[dependabot]

Bumps the github-actions-minor-patch group with 3 updates in the / directory: github/gh-aw/actions/setup, actions/upload-artifact and actions/download-artifact.

Updates github/gh-aw/actions/setup from 0.51.6 to 0.88.2

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.88.2

🌟 Release Highlights

A focused patch release improving safe-output reliability and CI hygiene: call_workflow inputs no longer get dropped during samples replay, sample-coverage gaps are now surfaced as warnings, and AI credit budgets are validated more safely to close a CodeQL alert.

🐛 Bug Fixes & Improvements

• Fixed call_workflow samples replay dropping workflow_name — ingestion previously stripped workflow_name/inputs for call_workflow safe outputs, causing the apply job to fail with "Workflow name is empty" (#58113).
• Added warnings for uncovered samples — --use-samples compilation now warns when an enabled safe output has no samples: entries, so silent no-op replay runs are easier to catch (#58112).
• Hardened AI credit budget handling — the max AI credits expression moved from inline shell interpolation to step env:, with strict integer validation before configuring the AWF firewall budget, resolving a CodeQL code-injection alert (#58116).

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

Generated by 🚀 Release · copilot · auto · 16.4 AIC · ⊞ 11.8K

---

What's Changed

• Fix call_workflow samples replay dropping workflow_name during ingestion by @​dsyme with @​Copilot in github/gh-aw#58113
• Warn when samples replay has no coverage; add replace-label sample to E2E workflow by @​dsyme with @​Copilot in github/gh-aw#58112
• Move max AI credits expression to step env and validate integer in shell run block by @​pelikhan with @​Copilot in github/gh-aw#58116

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

v0.88.0

🌟 Release Highlights

This release focuses on hardening the sandbox runtime, simplifying browser automation with a new Playwright CLI approach, and fixing dependency resolution for nested workflow imports.

⚠️ Breaking Changes

• Removed built-in Playwright MCP support (#57521). Browser automation now goes through the new Playwright CLI guidance instead of the bundled MCP server — update workflows that relied on the built-in Playwright MCP tool.

✨ What's New

• Sandbox security settings replaced with runtime profiles (#57692) — legacy sandbox security flags are now expressed as declarative runtime profiles, making sandbox configuration easier to reason about. See the sandbox reference.
• Playwright CLI guidance and browser provisioning (#57731, #57691, #57594) — new AWF-aware policy prompts, configuration, and a shared smoke test make it easier to provision and use Playwright safely from agentic workflows.
• gh-aw-firewall v0.28.12 integration (#57514) — pulls in attested Cloud Hypervisor artifacts for stronger supply-chain guarantees on the firewall image.
• Operational value report evaluator and history (#57503) — new tooling to evaluate and track the operational value of agentic workflow runs over time.

🐛 Bug Fixes & Improvements

• Fixed dependency ordering and cycle detection for nested imports (#57746) — resolves incorrect ordering and undetected cycles when shared workflow files import each other transitively. See the imports reference.
• Codex custom tools now classified as invalid-model failures (#57578) — clearer error reporting when Codex is configured with unsupported custom tools.
• Fixed stale skill docs and repo-path guard (#57579) for the action-based JS architecture.
• Super-Linter restricted to Go modules (#57465), reducing noise from linting unrelated file types.
• Added a daily Windows Defender release scan (#57768) to catch malware false positives early.

... (truncated)

Commits

• 8e30bcd Move max AI credits expression to step env and validate integer in shell run ...
• d89d731 Warn when samples replay has no coverage; add replace-label sample to E2E wor...
• 93dcf0e Fix call_workflow samples replay dropping workflow_name during ingestion (#58...
• b4fadaa feat(manifest): add optional icon field supporting emoji, octicon, and SVG re...
• 1e1fbac Restore MicroVM and ARC runner cards on homepage (#58054)
• dc5c0d2 fix(compiler): normalize gateway policy server IDs (#58023)
• 86c0e5a Prevent PR body injection during transfer (#58034)
• 37750b6 Stop suggesting redundant Playwright CLI mode (#58041)
• e96e161 Fix CodeQL code-injection alert for runner.tool_cache in generated shell ru...
• 650574f Add API and storage budgets to logs downloads (#58022)
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• See full diff in compare view

Updates actions/download-artifact from 8.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in actions/download-artifact#471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

Commits

• 3e5f45b Add regression tests for CJK characters (#471)
• e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Bill Schnurr (bschnurr)]

Superseded by the aggregate dependency update PR: #573. This Dependabot PR is intentionally being left open until the aggregate PR merges.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml