chore: upgrade gh-aw to v0.86.3

[lpcox]

Summary

• upgrade the gh-aw extension and action pins from v0.86.2 to v0.86.3
• recompile all 64 agentic workflows and apply the required AWF post-processing
• migrate the Azure OpenAI Entra smoke workflow secrets into engine.auth

Testing

• npm test (305 suites, 4,806 tests passed)

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.86%	93.88%	📈 +0.02%
Statements	92.71%	92.72%	📈 +0.01%
Functions	93.20%	93.20%	➡️ +0.00%
Branches	85.87%	85.89%	📈 +0.02%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Upgrades gh-aw to v0.86.3, recompiles representative agentic workflows, and migrates Azure Entra authentication into engine.auth.

Changes:

• Updates gh-aw actions, metadata, engines, and AWF images.
• Applies local AWF build post-processing to generated workflows.
• Migrates Azure OIDC configuration, but generated credentials are missing.

Show a summary per file

File	Description
.github/workflows/smoke-gemini.lock.yml	Recompiles Gemini smoke workflow.
.github/workflows/smoke-copilot-byok-aoai-entra.md	Moves Azure OIDC settings into engine.auth.
.github/workflows/smoke-cloud-hypervisor.lock.yml	Recompiles Copilot microVM smoke workflow.
.github/workflows/smoke-cloud-hypervisor-codex.lock.yml	Recompiles Codex microVM smoke workflow.
.github/workflows/smoke-cloud-hypervisor-claude.lock.yml	Recompiles Claude microVM smoke workflow.
.github/workflows/smoke-cloud-hypervisor-build-test.lock.yml	Recompiles microVM build test.
.github/workflows/smoke-claude.lock.yml	Recompiles Claude smoke workflow.
.github/workflows/firewall-issue-dispatcher.lock.yml	Recompiles issue dispatcher workflow.
.github/workflows/contribution-check.lock.yml	Recompiles contribution checks.
.github/workflows/agentics-maintenance.yml	Updates maintenance action and CLI pins.
.github/aw/actions-lock.json	Updates action and container-image locks.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 29/67 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

[github-actions]

✅ Smoke Claude passed

Generated by Smoke Claude for #7388

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

• msfeed2.pkgs.visualstudio.com
• msfeed25.pkgs.visualstudio.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

✅ Security Guard completed successfully!

Security review complete for PR #7388 (chore: upgrade gh-aw to v0.86.3). Three security-relevant Dockerfiles were identified (containers/agent/Dockerfile, containers/cli-proxy/Dockerfile, containers/enclave/Dockerfile), all showing no textual changes (+0/-0). No firewall rule modifications, capability changes, domain ACL expansions, seccomp relaxations, or security-weakening code detected. All other changed files are workflow lock files and configuration updates. PR passes security review.

Generated by Security Guard for #7388

[github-actions]

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

[github-actions]

✅ Contribution Check completed successfully!

Contribution review complete: no guideline issues that warrant a comment. The PR description is clear, includes testing, and the changes are organized in the expected generated workflow/config files.

Generated by Contribution Check for #7388

[github-actions]

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

[github-actions]

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7388

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

[github-actions]

🔌 Smoke Services — Service connectivity was cancelled ⚠️

🔌 Service connectivity validated by Smoke Services

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7388

[github-actions]

❌ Contribution Check was cancelled. Please review the logs for details.

Generated by Contribution Check for #7388

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

Chroot tests failed Smoke Chroot was cancelled - See logs for details.

Tested by Smoke Chroot

[github-actions]

❌ Security Guard failed. Please review the logs for details.

Generated by Security Guard for #7388

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

[github-actions]

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

• ✅ GitHub MCP connectivity: 2 recent merged PRs fetched
• ✅ github.com connectivity: HTTP 200
• ✅ File write/read test: passed
• ✅ BYOK inference: working (direct BYOK mode via api-proxy → api.githubcopilot.com)

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY)

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Check	Status
API	PASS
gh CLI	PASS
File	PASS

Overall result: PASS

Generated by Smoke Claude for #7388 · haiku45 · 60.5 AIC · ⊞ 3.9K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable — allowed=200
✅ Blocked domain (example.com) denied — proxy 403 (CONNECT tunnel failed)

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot Engine

• MCP connectivity ([docs] auth: auth: document cli-proxy-egress relay for DIFC credential isolation under network-isolation #7387, docs: include Cloud Hypervisor in runtime guides #7370 fetched): ✅
• GitHub.com connectivity (HTTP 200): ✅
• File write/read test: ✅

Overall: PASS ✅

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

chore: upgrade gh-aw to v0.86.3

• GitHub MCP connectivity: ✅
• GitHub.com connectivity: ✅
• File I/O test: ✅
• BYOK inference test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

cc @lpcox

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

[github-actions]

chore: upgrade gh-aw to v0.86.3

1. MCP connectivity: ✅
2. GitHub.com connectivity: ✅
3. File write/read: ✅
4. BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: PASS

@lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

[github-actions]

Reviewed PRs: [docs] auth: auth: document cli-proxy-egress relay for DIFC credential isolation under network-isolation
Reviewed PRs: docs: include Cloud Hypervisor in runtime guides
Queried PR: chore: upgrade gh-aw to v0.86.3
Merged review ✅ | safeinputs-gh exact path ❌ | Playwright ✅
File write ✅ | cat verify ✅ | discussion interaction ❌
Build ✅
Overall: FAIL

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

• msfeed2.pkgs.visualstudio.com
• msfeed25.pkgs.visualstudio.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	❌	N/A	❌ FAIL
C++	json	❌	N/A	❌ FAIL
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (ran, printed "Hello, World!")	✅ PASS
.NET	json-parse	✅	N/A (ran, correct output)	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 7/8 ecosystems passed — FAIL (C++ failed)

❌ Failure Details — C++ (fmt, json)

CMake configuration failed for both fmt and json projects with:

CMake Error: Could not find CMAKE_ROOT !!!
CMake has most likely not been installed correctly.
Modules directory not found in

Root cause: /usr/local/bin/cmake is a symlink to a relocated binary path (/tmp/awf-usr-local-bin-orig-*/cmake), and CMake could not locate its Modules directory (/usr/local/share/cmake-3.31) relative to that relocated binary path, even though the Modules directory exists on disk and setting CMAKE_ROOT explicitly did not resolve it. This appears to be an environment/sandbox path-relocation issue affecting the CMake installation in this runner, not an issue with the test repositories themselves. Java's Maven local repository (~/.m2/repository) had a similar permission restriction, worked around by using -Dmaven.repo.local=<writable path>; no equivalent override exists for CMake's Modules directory.

Note: This run was triggered by pull request #7388. Since not all ecosystems passed, the build-test label was not added per the workflow instructions.

Generated by Build Test Suite for #7388 · auto · 50.9 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: API Proxy OpenTelemetry Tracing — Results

• ✅ Scenario 1 (Module Loading): otel.js loaded successfully. isEnabled: true. Exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, _provider, _ProxyAwareOtlpExporter, _FileSpanExporter, _FanOutSpanExporter, _parseEndpoints, _parseOtlpHeaders, _buildResourceSpans, _createOtlpWorkloadIdentity.
• ✅ Scenario 2 (Test Suite): 3 suites / 68 tests passed (0 failed) — otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js.
• ✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, plus the same trace/span IDs to the api-proxy.
• ✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook point used for OTEL token usage attributes.
• ✅ Scenario 5 (OTEL Diagnostics): Spans were exported — /tmp/gh-aw/otel.jsonl contains 1 resourceSpans payload with expected service.name, gh-aw.workflow.name, gh-aw.run.id, etc. attributes.

Overall: All 5 scenarios passed. ✅

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

🔥 Smoke Test: Docker Sbx Validation

@lpcox

• ✅ GitHub MCP connectivity (list_pull_requests succeeded)
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read test (verified via cat)

Recent merged PRs: #7387, #7370

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

[github-actions]

Smoke Test: Services Connectivity — FAIL

• ❌ Redis: Could not connect... Temporary failure in name resolution
• ❌ PostgreSQL pg_isready: no response
• ❌ PostgreSQL SELECT 1: could not translate host name

Overall: FAIL — host.docker.internal did not resolve in the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}