Refresh agentic workflows to gh-aw v0.83.5

[vitek-karas]

Summary

• Upgrade all six agentic workflows from gh-aw v0.82.6 to v0.83.5.
• Regenerate the shared action pins and agentic maintenance workflow.
• Enable future workflows to use safe-output data payloads to store workflow-related metadata on issues and pull requests in a standard format.

Validation

• gh aw compile --schedule-seed dotnet/runtime --validate --no-emit
• gh aw compile --schedule-seed dotnet/runtime --validate --zizmor --poutine

Note

This PR description was generated by GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR refreshes the repository’s agentic GitHub Actions workflows to gh-aw v0.83.5, updating pinned action SHAs/container images and incorporating newer safe-outputs / MCP-gateway wiring. The changes primarily touch generated “*.lock.yml” workflows plus the generated agentic maintenance workflow and the shared gh-aw action pin map.

Changes:

• Bump gh-aw compiler references across the lock workflows to v0.83.5 (and update associated action SHAs, firewall/MCP images, Copilot CLI version, etc.).
• Update workflow runtime behavior around MCP gateway startup / docker socket group resolution, safe outputs processing, and additional error/guard outputs.
• Regenerate the agentic maintenance workflow and update the gh-aw actions pin map.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/holistic-review.lock.yml	Updates pinned gh-aw/actions/containers and refactors MCP gateway + safe outputs plumbing for the holistic review workflow.
.github/workflows/closed-issue-reference-check.lock.yml	Same refresh for the closed-issue reference check workflow, including updated MCP server container/features and safe outputs processing.
.github/workflows/ci-failure-scan.lock.yml	Same refresh for the CI failure scan workflow, including updated pins and MCP gateway configuration.
.github/workflows/agentics-maintenance.yml	Regenerated maintenance workflow for v0.83.5; splits “close expired” operations into discussions/issues/PR jobs and updates action pins.
.github/aw/actions-lock.json	Updates the pinned github/gh-aw-actions/* entries to v0.83.5 SHAs.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[PureWeen]

Can we bump this to v0.85.4 instead? It was the latest stable release before this PR opened, while v0.83.5 is marked prerelease upstream.

It looks like v0.83.5 was selected because it introduced the safe-output metadata channel this PR needs, but I could not find a compatibility reason to stop there. Regenerating with v0.85.4 would also pick up the security hardening and fixes since then.

Note

This review comment was generated with GitHub Copilot.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

.github/workflows/holistic-review.md:82

• The PR title/description says the workflows are being refreshed to gh-aw v0.83.5, but this workflow source now states the recognized agent config paths are for gh-aw v0.85.4. The lock workflows in this PR also advertise they were generated with v0.85.4, so the PR metadata and the pinned compiler version appear out of sync.

Please reconcile by either updating the PR title/description to v0.85.4, or by pinning/regenerating the workflows with v0.83.5 so the version claims match across metadata, source .md, and .lock.yml files.

      # These are the agent configuration paths recognized by gh-aw v0.85.4.
      # Re-audit this list whenever the pinned gh-aw compiler version changes.
      trusted_agent_folders=(

.gitattributes:86

• Removing merge=ours from the lock-workflow attribute will make Git merges try to merge the generated .github/workflows/*.lock.yml files normally, which can create frequent conflicts/churn for auto-generated content. If these files are intended to remain generator-owned, keep the merge strategy override to avoid noisy merges.

.github/workflows/*.lock.yml linguist-generated=true