Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648

Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged

Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom
dev/amauryleve/recompile-aw-workflows

Conversation

@Evangelink

@EvangelinkAmaury Levé (Evangelink) commented May 28, 2026

Copy link
Copy Markdown
Member

Fixes#8632.

Symptom

The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:

Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.

Root cause

The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:

path.join(__dirname,"../md/workflow_install_note.md")

…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.

The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).

Fix

Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.

This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:

  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)

No .lock.yml files were hand-edited — produced via gh aw compile --strict.

Verification

$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.

CopilotAI review requested due to automatic review settings May 28, 2026 09:52
CopilotAI reviewed May 28, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.

Changes:

  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.

Copilot's findings

  • Files reviewed: 30/34 changed files
  • Comments generated: 1

Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed the dev/amauryleve/recompile-aw-workflows branch from b518552 to 3f0f39eCompareMay 28, 2026 09:59
@Evangelink

Amaury Levé (Evangelink) commented May 28, 2026

Copy link
Copy Markdown
MemberAuthor

Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:

  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well

The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.

Evangelink
Amaury Levé (Evangelink) commented May 28, 2026
View reviewed changes

@EvangelinkAmaury Levé (Evangelink) left a comment

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary

This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.

Two findings worth discussion before merging:

#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files

Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.

Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.

Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M

Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink) merged commit b73004d into mainMay 28, 2026
24 checks passed
@Evangelink
Amaury Levé (Evangelink) deleted the dev/amauryleve/recompile-aw-workflows branch May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed

2 participants

@Evangelink
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632) - #8648
Merged
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
May 28, 2026
Merged
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_install_note.md ENOENT (fixes #8632)#8648
Amaury Levé (Evangelink) merged 1 commit into
mainfrom 
dev/amauryleve/recompile-aw-workflows
Conversation
@Evangelink
@EvangelinkAmaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

Member
Fixes#8632.
Symptom
The Daily Link Checker & Fixer workflow (and any other agentic workflow that emits safe outputs) was failing in the Process Safe Outputs step with:
Error: ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

See the failed run in #8632.
Root cause
The repository's agentic workflows were last compiled with gh-aw v0.74.8. That version ships a bug in actions/setup/js/messages_footer.cjs where the defaultInstallTemplatePath is computed as:
path.join(__dirname,"../md/workflow_install_note.md")
…which resolves to ${RUNNER_TEMP}/gh-aw/md/workflow_install_note.md. But the matching actions/setup/setup.sh copies the md files into ${RUNNER_TEMP}/gh-aw/prompts/ (not ../md/). As a result, getFooterInstallMessage always throws ENOENT, which causes the create_pull_request safe output to fail — exactly what we see in #8632.
The bug was fixed in gh-aw v0.75.0+ (the code now uses getPromptPath("workflow_install_note.md") which honors the actual ${RUNNER_TEMP}/gh-aw/prompts/ location).
Fix
Because the buggy code lives inside the github/gh-aw-actions/setup action that the lock files pin by SHA, recompiling with a newer compiler is enough — it re-pins the setup action to a fixed SHA and embeds the fixed JS in every workflow.
This PR recompiles all agentic workflows with gh-aw v0.75.4 (latest stable at time of writing). The result:
  • 26 .lock.yml files in .github/workflows/ regenerated
  • agentic_commands.yml and agentics-maintenance.yml regenerated
  • .github/aw/actions-lock.json updated (setup + setup-cli now pinned at the v0.75.4 SHA 9f050961da586148d135e113d8bb025185cdf2b8)
No .lock.yml files were hand-edited — produced via gh aw compile --strict.
Verification
$ grep -r "v0\.74\." .github/
(no matches)

The original failing workflow (link-checker.lock.yml) now references github/gh-aw-actions/setup@9f050961da586148d135e113d8bb025185cdf2b8 # v0.75.4 everywhere.
CopilotAI
review requested due to automatic review settings
May 28, 2026 09:52
CopilotAI
reviewed
May 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
This PR recompiles agentic workflow outputs with gh-aw v0.75.4 to move generated workflows off the buggy v0.74.8 setup action that caused safe-output workflow_install_note.md failures.
Changes:
  • Updates generated agentic workflow lock files, command routing, maintenance workflow, and action lock entries to gh-aw v0.75.4.
  • Bumps embedded gh-aw runtime/tooling versions, model defaults, and generated safe-output/detection script wiring.
  • Removes the issue-arborist.md and repo-chronicle.md workflow sources and their README catalog entries, which is not described in the PR metadata.
Show a summary per file
FileDescription
.github/aw/actions-lock.jsonRe-pins github/gh-aw-actions/setup and setup-cli to v0.75.4.
.github/workflows/add-tests.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/address-review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/adhoc-qa.lock.ymlRegenerated lock file and updated safe-output schema.
.github/workflows/agentic_commands.ymlRegenerated command router with v0.75.4.
.github/workflows/agentics-maintenance.ymlRegenerated maintenance workflow with v0.75.4 setup/setup-cli.
.github/workflows/autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis-command.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/build-failure-analysis.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/code-simplifier.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/daily-file-diet.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-issue-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/dependabot-pr-bundler.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/duplicate-code-detector.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/efficiency-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/glossary-maintainer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/issue-arborist.mdDeletes the Issue Arborist workflow source.
.github/workflows/link-checker.lock.ymlRegenerated failing workflow lock file with fixed setup action.
.github/workflows/malicious-code-scan.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/markdown-linter.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/msbuild-quality-review.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/perf-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/pr-fix.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/README.mdUpdates agentic workflow catalog by removing two entries.
.github/workflows/repo-chronicle.mdDeletes the Repository Chronicle workflow source.
.github/workflows/repository-quality-improver.lock.ymlRegenerated lock file with updated generated job condition.
.github/workflows/review-after-autofix.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review-on-open.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/review.agent.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/sub-issue-closer.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/test-improver.lock.ymlRegenerated agentic workflow lock file.
.github/workflows/weekly-issue-activity.lock.ymlRegenerated agentic workflow lock file.
Copilot's findings
  • Files reviewed: 30/34 changed files
  • Comments generated: 1
Comment thread.github/workflows/README.md
@Evangelink
Recompile agentic workflows with gh-aw v0.75.4 to fix workflow_instal…
3f0f39e
…l_note.md ENOENT
Fixes#8632.
The Daily Link Checker & Fixer (and any other agentic workflow that
emits safe outputs) was failing in the 'Process Safe Outputs' step
with:
Error: ENOENT: no such file or directory, open
'/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'
Root cause: gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs
where defaultInstallTemplatePath resolves to '../md/workflow_install_note.md'
relative to the cjs file, but actions/setup/setup.sh copies the md files
into \/gh-aw/prompts/ (not '../md/'). The result is a
guaranteed crash whenever getFooterInstallMessage runs, which breaks
the create_pull_request safe output entirely.
The bug is fixed in gh-aw v0.75.0+ (now uses getPromptPath()), so the
fix here is to recompile every workflow with a newer compiler. All 28
.lock.yml files plus agentic_commands.yml, agentics-maintenance.yml,
and .github/aw/actions-lock.json are regenerated with gh-aw v0.75.4,
which also re-pins github/gh-aw-actions/setup to the v0.75.4 SHA where
the runtime fix lives.
Compiled with: gh aw compile --strict (no .lock.yml files were
hand-edited).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Evangelink
Amaury Levé (Evangelink)force-pushed
the
dev/amauryleve/recompile-aw-workflows
branch
from
b518552 to
3f0f39eCompareMay 28, 2026 09:59
@Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026

Copy link


Copy Markdown

MemberAuthor
Thanks for catching this! The previous push bundled an unrelated commit (the chronicle/arborist removal) because I had inadvertently branched off the wrong starting point. I've force-pushed a clean version that now:
  • Drops the unrelated removal commit
  • Recompiles the previously-missed issue-arborist.lock.yml and repo-chronicle.lock.yml to v0.75.4 as well
The PR now contains only the 31 regenerated files from gh aw compile --strict — no source .md or README changes.
Evangelink
Amaury Levé (Evangelink)
commented
May 28, 2026
View reviewed changes
@EvangelinkAmaury Levé (Evangelink)
left a comment


Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary
This PR recompiles all 26 agentic workflow lock files with gh-aw v0.75.4 to fix a genuine ENOENT bug in actions/setup/js/messages_footer.cjs that caused the "Process Safe Outputs" step to fail. The .lock.yml files are tooling-generated (gh aw compile --strict), not hand-edited, and strict: true is preserved throughout — the agentic workflow integrity dimension passes.
Two findings worth discussion before merging:
#DimensionFindingSeverityFiles
1Algorithmic Correctness✅ Clean——
2Threading & Concurrency✅ Clean (CI/YAML only)——
3Security / IPC Contract⚠️ Four container images now lack SHA-256 digest pins (gh-aw-firewall/agent, api-proxy, squid, gh-aw-mcpg); compiler v0.74.8 pinned all imagesMAJORall .lock.yml
4Public API & Binary Compat✅ N/A——
5Performance✅ N/A——
6Cross-TFM Compat✅ N/A——
7Resource / IDisposable✅ N/A——
8Defensive Coding✅ N/A——
9Error Handling✅ N/A——
10Test Quality✅ N/A——
11Naming & Clarity✅ detect-copilot-errors → detect-agent-errors rename is consistent——
12Documentation✅ README updated——
13Localization✅ N/A——
14MSBuild & Packaging✅ N/A——
15Analyzer Rules✅ N/A——
16Agentic Workflow Integrity✅ strict: true maintained everywhere; no hand-edits——
17Configuration & Defaults✅ N/A——
18Dependency & Version Mgmt⚠️ See finding #3 — four unpinned image tagsMAJORall .lock.yml
19CI/CD & Build Pipeline✅ Compiler-version bump is consistent across all 26 files——
20Style & Formatting✅ Clean——
21Scope & Focusi️ Deletion of issue-arborist and repo-chronicle workflows bundled with the bug-fix recompileMINORREADME, 4 files
Primary concern (MAJOR): The new compiler silently drops SHA-256 digest pins for four first-party container images. Because the lock files must not be hand-edited, please confirm with the gh-aw tooling team whether this is intentional (e.g. the framework resolves digests at runtime) or a compiler regression that should be fixed upstream first.
Secondary concern (MINOR): Two workflow files are retired in the same commit as the bug fix. Please confirm this retirement is deliberate so it doesn't fly under the radar.
Generated by Expert Code Review (on open) for issue #8648 · sonnet46 1.9M
Comment thread.github/workflows/add-tests.lock.yml
@Evangelink
Amaury Levé (Evangelink)
merged commit b73004d
into
mainMay 28, 2026

24 checks passed

@Evangelink
Amaury Levé (Evangelink)
deleted the

dev/amauryleve/recompile-aw-workflows

branch
May 28, 2026 10:24
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[aw] Daily Link Checker & Fixer failed


2 participants

@Evangelink