build(deps): bump github/gh-aw-actions from 0.74.4 to 0.77.5

[dependabot]

Bumps github/gh-aw-actions from 0.74.4 to 0.77.5.

Release notes

Sourced from github/gh-aw-actions's releases.

v0.77.5

Sync of actions from gh-aw at v0.77.5.

v0.77.4

Sync of actions from gh-aw at v0.77.4.

v0.77.3

Sync of actions from gh-aw at v0.77.3.

v0.77.2

Sync of actions from gh-aw at v0.77.2.

v0.77.1

Sync of actions from gh-aw at v0.77.1.

v0.77.0

Sync of actions from gh-aw at v0.77.0.

v0.76.1

Sync of actions from gh-aw at v0.76.1.

v0.76.0

Sync of actions from gh-aw at v0.76.0.

v0.75.4

Sync of actions from gh-aw at v0.75.4.

v0.75.3

Sync of actions from gh-aw at v0.75.3.

v0.75.2

Sync of actions from gh-aw at v0.75.2.

v0.75.1

Sync of actions from gh-aw at v0.75.1.

v0.75.0

Sync of actions from gh-aw at v0.75.0.

v0.74.9

Sync of actions from gh-aw at v0.74.9.

v0.74.8

Sync of actions from gh-aw at v0.74.8.

v0.74.7

Sync of actions from gh-aw at v0.74.7.

v0.74.6

Sync of actions from gh-aw at v0.74.6.

... (truncated)

Commits

• 3ea13c0 chore: sync actions from gh-aw@v0.77.5 (#128)
• 4c7307f chore: sync actions from gh-aw@v0.77.4 (#127)
• 97f280b chore: sync actions from gh-aw@v0.77.3 (#126)
• 8ef4fd0 chore: sync actions from gh-aw@v0.77.2 (#125)
• 2d6db59 chore: sync actions from gh-aw@v0.77.1 (#124)
• b11be78 chore: sync actions from gh-aw@v0.77.0 (#122)
• 46d5649 chore: sync actions from gh-aw@v0.76.1 (#118)
• 029b1de chore: sync actions from gh-aw@v0.76.0 (#117)
• 9f05096 chore: sync actions from gh-aw@v0.75.4 (#116)
• 7a36338 chore: sync actions from gh-aw@v0.75.3 (#115)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 1, 2026, 4:41 PM ET / 20:41 UTC.

Summary
This PR updates github/gh-aw-actions setup/setup-cli pins from the v0.74.4 commit to the v0.77.5 commit in three workflow files.

Reproducibility: not applicable. this is a dependency update PR, not a reported runtime bug. Source and PR diff inspection verify the affected workflow action pins.

Review metrics: 2 noteworthy metrics.

• Workflow files changed: 3 files, 15 additions, 15 deletions. The diff is small, but every changed file is GitHub Actions automation rather than application code.
• Runtime setup pins updated: 13 setup uses plus 2 generated comments. The action bump affects multiple jobs across generated lock workflows, so one local source check is not enough to prove runtime behavior.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Run or wait for the affected gh-aw workflow paths from this head before merge.

Risk before merge

• [P1] The bump changes setup actions used by Copilot setup, Repo Assist, and Localization Audit automation; ordinary application build/test checks do not fully prove those event-driven gh-aw workflows still run with the existing v0.72.1 generated lock metadata.

Maintainer options:

1. Verify affected workflow runtime (recommended)
   Run or wait for the Copilot setup, Repo Assist, and Localization Audit workflow paths against this head so the setup action bump is proven in the generated lock workflows.
2. Accept the pinned update
   Maintainers can merge after normal checks if they are comfortable relying on the full-SHA pin and upstream tag verification for this minor action update.
3. Regenerate if coupling fails
   If the newer setup action is not compatible with the v0.72.1 lock metadata, replace this Dependabot patch with regenerated gh-aw lock workflow output.

Next step before merge

• [P2] Maintainer review should focus on workflow runtime checks or explicit acceptance of the automation risk; there is no narrow ClawSweeper repair to queue.

Security
Cleared: No concrete security or supply-chain defect found; the updated action remains pinned to a full commit SHA that matches the upstream v0.77.5 tag, with no permission or secret changes in the diff.

Review details

Best possible solution:

Land the full-SHA action bump after affected workflow checks prove runtime compatibility, or deliberately accept the automation risk if maintainers trust the upstream pinned release.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency update PR, not a reported runtime bug. Source and PR diff inspection verify the affected workflow action pins.

Is this the best way to solve the issue?

Yes; a full-SHA Dependabot bump is the narrowest dependency-maintenance path, provided maintainers verify or accept the affected workflow runtime risk.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 1d58d59673c9.

Label changes

Label justifications:

• P3: This is routine dependency maintenance with impact limited to repository automation unless the updated action breaks workflow setup.
• merge-risk: 🚨 automation: The diff changes GitHub Actions setup actions used by Copilot setup, Repo Assist, and Localization Audit workflows, which can fail outside normal application build/test coverage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot dependency PRs are outside the external-contributor real behavior proof gate; affected workflow checks are the relevant merge evidence.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read in full; its validation commands apply after code changes, while this pass was read-only PR review. (AGENTS.md:1, 1d58d59673c9)
• Current main still has old pin: Current main still references the v0.74.4 github/gh-aw-actions commit at the affected workflow setup lines, so the PR is not already implemented on the default branch. (.github/workflows/copilot-setup-steps.yml:24, 1d58d59673c9)
• Patch surface: The GitHub PR files API shows three workflow files changed with 15 additions and 15 deletions, replacing 13 runtime setup/setup-cli uses plus two generated reference comments. (.github/workflows/repo-assist.lock.yml:136, db477dd8a1c8)
• Pinned upstream action tag: The proposed github/gh-aw-actions v0.77.5 tag peels to 3ea13c02d765410340d533515cb31a7eef2baaf0, and the current v0.74.4 tag peels to d3abfe96a194bce3a523ed2093ddedd5704cdf62. (3ea13c02d765)
• Current checks context: The checks API showed the Copilot setup and test checks succeeding for the PR head, while generic commit status remained pending with some build jobs still in progress at review time. (db477dd8a1c8)
• Workflow ownership provenance: git blame attributes the affected workflow setup lines in this checkout to commit aaf50b75850424837f8caf6ef0c26623afd05900; the GitHub commit API maps that commit to shanselman. (.github/workflows/repo-assist.lock.yml:136, aaf50b758504)

Likely related people:

• shanselman: Git blame on the affected workflow setup lines points to aaf50b75850424837f8caf6ef0c26623afd05900, and the GitHub commit metadata maps that workflow-history commit to this handle. (role: recent area contributor; confidence: high; commits: aaf50b758504; files: .github/workflows/copilot-setup-steps.yml, .github/workflows/localization-audit.lock.yml, .github/workflows/repo-assist.lock.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.