even when detection works.

<details>
<summary>💡 Suggested fix</summary>

Capture the information stream by redire…

actions/setup-cli/action.yml:190

installed-version output is never populated on Windows: the composite action declares installed-version as an output but neither step sets value:, so the output is always empty. The install script writes to $GITHUB_OUTPUT, but composite action outputs require an explicit value: mapping to expose a step's output to callers.

<details>
<summary>💡 Suggested fix</summary>

Give each install step an id and map the action output:

steps:
- name: Install gh-aw CLI (PowerShel…</details><details><summary>install-gh-aw.ps1:377</summary>**No HTTP timeout on `Invoke-WebRequest` — installer can hang indefinitely**: binary and checksum downloads use `Invoke-WebRequest` without `-TimeoutSec`, so a stalled connection blocks the installer forever with no recovery path.&lt;details&gt;&lt;summary&gt;💡 Suggested fix&lt;/summary&gt;The bash installer bounds downloads to 120 seconds (`--max-time 120`); match that here. Add `-TimeoutSec` to every `Invoke-WebRequest` call — in `Invoke-DownloadWithRetry` (line 377) and the checksums loop (line 530), an…</details><details><summary>install-gh-aw.ps1:536</summary>**Checksum download failure silently skips integrity verification**: if all 3 checksum download attempts fail, the installer emits a warning and continues installing the binary without verification — this is a security hole, not a recoverable warning.&lt;details&gt;&lt;summary&gt;💡 Suggested fix&lt;/summary&gt;A network attacker or CDN error could make `checksums.txt` unreachable while delivering a tampered binary. The current behavior lets that attack succeed silently.Unless `--skip-checksum` was explic…</details><details><summary>install-gh-aw.ps1:632</summary>**`GITHUB_OUTPUT` writes literal string `&quot;latest&quot;` instead of resolved version**: when no version is specified and the API tag resolution fails (line 474), `$Version` remains `&quot;latest&quot;`. At install completion, `installed_version=latest` is written to the output — any caller checking the output to pin or verify a version will get a useless sentinel value.&lt;details&gt;&lt;summary&gt;💡 Suggested fix&lt;/summary&gt;Resolve the actual installed version from the binary before writing to output, falling back to…</details><details><summary>install-gh-aw.ps1:344</summary>**Race condition: redirect files read immediately after `Kill()` without waiting for process exit**: `Process.Kill($true)` initiates termination asynchronously on Windows; the OS may not have flushed buffered I/O to the redirect files before `Get-Content` reads them, yielding partial or empty output.&lt;details&gt;&lt;summary&gt;💡 Suggested fix&lt;/summary&gt;After calling `Kill()`, wait for process exit before reading the redirect files:
```powershelltry { $process.Kill($true) $process.WaitForEx…</details><details><summary>.github/workflows/install.yml:100</summary>**CI test accepts timeout (exit 124) as a successful install verification**: `Invoke-WithTimeout` returning 124 means the binary timed out — not that it passed. Treating it as a non-failure makes it impossible for this test to distinguish a working binary from a hanging or crashing one.&lt;details&gt;&lt;summary&gt;💡 Suggested fix&lt;/summary&gt;At minimum, mark a timeout as a distinct warning rather than letting the step silently pass:
```powershell$versionExit = Invoke-WithTimeout -FilePath $binaryPath…</details><details><summary>docs/src/content/docs/setup/cli.md:641</summary>**PowerShell commands in a Bash code fence**: the two new `Invoke-WebRequest` lines are inside a ```bash``` fenced block, so rendered documentation applies Bash syntax highlighting and copy-as-bash context to PowerShell syntax.&lt;details&gt;&lt;summary&gt;💡 Suggested fix&lt;/summary&gt;Split into separate, language-tagged fences:
```markdown```bashcurl -sL https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.sh | bash # Latestcurl -sL https://raw.githubusercontent.com/githu…</details>

Done

[pelikhan]

@copilot fix issue see https://github.com/github/gh-aw/actions/runs/29153475200/job/86549694746#step:3:1

[Copilot]

@copilot fix issue see https://github.com/github/gh-aw/actions/runs/29153475200/job/86549694746#step:3:1

Fixed in commit Fix CI dry-run test, action outputs, installer timeouts, and docs. Here's a summary of what was addressed:

CI failure (dry-run step): The step was using 2>&1 which doesn't capture Write-Host output (PowerShell information stream 6). Changed to 6>&1 2>&1 and joined the result with ($output | Out-String) before matching so -notmatch gets a string rather than an array. Also removed $ErrorActionPreference = "Stop" from that step — the installer is expected to exit 1 when the fake v999.999.999 version fails to download, and the assertions verify that platform detection ran successfully before the download attempt.

action.yml outputs: Added id: install-windows and id: install-unix to the two conditional steps, and wired the installed-version output value to ${{ steps.install-windows.outputs.installed_version || steps.install-unix.outputs.installed_version }}.

Installer timeouts: Added -TimeoutSec 120 to the binary Invoke-WebRequest, -TimeoutSec 30 to the latest-release Invoke-RestMethod, and -TimeoutSec 60 to the checksums Invoke-WebRequest.

Process.Kill async: Added $process.WaitForExit(5000) after Kill($true) to ensure the process tree is fully terminated before continuing.

[github-actions]

🤖 PR Triage

Field	Value
Category	feature
Risk	🟡 medium
Score	47/100 (impact:22 + urgency:15 + quality:10)
Action	📦 batch_review

Rationale: Non-draft, adds Windows PowerShell installer path + CI coverage. Good value, moderate scope (9 files). Batch with other medium-risk non-urgent PRs. Windows CI in_progress.

Triage run §29183606049

Generated by 🔧 PR Triage Agent · 171.6 AIC · ⌖ 5.63 AIC · ⊞ 5.6K · ◷

[gh-aw-bot]

pr-sous-chef
@copilot please run the pr-finisher skill, address any remaining unresolved review feedback, make sure the branch is up to date, and rerun checks once done. Run: https://github.com/github/gh-aw/actions/runs/29183870267

Generated by 👨‍🍳 PR Sous Chef · 9.89 AIC · ⌖ 6.64 AIC · ⊞ 6K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
@copilot please run the pr-finisher skill, address any remaining unresolved review feedback, make sure the branch is up to date, and rerun checks once done. Run: https://github.com/gi...

Branch is up to date with main. Fixed the remaining CI failure in the "Test PowerShell installer on Windows" job.

Root cause: The "Verify composite-action binary and installed-version output" step asserted the binary existed at $HOME\.local\share\gh\extensions\gh-aw\gh-aw.exe, but gh extension install on Windows places extension binaries under %APPDATA%\GitHub CLI\extensions\ — not under $HOME\.local. The binary was installed successfully but the path check failed.

Fix (commit fix: use gh aw commands in Windows CI instead of hardcoded binary path): Replaced the hardcoded binary path assertion with gh aw version and gh aw --help invocations. This is the correct cross-platform verification: after gh extension install, gh aw is registered as a gh subcommand regardless of where the binary lives on disk.

All 11 review threads remain resolved. Local validation passes (make agent-report-progress green). CI must be re-triggered by a maintainer to confirm the fix.

[github-actions]

🤖 PR Triage

Field	Value
Category	feature
Risk	🟡 Medium
Score	58/100 (impact: 28, urgency: 15, quality: 15)
Action	batch_review

PowerShell installer + Windows CI. +1042/-10 — large addition but isolated to install/CI path. Batch review.

Generated by 🔧 PR Triage Agent · 48.3 AIC · ⌖ 7.99 AIC · ⊞ 5.6K · ◷

[gh-aw-bot]

@copilot please run the pr-finisher skill, address unresolved review feedback if any, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 14.1 AIC · ⌖ 8.64 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address unresolved review feedback if any, and rerun checks once the branch is up to date.

...

Branch is up to date with main. All CI checks on the latest HEAD are now passing — including "Test PowerShell installer on Windows" (fixed in commit e648822). All 11 review threads remain resolved. The PR is ready for merge pending maintainer approval.

[gh-aw-bot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29196572530

Generated by 👨‍🍳 PR Sous Chef · 8.11 AIC · ⌖ 5.41 AIC · ⊞ 4.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29196572530...

Branch is up to date with main. All CI checks are passing (run 29184418*), including "Test PowerShell installer on Windows". All 11 review threads remain resolved. The PR is ready for maintainer merge.

[gh-aw-bot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29200137487

Generated by 👨‍🍳 PR Sous Chef · 8.57 AIC · ⌖ 7.74 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29200137487...

Branch is up to date (at e648822). No changes needed this pass.

• ✅ Reviews — all 11 review threads are resolved (confirmed via GraphQL)
• ✅ Checks (local) — make agent-report-progress passes with zero lint errors and lock files in sync
• ❓ Checks (CI) — stale after agent push; last full CI run (29184418164) had all checks passing including "Test PowerShell installer on Windows". The run linked in this comment (29200137487) is a PR Sous Chef scheduling run on main, not a CI run on this branch.
• ✅ Mergeable — mergeable_state: clean (no conflicts; the 5 new main commits are all docs/infra and don't touch our changed files)

Hand-off: A maintainer needs to approve and re-trigger CI (close/reopen or workflow_dispatch) before merge. No agent action remains.

[gh-aw-bot]

\n@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 5.74 AIC · ⌖ 6.61 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

pr-sous-chef
@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29214279165

Generated by 👨‍🍳 PR Sous Chef · 13.2 AIC · ⌖ 8.72 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.
...

Branch merged with latest main (7 new commits: private-to-public-flows feature, gVisor bump, firewall v0.27.30, docs). Local validation passes. All 11 review threads remain resolved.

• ✅ Reviews — all 11 threads resolved
• ✅ Checks (local) — make agent-report-progress passes with zero errors
• ❓ Checks (CI) — last full CI run (29184418164) on this branch had all checks passing; CI on the updated HEAD needs a human re-trigger
• ✅ Mergeable — clean after merge

Hand-off: A maintainer needs to re-trigger CI (close/reopen or workflow_dispatch) before merge.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.9