[CI] Agentic workflows: Update gh-aw workflows to v0.82.14

[PureWeen]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Summary

Updates all repository agentic workflows from gh-aw v0.81.6 to the latest stable v0.82.14 and repairs the PAT-pool source shape that prevented regeneration with the new compiler.

Root Cause

The v0.82.14 compiler emitted invalid generated YAML for the multiline engine.env.COPILOT_GITHUB_TOKEN case() expressions used by all 14 workflows (non-map value is specified). This was a compiler/source-shape incompatibility, not an organization-billing or PAT-authentication failure. Audited v0.81.6 runs showed the existing copilot-pat-pool job, Copilot inference, and safe outputs completing successfully.

Changes

• Normalize all PAT-pool COPILOT_GITHUB_TOKEN expressions to compiler-safe single-line scalars.
• Preserve the environment-scoped PAT pool; do not add permissions: copilot-requests: write or org-billed inference.
• Apply supported v0.82.14 migrations, including top-level model fields and checkout: false for the pull_request_target labeler.
• Add explicit protected-file blocking to code-writing workflows.
• Update gh-aw action pins, dispatcher assets, PAT-pool documentation, and the PAT validator.
• Regenerate all 14 .lock.yml files and agentics-maintenance.yml with gh-aw v0.82.14.
• Remove the obsolete local agentic workflow designer skill replaced by the v0.82.14 dispatcher route.

Validation

• gh aw compile --approve --strict --validate --schedule-seed dotnet/maui --verbose — 14/14 workflows compiled successfully.
• Trial-mode compile against PureWeen/maui — 14/14 workflows compiled successfully.
• gh aw trial ... --clone-repo PureWeen/maui --dry-run accepted all 14 workflows without changes.
• gh aw fix reports no remaining migrations.
• All 14 lock files report compiler v0.82.14.
• Structural YAML parsing passed for all locks, maintenance, and PAT validation workflows.
• PAT-pool preservation checks confirm all workflows still use COPILOT_GITHUB_TOKEN and none grant copilot-requests: write.

Container-backed actionlint, zizmor, and poutine could not run locally because the Docker Desktop daemon was unavailable.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36705

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36705"

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Skill Validation Results

@PureWeen — new skill validation results are available based on this last commit: 65a0cf2.
To request a fresh validation after new comments or commits, comment /evaluate-skills.

✅ Skill Validation Results — 65a0cf2 · [CI] Agentic workflows: Update gh-aw workflows to v0.82.14 · 2026-07-21T19:18:29Z

✅ Static Checks Passed

Skills: 23 | Eval specs linted: 11

Full lint output

── .github/skills/agentic-labeler/tests/eval.vally.yaml
npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
✔ .github/skills/agentic-labeler/tests/eval.vally.yaml is valid
── .github/skills/analyze-sessions/tests/eval.vally.yaml
✔ .github/skills/analyze-sessions/tests/eval.vally.yaml is valid
── .github/skills/code-review/tests/eval.capability.vally.yaml
✔ .github/skills/code-review/tests/eval.capability.vally.yaml is valid
── .github/skills/code-review/tests/eval.inline-findings.vally.yaml
✔ .github/skills/code-review/tests/eval.inline-findings.vally.yaml is valid
── .github/skills/code-review/tests/eval.trim-aot.vally.yaml
✔ .github/skills/code-review/tests/eval.trim-aot.vally.yaml is valid
── .github/skills/code-review/tests/eval.vally.yaml
✔ .github/skills/code-review/tests/eval.vally.yaml is valid
── .github/skills/code-review/tests/hermeticity.vally.yaml
✔ .github/skills/code-review/tests/hermeticity.vally.yaml is valid
── .github/skills/evaluate-pr-tests/tests/eval.vally.yaml
✔ .github/skills/evaluate-pr-tests/tests/eval.vally.yaml is valid
── .github/skills/pr-review/tests/eval.gh-auth.vally.yaml
✔ .github/skills/pr-review/tests/eval.gh-auth.vally.yaml is valid
── .github/skills/try-fix/tests/eval.vally.yaml
✔ .github/skills/try-fix/tests/eval.vally.yaml is valid
── .github/skills/verify-tests-fail-without-fix/tests/eval.vally.yaml
✔ .github/skills/verify-tests-fail-without-fix/tests/eval.vally.yaml is valid

⏭️ LLM Evaluation: Skipped

No changed skills with eval specs found.

🔍 Full results and investigation steps

[Copilot]

Pull request overview

This PR upgrades the repository’s GitHub Agentic Workflows (gh-aw) footprint from v0.81.6 to v0.82.14, including source workflow frontmatter migrations, PAT-pool expression normalization for compiler compatibility, and regeneration of the compiled .lock.yml workflows.

Changes:

• Update gh-aw action pins / Copilot CLI version and apply v0.82.14 frontmatter migrations (e.g., top-level model, checkout: false for labeler).
• Normalize PAT-pool COPILOT_GITHUB_TOKEN case() expressions to single-line scalars to avoid v0.82.14 YAML materialization issues.
• Regenerate compiled lock workflows and maintenance workflow, and update in-repo gh-aw dispatcher skill/agent docs.

Show a summary per file

File	Description
.github/workflows/validate-pat-pool.yml	Bumps gh-aw setup action and Copilot CLI used to validate PAT pool entries.
.github/workflows/shared/pat_pool.README.md	Documents v0.82.14 requirement and single-line PAT case() expression constraint.
.github/workflows/rerun-review-scanner.md	Updates checkout action version and flattens PAT case() expression.
.github/workflows/regression-corpus-scanner.md	Moves model to top-level and flattens PAT case() expression; updates checkout action.
.github/workflows/leak-fixer.md	Moves model to top-level, flattens PAT case() expression, and adds protected-files blocking.
.github/workflows/daily-repo-status.md	Flattens PAT case() expression.
.github/workflows/daily-repo-status.lock.yml	Regenerated compiled workflow with gh-aw v0.82.14, updated actions/containers, and new guard steps.
.github/workflows/daily-leak-hunter.md	Moves model to top-level and flattens PAT case() expression.
.github/workflows/copilot-review-tests.md	Moves model to top-level and flattens PAT case() expression.
.github/workflows/copilot-evaluate-tests.md	Moves model to top-level and flattens PAT case() expression.
.github/workflows/ci-status-net11.md	Moves model to top-level and flattens PAT case() expression.
.github/workflows/ci-status-main.md	Moves model to top-level and flattens PAT case() expression.
.github/workflows/ci-status-fix.md	Moves model to top-level, flattens PAT case() expression, and adds protected-files blocking to safe-outputs.
.github/workflows/ci-status-fix-net11.md	Same as ci-status-fix.md but for net11 workflow variant.
.github/workflows/aw-version-update.md	Flattens PAT case() expression.
.github/workflows/aw-actions-update.md	Flattens PAT case() expression while keeping GH_TOKEN usage documented.
.github/workflows/agentics-maintenance.yml	Regenerated maintenance workflow and splits expired-entity closing into separate jobs with scoped permissions.
.github/workflows/agentic-labeler.md	Switches to checkout: false for pull_request_target safety and flattens PAT case() expression.
.github/skills/agentic-workflows/SKILL.md	Updates dispatcher guidance and adds optional repo overlay instruction hook.
.github/skills/agentic-workflow-designer/SKILL.md	Removes obsolete local designer skill in favor of upstream dispatcher route.
.github/aw/actions-lock.json	Updates pinned action versions/SHAs (checkout, setup-node, gh-aw setup actions).
.github/agents/agentic-workflows.md	Updates agent dispatcher documentation and upstream reference URLs (noted issues in PR comments).

Copilot's findings

• Files reviewed: 27/35 changed files
• Comments generated: 2

[kubaflo]

Multi-model review — PR #36705 · LGTM ✅

Three independent model reviews (Claude Opus 4.8 · GPT-5.5 · Gemini 3.1 Pro) plus orchestrator verification. Unanimous LGTM, high confidence, zero blocking findings. This is a clean, security-positive maintenance PR.

What it does

• Bumps all 14 agentic workflows gh-aw v0.81.6 → v0.82.14 (regenerated .lock.yml + setup/setup-cli pins; actions/checkout v7.0.0→v7.0.1, actions/setup-node v6.4.0→v7.0.0).
• PAT-pool source-shape repair: collapses the multiline COPILOT_GITHUB_TOKEN: | ${{ case(...) }} to a single-line case(...) and moves model: from engine.model to the top-level key — v0.82.14 no longer preserves indentation when materializing multiline engine.env, which was emitting invalid YAML and blocking regeneration.
• Security hardening (additive): protected-files: blocked on create-pull-request + push-to-pull-request-branch (ci-status-fix / -net11 / leak-fixer); agentic-labeler → checkout: false.
• Skill consolidation (delete agentic-workflow-designer, redirect to upstream .github/aw/designer.md, add repo overlay).

Verification (each claim checked against the generated lock at 43fccf43)

Area	Result
case() collapse	All 10 PAT branches (0–9) + 'NO COPILOT PAT AVAILABLE' fallback preserved, in order, across all 14 workflows; compiled locks unchanged; pat_pool gate green ✅
model: relocation	Lock still resolves claude-opus-4.8 (agent_model / GH_AW_ENGINE_MODEL / COPILOT_MODEL); no model line changed base→head ✅
agentic-labeler checkout: false	PR-branch checkout + restore_base_github_folders.sh removed from the secret-bearing job; PR data read via GitHub MCP; SKILL.md still provisioned from base. Net security improvement, no functional regression ✅
protected-files: blocked	Compiles to protected_files_policy:"blocked" ×2 in all 3 workflows; PublicAPI.Unshipped.txt is not on the protected list, so routine ci-fix paths are unaffected ✅
Deleted skill	No dangling references remain in the head tree ✅
Action pins	actions-lock.json SHAs/versions internally consistent and match upstream tags ✅
Compiler-behavior comments	create/push → protected_files_policy:blocked; add_labels + mark_ready now emit required_title_prefix+required_labels; update_pull_request still allow_title:false/no required-* — all 4 updated notes accurate ✅

CI

No failures. The agentic gates that actually validate this PR are green: pat_pool (shape repair runs), activation/agent/safe_outputs/pre_activation/detection/conclusion (regenerated locks compile + run), Skill Validation/Static validation/skill-validation. maui-pr correctly skips (full build isn't triggered by workflow-only changes); Build Analysis non-blocking.

💡 Informational (no action needed)

• protected-files: blocked is a policy upgrade — it changes enforcement from the default request_review to hard blocked, so a run touching a protected manifest is now rejected outright rather than flagged. Worth reviewers knowing the enforcement got stricter (this is the intended defense-in-depth).

Verdict: LGTM (high). Approving.

🤖 AI-generated multi-model review (GitHub Copilot CLI, on behalf of @kubaflo).

[Copilot]

Copilot's findings

• Files reviewed: 27/35 changed files
• Comments generated: 0 new

[kubaflo]

Re-approve after new commit 65a0cf28 — LGTM ✅

Re-verified the delta since my prior (auto-dismissed) approval at 43fccf43. One commit, one file:

• .github/agents/agentic-workflows.md (+25/−15, "Fix gh-aw dispatcher references"): version-pins the gh-aw doc reference URLs from github/gh-aw/main/... → github/gh-aw/v0.82.14/... (matching this PR's compiler bump — improves reproducibility over a moving main), and adds one new ASCII Charts reference section.

Pure documentation in the agent-definition file — no workflow/lock/code/security surface. Nothing here changes the unanimous 3-model (Opus 4.8 · GPT-5.5 · Gemini 3.1 Pro) zero-finding LGTM from the prior round. skill-validation green; no required check red (maui-pr correctly skips workflow-only changes).

Verdict: LGTM (high). Re-approving.

🤖 AI-generated multi-model review (GitHub Copilot CLI, on behalf of @kubaflo).