Skip to content

v0.64.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Mar 23:07
· 44 commits to main since this release
v0.64.2
72346ee
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🌟 Release Highlights

This release delivers a new cross-run security audit report command, an important YAML injection security fix, several resilience improvements for large repositories and PR creation workflows, and resolves three community-reported issues.

✨ What's New

gh aw audit report — Cross-Run Security Audit Reports

A new gh aw audit report subcommand aggregates firewall behavior across multiple workflow runs, producing an executive summary, domain inventory, and per-run breakdown — ideal for security reviews and compliance checks.

gh aw audit report --workflow "agent-task" --last 10       # Markdown (default)
gh aw audit report --last 5 --json                         # JSON for dashboards
gh aw audit report --format pretty --repo owner/repo       # Console output

Supports --workflow, --last, --format (markdown/pretty/json), and --repo flags.

🐛 Bug Fixes & Improvements

  • Security: YAML env injection prevention — All env: emission sites in the compiler now use %q-escaped YAML scalars, preventing newlines or quote characters in frontmatter values (e.g. bot names) from injecting sibling env variables into .lock.yml files. A bots schema pattern now rejects structurally dangerous characters at parse time.

  • Fix ENOBUFS crash in push_repo_memory on large repos — Repos with 10K+ files (e.g. Azure/azure-sdk-for-js) no longer crash during memory operations. Replaced git rm -r -f (which overflowed the pipe buffer) with git read-tree --empty + fs.rmSync, and removed the unnecessary git sparse-checkout disable call.

  • Fix gh aw upgrade when no GitHub Releases exist — gh aw upgrade now falls back to git tag scanning when the Releases API returns an empty list (e.g. for github/gh-aw-actions/setup). Both resolution paths filter out prerelease versions to ensure stable upgrades.

  • Fix gh aw init MCP configuration for VS Code — The generated .vscode/mcp.json no longer includes an unsupported cwd field that caused spawn gh ENOENT errors in Copilot CLI.

  • Pin setup-cli action to commit SHA — generateInstallCLISteps now resolves the setup-cli action through the ActionSHAResolver (consistent with all other generated actions), replacing mutable tag references with pinned SHAs.

  • PR creation resilience: conflict fallback — When git am --3way fails due to merge conflicts, PR creation now falls back to the original base commit so GitHub can surface the conflicts for manual resolution, rather than failing outright.

  • Fix signed-commit push for CI trigger token — When GH_AW_CI_TRIGGER_TOKEN is set and pushSignedCommits creates a branch via GraphQL, the follow-up empty commit push no longer fails with a non-fast-forward error.

  • microsoft/apm-action bumped to v1.4.1 — Fixes token handling for cross-org private repository installs where v1.4.0 shadowed the caller-provided GITHUB_TOKEN.

  • ci-doctor: paginate check-runs API — CI Doctor now uses --paginate to collect all check runs, fixing silent truncation at 30 items on PRs with large CI suites.

  • Improved branch sync error messaging — Branch sync failures now surface the underlying error message at warning level for easier debugging.

  • Detection model aligned with agent default — GetDefaultDetectionModel now returns claude-sonnet-4.6, matching the main agent default.

🌍 Community Contributions

A huge thank you to the community members who reported issues that were resolved in this release!

@deyaaeldeen

@grahame-white

For complete details, see CHANGELOG.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

  • #23088 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Release

What's Changed

  • Deduplicate tool-usage aggregation logic in audit report pipeline by @Copilot in #23120
  • ci-doctor: paginate check-runs API call to handle >30 jobs by @Copilot in #23128
  • docs: upgrade gh aw init tip to full section in creating-workflows by @Copilot in #23131
  • fix(docs-noob-tester): add Node.js 22 runtime to prevent Astro 6 version check failures by @Copilot in #23133
  • fix: recompile lock files after adding docs-server-lifecycle.md shared workflow by @Copilot in #23142
  • fix: prevent ENOBUFS in push_repo_memory on large repos by @Copilot in #23069
  • Remove unsupported cwd from generated .vscode/mcp.json by @Copilot in #23144
  • Fall back to original base commit when git am --3way fails due to merge conflicts by @Copilot in #23132
  • fix: fetch remote branch before pushing CI trigger empty commit to avoid non-fast-forward rejection by @Copilot in #23152
  • fix: SHA-pin setup-cli action references in maintenance workflow generation by @Copilot in #23146
  • Fix: fallback to git tags when GitHub Releases API returns empty for gh aw upgrade by @Copilot in #23147
  • bump microsoft/apm-action to v1.4.1, add DefaultAPMActionVersion constant, rebuild wasm, recompile by @Copilot in #23150
  • build(deps): bump fast-xml-parser from 5.4.1 to 5.5.9 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #23164
  • fix: align GetDefaultDetectionModel with main agent default (claude-sonnet-4.6) by @Copilot in #23160
  • fix: escape YAML env values to prevent structure injection (all remaining sites) by @Copilot in #23168
  • [ubuntu-image] research: update Ubuntu runner image analysis for 2026-03-26 by @github-actions[bot] in #23177

Full Changelog: v0.64.1...v0.64.2

Contributors

dependabot
Assets 18
Loading