[westey (westey-m)]

Motivation & Context

The Issue Planning workflow (/plan comments) has failed on every run since Oct 26, for example https://github.com/microsoft/agent-framework/actions/runs/41642150331. The agent runs, but the last step, which posts the planning comment, fails with:

add_comment: Missing or invalid safe-output execution provenance: GH_AW_JOB_CHECK_RUN_ID

The cause is Dependabot PR #9689. It bumped only the github/gh-aw-actions/setup step in issue-plan.lock.yml from v0.91.0 to v0.92.5. The rest of that file is generated by gh aw compile and was still at v0.91.0. The newer setup runtime expects GH_AW_JOB_CHECK_RUN_ID, but the old generated file never sets it.

Description & Review Guide

• What are the major changes?
  • Regenerated issue-plan.lock.yml and .github/aw/actions-lock.json with gh aw compile v1.0.1, the latest release. This updates github/gh-aw-actions/setup to v1.0.1 and keeps it on the same version as the rest of the generated file. The new file sets GH_AW_JOB_CHECK_RUN_ID for the safe-outputs job.
  • In issue-plan.md, renamed the safe-output keys missing-tool and missing-data to report-missing-tool and report-missing-data, because v1.0.1 deprecates the old names. Behavior is unchanged, and the workflow now compiles with no warnings.
  • Added a Dependabot ignore rule for github/gh-aw-actions/* so Dependabot no longer bumps the setup step by itself. gh-aw should be upgraded with gh aw upgrade or gh aw compile, which keeps the setup step and the generated file on the same version.
• What is the impact of these changes? /plan comments should post their result again. Only the Issue Planning workflow and the Dependabot config are affected.
• What do you want reviewers to focus on? Whether ignoring github/gh-aw-actions/* in Dependabot is the approach we want for future gh-aw upgrades.

Related Issue

N/A - trivial change. This fixes a broken CI workflow by regenerating its lock file with a matching gh-aw version. The desired result, a working workflow, is not in dispute.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Investigating the failure, regenerating the workflow lock file, the Dependabot config change, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

The tool renames leave the safe-tool test filter outdated, causing its equality assertion to fail and breaking CI for Issue Planning changes.

1 open issue

• Exclude renamed report tools from safe-tool assertion · New

What changed in this PR

This PR addresses the /plan comment-posting failure by aligning the Issue Planning workflow’s generated configuration and runtime with gh-aw v1.0.1.

Changes:

• Regenerates workflow and action locks, including the required safe-output execution provenance.
• Migrates deprecated safe-output keys to report-missing-tool and report-missing-data.
• Prevents Dependabot from independently upgrading gh-aw actions and recreating the compiler/runtime mismatch.

File	Description
.github/​workflows/​issue-plan.md	Renames deprecated safe-output configuration keys.
.github/​workflows/​issue-plan.lock.yml	Regenerates the workflow with updated runtime dependencies and provenance handling.
.github/​dependabot.yml	Excludes gh-aw actions from independent dependency updates.
.github/​aw/​actions-lock.json	Pins the setup action to gh-aw v1.0.1.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (2 commit(s)): e61eb5ddaa77, 487f85cfd63c
Model: gpt-5.6-sol

Overview

This PR recompiles the Issue Planning workflow with gh-aw v1.0.1, aligns every generated setup reference and the action lock to the same pinned release, supplies the safe-output provenance expected by that runtime, and migrates deprecated report keys consistently. Existing role checks, read-only agent permissions, isolated safe-output write permissions, bounded comment publication, and source/generated workflow tests constrain the changed behavior. No publishable Critical, High, or Medium defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.