Upgrade agentic workflows to gh-aw 0.86.2

[PureWeen]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Summary

Upgrade all 14 repository agentic workflows to stable gh-aw v0.86.2 so they use one consistent generated runtime instead of leaving unaffected workflows on the same vulnerable v0.85.4 path handling.

Root cause and outage evidence

The CI scanner/fixer workflows failed after Copilot CLI toolcache cache hits because their v0.85.4 locks hardcoded /usr/local/bin/copilot, which did not exist on the runner. The latest failures were:

• Main scanner: 32032695269
• net11 scanner: 32032695241
• Main fixer: 32029938943
• net11 fixer: 32030214368

Stable gh-aw v0.86.2 includes github/gh-aw#51275. Its generated runtime resolves Copilot CLI from PATH, stages it at ${RUNNER_TEMP}/gh-aw/bin/copilot, and passes that sandbox-visible path to the harness for both agent and threat-detection execution.

Security and scope

agentic-labeler.md now explicitly sets tools.bash: false, satisfying v0.86.2 strict-mode requirements for its intentional min-integrity: none GitHub MCP reads while preserving a no-shell agent. Its deterministic on.steps are unaffected.

All other changes are compiler-generated runtime updates across the 14 .lock.yml files. Workflow business logic, prompts, triggers, permissions, and safe-output contracts are unchanged.

Validation

• gh aw compile with all 14 workflow IDs: 14 succeeded
• All locks report compiler v0.86.2 and Copilot engine 1.0.79
• Agent and threat-detection paths use PATH resolution plus ${RUNNER_TEMP}/gh-aw/bin/copilot
• No /usr/local/bin/copilot references remain
• agentic-labeler exposes GitHub/safe-output tools with no shell allowance
• Native actionlint passed all 14 generated locks
• Scanner/fixer and test-review runtime symmetry checks passed
• git diff --check passed

The compiler retains one preexisting warning for copilot-evaluate-tests configuring both slash_command and bots. Shellcheck reports only generated SC2129 style advisories for repeated output redirects.

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 37549

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 37549"

[Copilot]

Pull request overview

This pull request updates the generated GitHub Actions “lock” workflows for the CI failure scanner/fixer automation to a newer gh-aw compiler/runtime, addressing recent workflow failures caused by hardcoded Copilot CLI paths after toolcache hits.

Changes:

• Recompiled the ci-status-* scanner and fixer lock workflows with gh-aw v0.86.2 (metadata/actions/container pins updated accordingly).
• Updated the generated runtime logic to stage and pass a runner-visible Copilot CLI path (and related runtime plumbing updates produced by the new compiler).
• Refreshed generated activation/prompt/threat-detection handling in the lock files (prompt generation/staging, detection scripts, and related outputs).

Show a summary per file

File	Description
.github/workflows/ci-status-main.lock.yml	Regenerated main-branch CI failure scanner lock workflow with gh-aw v0.86.2 and updated runtime steps/pins.
.github/workflows/ci-status-net11.lock.yml	Regenerated net11 CI failure scanner lock workflow with gh-aw v0.86.2 and updated runtime steps/pins.
.github/workflows/ci-status-fix.lock.yml	Regenerated main-branch CI failure fixer lock workflow with gh-aw v0.86.2, including updated safe-output/runtime schema and supporting steps.
.github/workflows/ci-status-fix-net11.lock.yml	Regenerated net11 CI failure fixer lock workflow with gh-aw v0.86.2, including updated safe-output/runtime schema and supporting steps.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 15/15 changed files
• Comments generated: 0 new
• Review effort level: Lite