ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.90.2

[dependabot]

Bumps github/gh-aw/actions/setup from 0.81.6 to 0.90.2.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.90.1

🌟 Release Highlights

This release expands ledger support for repo-memory and deepens audit visibility into usage, threat detection, and experiments.

✨ What's New

• Standalone safe-output-backed ledgers with replay projections, and default ledgers preserved when importing shared workflows (#64354, #64420, #64464)
• Richer audit and usage artifacts: ledger transactions, threat-detection outcomes, experiment/evals data, and friction costs attributed to audit sources (#64509, #64506, #64339, #64338)
• Narrowed add-labels schemas for triage workflows and required-labels gating for assign-to-agent (#64179, #64266, #64174)
• Self-hosted runner enforcement at compile time (#64173)
• Sandbox frontmatter fields normalized to kebab-case (#64302)

🐛 Bug Fixes & Improvements

• Honor runtimes.node action override in threat-detection and evals Setup Node.js steps (#64498)
• Handle malformed aw_context in manual dispatches (#64335)
• Preserve version labels on SHA-pinned actions and resolvable safe-output targets (#64175, #64176)
• Infer Copilot wire API for utility model variants (#64177)
• version output now written to stdout (#64336)
• Generated files filtered from reviewer PR diffs (#64357)
• Hardened private-to-public flow validation (#64267)
• Claude Code CLI updated to 2.1.280 and engine CLI pins refreshed (#64127, #64359)

📚 Documentation

• Documented the SEC-005 exemption for ledger pushes and trimmed the measuring-impact guide (#64499, #64375)

Generated by 🚀 Release · copilot · auto · 13.3 AIC · ⊞ 11.5K

---

What's Changed

• Fix upload-assets job summary formatting by @​pelikhan with @​Copilot in github/gh-aw#64089
• Add Daily Ecosystem Explorer agentic workflow by @​pelikhan with @​Copilot in github/gh-aw#64096
• Repoint pydantic-ai engine import from archived pydantic-ai-harness to pydantic/pydantic-ai by @​pelikhan with @​Copilot in github/gh-aw#64093
• Update generated Claude Code CLI to 2.1.280 by @​lpcox with @​Copilot in github/gh-aw#64127
• [docs] docs: unbloat MCP gateway changelog by @​github-actions[bot] in github/gh-aw#64145
• Preserve resolvable safe-output targets by @​pelikhan with @​Copilot in github/gh-aw#64176
• Preserve version labels on SHA-pinned workflow actions by @​pelikhan with @​Copilot in github/gh-aw#64175
• [docs] Update glossary - daily scan by @​github-actions[bot] in github/gh-aw#64244
• [spec-extractor] Update package specifications for stringutil, styles, testutil, timeutil by @​github-actions[bot] in github/gh-aw#64238
• [eslint-miner] Add no-single-char-string-replace rule by @​github-actions[bot] in github/gh-aw#64232
• [instructions] Sync instruction files with release v0.89.21 (follow-ups) by @​github-actions[bot] in github/gh-aw#64228
• [actions] Update GitHub Actions versions - 2026-09-29 by @​github-actions[bot] in github/gh-aw#64213
• Allow workflows to narrow add-labels item schemas by @​pelikhan with @​Copilot in github/gh-aw#64179
• Add required-labels gating to assign-to-agent by @​pelikhan with @​Copilot in github/gh-aw#64174
• Infer Copilot wire API for utility model variants by @​pelikhan with @​Copilot in github/gh-aw#64177
• Enable narrowed label schemas in triage workflows by @​pelikhan with @​Copilot in github/gh-aw#64266
• Enforce self-hosted runners during compilation by @​pelikhan with @​Copilot in github/gh-aw#64173
• Harden private-to-public flow validation by @​pelikhan with @​Copilot in github/gh-aw#64267

... (truncated)

Changelog

Sourced from github/gh-aw/actions/setup's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• 85fb425 Handle transient stdin reads in the safe-output transport (#65067)
• cf507f6 Add deterministic dispatch coordinator replay core (#65030)
• cd3a649 Add Git-backed work queue operator commands (#65062)
• 802f7af Set homepage social card short URL and add regression coverage (#65095)
• 83075e2 Add TLC execution witnesses for dispatch coordinator ADR review (#65075)
• 52f85db docs: redesign cleanup — specs, unused dependency, mobile line break (#64994)
• 1087c0d Recompile workflow lock files (#65070)
• b8bddc0 docs: new site chrome and docs reading polish (#64936)
• 91c9a69 docs: rebuild the landing page (#64935)
• 02ef47b docs: improve docs reading experience (#64937)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.