build(deps): bump github/gh-aw/actions/setup-cli from 0.88.7 to 0.89.14 in the actions group

[dependabot]

Bumps the actions group with 1 update: github/gh-aw/actions/setup-cli.

Updates github/gh-aw/actions/setup-cli from 0.88.7 to 0.89.14

Release notes

Sourced from github/gh-aw/actions/setup-cli's releases.

v0.89.13

🌟 Release Highlights

A small maintenance release focused on logs tooling, release-notes governance, and a documentation fix.

✨ What's New

• Wildcard support for cached logs — gh aw logs --cached-logs now accepts trailing-wildcard prefixes (e.g. logs-*), merging all matching *.jsonl shards, pruning out-of-range files, and writing fresh results to a new collision-resistant shard. Handy for teams sharing rolling log caches. (#60702)
• Safer release-notes automation — agentic workflows that touch release notes must now go through the update-release safe output instead of direct GitHub mutations, keeping agent jobs read-only and closing off a class of unintended writes. (#60701)

📚 Documentation

• Fixed the Artifacts reference table, which listed aw-info and prompt as current artifact names even though no compiled workflow produces them; the correct info artifact is now documented, and the legacy names are marked back-compat. (#60706)

🔧 Internal

• Weekly blog post summarizing recent activity. (#60729)

No community-labeled issues were closed in this release window.

Generated by 🚀 Release · copilot · auto · 23.1 AIC · ⊞ 11.9K

---

What's Changed

• Require update-release for agent-generated release notes by @​pelikhan with @​Copilot in github/gh-aw#60701
• [docs] Self-healing documentation fixes from issue analysis - 2026-09-13 by @​github-actions[bot] in github/gh-aw#60706
• Support wildcard cached logs files by @​pelikhan with @​Copilot in github/gh-aw#60702
• [blog] Weekly blog post – 2026-09-14 by @​github-actions[bot] in github/gh-aw#60729

Full Changelog: github/gh-aw@v0.89.12...v0.89.13

v0.89.12

🌟 Release Highlights

A small security-hardening and CI reliability release.

🐛 Bug Fixes & Improvements

• Reduced credential blast radius in slash-command router — The generated central slash-command router workflow (.github/workflows/agentic_commands.yml) now checks out the repository with persist-credentials: false, so GITHUB_TOKEN is no longer persisted in the local git config for the lifetime of the routing job (#60685).
• Fixed failing CI job — Resolved a failure in the "Integration: CMD Tests" GitHub Actions job to restore green CI signal (#60683).

Generated by 🚀 Release · copilot · auto · 19.3 AIC · ⊞ 11.9K

---

... (truncated)

Changelog

Sourced from github/gh-aw/actions/setup-cli's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• 97b9a7c Surface safe-output entities in logs and usage artifacts (#60788)
• 25ea846 Add Agent of the Day blog post for September 14, 2026 (#60854)
• 53cdd80 Clarify missing GitHub Release safe-output errors (#60845)
• c20c996 Apply safe-output temporary IDs to repo memory (#60789)
• 12f29c3 [instructions] Sync assign-to-agent docs with reasoning-effort field (#60800)
• 19f3182 Test wildcard JSONL cache sharding in live logs integration (#60782)
• 70581f4 Simplify operational-value grading to one-shot evaluators (#60682)
• a013f5a docs: unbloat frontmatter reference (#60713)
• aa0cabf Add weekly blog post for 2026-09-14 (#60729)
• c3d7c9e Support wildcard cached logs files (#60702)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟢 Approval recommended

Both reviewed workflow updates are consistent and preserve existing configuration.

Review effort: Lite
Findings: None

What changed in this PR

Updates the pinned github/gh-aw/actions/setup-cli action from v0.88.7 to v0.89.14.

Changes:

• Updates the action pins in both workflows.
• Preserves existing CLI version pins.

File	Summary
.github/​workflows/​copilot-setup-steps.yml	Updates the gh-aw setup action.
.github/​workflows/​check-agentic-workflows.yml	Updates the gh-aw setup action.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.