chore(deps): bump the github-actions-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the github-actions-minor-patch group with 3 updates in the / directory: github/gh-aw/actions/setup, actions/upload-artifact and actions/download-artifact.

Updates github/gh-aw/actions/setup from 0.51.6 to 0.82.14

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.82.14

🌟 Release Highlights

This release focuses on safe-outputs reliability, workshop UX polish, a new top-level model field, and a wave of new linters and security guardrails.

✨ What's New

• Top-level model field — You can now specify the model at the top level of your workflow (e.g., model: claude-sonnet-4-5), deprecating the nested engine.model path. Reference docs
• auto_upgrade_cron in aw.json — Configure a custom auto-upgrade schedule directly in your project manifest instead of relying on defaults.
• Evals enabled across 64 agentic workflows — Broader evaluation coverage improves regression detection and workflow quality assurance.
• --rootless flag for install_copilot_cli.sh — ARC/DinD runners can now install the Copilot CLI without root privileges.
• Mode-specific intent guidance for safe-output tools — Mutation tools now surface targeted guidance based on the current workflow mode, reducing misuse and improving agent decision quality.
• Fail-fast guardrail for schema file changes — The compiler now rejects schema changes that were made without a rebuild, preventing subtle runtime mismatches.
• Workshop: journey/adventure filtering, GFM alerts & task lists — Workshop steps now support filtering by journey/adventure tags, render GitHub-flavored alerts (> [!NOTE]), and display task-list checkboxes.
• Workshop URL hash navigation — Browser back/forward now restores workshop state via URL hash encoding.
• DeepSec & VulnHunter security scan workflows — On-demand and daily security scanning workflows added for continuous vulnerability detection.
• errgroup for structured concurrency in MCP inspector — Replaces ad-hoc goroutine management with proper error propagation.

🐛 Bug Fixes & Improvements

• tools.startup-timeout now propagates to gateway.startupTimeout — Fixes safeoutputs eviction on slow runners where the gateway was timing out before the tool server was ready.
• OTEL_SERVICE_NAME respected — User-defined OpenTelemetry service names are no longer overridden when OTLP observability is enabled.
• MCP CLI prompt list reflects --disable-builtin-mcps — The listed MCP servers now accurately reflect which servers are actually mounted.
• logs tool fixed for missing workflow_name filter — Previously caused a context deadline exceeded error; now handled gracefully.
• safe.directory trust bridged via GIT_CONFIG_* env vars — Fixes git operations in safe-outputs on restrictive runners.
• partial_execution + terminal safe-output treated as success — Prevents false failure signals when an agent completes its final safe-output action after a partial execution state.
• Stable cron schedule in make recompile — Pins --schedule-seed to eliminate drift in auto-upgrade lock files across recompiles.
• #nosec justification separators normalized — - and — variants are now normalised to -- for consistent security annotation parsing.
• close_issue and assign_to_agent payloads — Issue-intent metadata is now correctly nested in the payload structure.
• update_issue MCP body length regression coverage — Added tests to guard against silent truncation above 10 KB.

⚡ Performance

• parseEngineDefinitionFromJSON cached — Eliminates a per-compile JSON→YAML round-trip, reducing compilation overhead for workflows with engine definitions.
• Reduced ambient context token usage — 4 workflows updated to use narrower context windows, lowering AI-credit burn.
• Scheduled workflow staggering — Midnight batch workflows staggered to reduce peak AI-credit consumption.

🔒 Security

• SHA-256 checksum pinned for sentrux binary install — Resolves RGS-018 supply-chain finding.
• no-exec-interpolated-command ESLint rule — Flags shell commands constructed from interpolated strings.
• no-github-request-interpolated-route extended — Now recognises global.getOctokit() aliases.
• Cross-repo regex tightened (SEC-005) — Eliminates false positive on frontmatter_hash_pure.cjs.

🔧 New Linters

• timenowsub — Flags time.Now().Sub(t) patterns that should be time.Since(t).
• trimleftright — Detects distinct-character prefix/suffix bugs from strings.TrimLeft/TrimRight misuse.
• appendoneelement — Catches single-element append patterns that could use assignment.
• no-core-error-then-process-exit (ESLint) — Prevents error-then-exit anti-patterns in GitHub Scripts.

... (truncated)

Commits

• 8b820ae fix: propagate tools.startup-timeout to gateway.startupTimeout (prevents safe...
• bd3f5d9 fix: mode-specific intent guidance for all intent-aware safe-output mutations...
• cdd7b86 [WIP] Fix failing GitHub Actions job for CLI completion (#46859)
• deea8a4 Recognize global.getOctokit() aliases in `no-github-request-interpolated-ro...
• 0d16d68 feat: mode-specific intent guidance for all safe-output mutation tools (#46861)
• f1220ce chore: remove dead functions — 1 function removed (#46860)
• 3ceb8ec feat(init): make --codespaces optional-value; grant discussions/issues write ...
• 9dc71fb fix: nest issue-intent metadata correctly in close_issue and assign_to_agent ...
• e03203a [eslint-factory] core-method-resolve: recognize function-parameter core bin...
• f9ecca5 Replace in-doc workshop experience with external workshop repository link (#4...
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• See full diff in compare view

Updates actions/download-artifact from 8.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in actions/download-artifact#471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

Commits

• 3e5f45b Add regression tests for CJK characters (#471)
• e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
• See full diff in compare view