Bumps the actions group with 1 update: [github/gh-aw](https://github.com/github/gh-aw). Updates `github/gh-aw` from 0.71.1 to 0.71.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/gh-aw/releases">github/gh-aw's releases</a>.</em></p> <blockquote> <h2>v0.71.5</h2> <h2>🌟 Release Highlights</h2> <p>This release focuses on reliability and correctness across the <code>engine.env</code> compilation pipeline, the security check layer, and the Claude engine — with five community-reported issues resolved.</p> <h3>🐛 Bug Fixes & Improvements</h3> <ul> <li> <p><strong>Claude engine stability</strong> — Workflows using the <code>claude</code> engine no longer crash mid-session with "Fast mode unavailable". <code>CLAUDE_CODE_DISABLE_FAST_MODE=1</code> is now set automatically to suppress an incompatible server-side flag introduced in Claude Code 2.1.120+.</p> </li> <li> <p><strong><code>engine.env</code> multi-line values</strong> — Block-scalar <code>engine.env</code> values (written with <code>>-</code> and extra-indented continuation lines) previously compiled to broken YAML with embedded newlines. These now compile correctly into valid multi-line <code>env:</code> entries. <em>(Reported by <code>@jeffhandley</code> in <a href="https://redirect.github.com/github/gh-aw/issues/30204">#30204</a>)</em></p> </li> <li> <p><strong><code>engine.env</code> <code>needs</code> expressions</strong> — Custom job references in <code>engine.env</code> values (e.g. <code>${{ needs.my_job.outputs.value }}</code>) were silently dropped from the agent job's <code>needs</code> list, causing those expressions to evaluate to empty strings at runtime. The compiler now correctly wires these dependencies. <em>(Reported by <code>@jeffhandley</code> in <a href="https://redirect.github.com/github/gh-aw/issues/30232">#30232</a>)</em></p> </li> <li> <p><strong><code>gh aw upgrade</code> false BYOK warning</strong> — <code>gh aw upgrade</code> was incorrectly warning "Remove unsafe secrets from engine.env" for <code>COPILOT_PROVIDER_API_KEY</code> and <code>COPILOT_PROVIDER_BEARER_TOKEN</code>, silently stripping legitimate BYOK configuration. <code>gh aw upgrade</code> now matches <code>gh aw compile</code> in allowing these keys. <em>(Reported by <code>@MauroDruwel</code> in <a href="https://redirect.github.com/github/gh-aw/issues/30178">#30178</a>)</em></p> </li> <li> <p><strong><code>pull_request_review</code> activation signal</strong> — Workflows triggered by <code>pull_request_review</code> events no longer silently skip the 👀 reaction and <code>run-started</code> comment. The <code>buildReactionLikeCondition</code> allowlist now includes this event type. <em>(Reported by <code>@mason-tim</code> in <a href="https://redirect.github.com/github/gh-aw/issues/30336">#30336</a>)</em></p> </li> <li> <p><strong>Confused-deputy false positive for bot-menu patterns</strong> — The security check introduced in v0.71.4 was blocking the legitimate pattern where a bot posts a checkbox-menu comment and a human maintainer edits it to tick a box (<code>issue_comment:edited</code>). The check now automatically detects <code>[bot]</code>-authored comments and skips the guard for that path, while keeping all other <code>issue_comment:created</code> paths fully protected. <em>(Reported by <code>@theletterf</code> in <a href="https://redirect.github.com/github/gh-aw/issues/30327">#30327</a>)</em></p> </li> </ul> <h3>✨ What's New</h3> <ul> <li> <p><strong><code>allow-bot-authored-trigger-comment</code> frontmatter option</strong> — For bots that don't follow the standard <code>[bot]</code> naming convention, you can now opt into the confused-deputy bypass explicitly:</p> <pre lang="yaml"><code>on: issue_comment: types: [edited] allow-bot-authored-trigger-comment: true </code></pre> </li> <li> <p><strong>MCP progress notifications</strong> — The <code>logs</code>, <code>audit</code>, and <code>audit-diff</code> MCP tools now stream real-time progress updates to AI clients (Copilot, Claude) during long-running operations, eliminating silent 30+ second waits.</p> </li> <li> <p><strong>MCP Gateway bump to v0.3.6</strong> — The embedded MCP gateway has been updated to <code>ghcr.io/github/gh-aw-mcpg:v0.3.6</code> with pinned digest for supply-chain safety.</p> </li> </ul> <h3>🌍 Community Contributions</h3>  <h3><code>@jeffhandley</code></h3> <ul> <li><a href="https://redirect.github.com/github/gh-aw/issues/30232">Agent 'needs' does not incorporate jobs in engine.env expressions</a> <em>(direct issue)</em></li> <li><a href="https://redirect.github.com/github/gh-aw/issues/30204">Multi-line expressions unsupported in <code>engine.env</code> values</a> <em>(direct issue)</em></li> </ul> <h3><code>@mason-tim</code></h3> <ul> <li><a href="https://redirect.github.com/github/gh-aw/issues/30336">Activation comment / reaction not posted for <code>pull_request_review</code> triggers — <code>buildReactionLikeCondition</code> allowlist is incomplete</a> <em>(direct issue)</em></li> </ul> <h3><code>@MauroDruwel</code></h3> <ul> <li>[gh aw upgrade: still warns 'Remove unsafe secrets from engine.env' despite fix in <a href="https://redirect.github.com/github/gh-aw/issues/29378">#29378</a> for compile](<a href="https://redirect.github.com/github/gh-aw/issues/30178">github/gh-aw#30178</a>) <em>(direct issue)</em></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/gh-aw/commit/19ac811a4a85389c33b15128e1d7b7d4507f814a"><code>19ac811</code></a> Bump default AWF firewall image set to v0.25.40 (<a href="https://redirect.github.com/github/gh-aw/issues/30406">#30406</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/ec084897bffb5017816faee39a5121fcb6a7c71e"><code>ec08489</code></a> Fix CJS shard failures caused by <code>template_branch.cjs</code> integration gaps (<a href="https://redirect.github.com/github/gh-aw/issues/30425">#30425</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/377109d8377d6b8181cb58e30ea067609e22ff1f"><code>377109d</code></a> Fix js-typecheck failure in <code>template_branch.cjs</code> null-else branch typing (<a href="https://redirect.github.com/github/gh-aw/issues/3">#3</a>...</li> <li><a href="https://github.com/github/gh-aw/commit/456c1ceb138515521b83352081577ad232d95892"><code>456c1ce</code></a> Add MCP Gateway v0.3.6 container pin to lock data and embedded pin maps (<a href="https://redirect.github.com/github/gh-aw/issues/30408">#30408</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/8098a8ee8c57df985adfd36f98a7328d3b31d13e"><code>8098a8e</code></a> Rename <code>MustBeWithin</code> → <code>ValidatePathWithinBase</code> in <code>pkg/fileutil</code> (<a href="https://redirect.github.com/github/gh-aw/issues/30421">#30421</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/6a0ab1e13133c52348f9d1d61bd5955e29341c3b"><code>6a0ab1e</code></a> chore: update source reference in token optimizer workflows (<a href="https://redirect.github.com/github/gh-aw/issues/30420">#30420</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/53bd0fb80f8eba52cc0e62dea5095aef2a88f715"><code>53bd0fb</code></a> feat: Update OTel instrumentation workflow to support multiple endpoints (<a href="https://redirect.github.com/github/gh-aw/issues/30">#30</a>...</li> <li><a href="https://github.com/github/gh-aw/commit/e890d0f372bb10643492a0f0b343970dce18c915"><code>e890d0f</code></a> fix: use require.Error for error assertion in compile_args_test.go (<a href="https://redirect.github.com/github/gh-aw/issues/30394">#30394</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/2fa5c46826e584b5e302458acb73f16ffc1644c0"><code>2fa5c46</code></a> Add redirect from shared/apm.md to microsoft/apm upstream and update docs (<a href="https://redirect.github.com/github/gh-aw/issues/3">#3</a>...</li> <li><a href="https://github.com/github/gh-aw/commit/19b21703d2332d12e12ff1b2866ffd6117b6607e"><code>19b2170</code></a> Add <code>agentic-ops</code> workflows (<a href="https://redirect.github.com/github/gh-aw/issues/30379">#30379</a>)</li> <li>Additional commits viewable in <a href="https://github.com/github/gh-aw/compare/v0.71.1...v0.71.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/gh-aw&package-manager=github_actions&previous-version=0.71.1&new-version=0.71.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-Original file line number
+Diff line change
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Install gh-aw extension
 -        uses: github/gh-aw/actions/setup-cli@v0.71.1
 +        uses: github/gh-aw/actions/setup-cli@v0.71.5
         with:
           version: v0.50.1