build(deps): bump github/gh-aw from 0.58.0 to 0.65.0

[dependabot]

Bumps github/gh-aw from 0.58.0 to 0.65.0.

Release notes

Sourced from github/gh-aw's releases.

v0.64.4

🌟 Release Highlights

This release delivers safe-output tooling improvements, sibling import resolution, and enhanced runner flexibility — driven largely by community feedback from @j-srodka.

✨ What's New

• runs-on-slim for compile-stable jobs — Override the runner for compile-stable framework jobs using the new runs-on-slim key, giving you precise control over job execution environments (#23490)
• Compile-time validation of safe-output job ordering — The compiler now validates needs: ordering on custom safe-output jobs at compile time, catching dependency misconfigurations before they reach runtime (#23486)
• DIFC proxy feature flag — The new difc-proxy feature flag gates DIFC proxy emission, enabling opt-in integrity enforcement for supported environments (#23471)

🐛 Bug Fixes & Improvements

• Sibling nested imports resolved correctly — ./file.md imports now resolve relative to the parent file's directory, fixing broken modular workflow imports (#23475)
• Custom tools included in <safe-output-tools> prompt — Custom jobs, scripts, and actions are now surfaced in the <safe-output-tools> prompt block so agents are aware of all available safe-output mechanisms (#23487)
• Repo-memory concurrency scope tightened — Push concurrency keys are now scoped to the actual branch target, eliminating unnecessary serialization across unrelated branches (#23489)
• MCP error message clarity — Docker-unavailable error messages now use correct parameter syntax for MCP compatibility (#23515)

📚 Documentation

• MemoryOps guide streamlined for better readability (#23506)
• Broken anchor link in safe-outputs specification fixed (#23474)

🌍 Community Contributions

@j-srodka

• Generated jobs lack a compile-stable runner override/inheritance mechanism (direct issue)
• Compiled (safe-output-tools) can omit custom safe-output tools/jobs (direct issue)
• Custom safe-output jobs cannot declare needs / ordering relative to generated jobs (direct issue)
• Compiler-generated repo-memory push concurrency is broader than the actual write surface (direct issue)

---

For complete details, see CHANGELOG.

Generated by Release

---

What's Changed

• [docs] Self-healing documentation fixes from issue analysis - 2026-03-29 by @​github-actions[bot] in github/gh-aw#23460
• fix: add Node.js 24 runtime to daily-multi-device-docs-tester by @​Copilot in github/gh-aw#23464
• feat: guard DIFC proxy emission with difc-proxy feature flag by @​Copilot in github/gh-aw#23471

... (truncated)

Changelog

Sourced from github/gh-aw's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• 89ae1c2 Fix argument injection in npm/pip/docker package validators (#23374)
• eefc97d Bump MCP gateway default version to v0.2.8 (#23372)
• 4549e7b Fix DIFC proxy GH_HOST mismatch for user-defined setup steps (#23367)
• 531594a Security: exclude all secret-bearing env vars from agent container via AWF --...
• 8f8f67b Apply DIFC integrity filtering to the main agent job (post-activation only) (...
• 0962ba0 fix: propagate assign-to-agent failure to status comment (#23362)
• 89bb63b Add item_type, item_number, and comment_id to aw_context for current item res...
• 4abbaff refactor: semantic function clustering — consolidate, move, rename, and split...
• 06e7339 Apply progressive disclosure to agent failure issues (#23361)
• 21e679c Fix update-discussion API error logging for explicit discussion_number (#23340)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Wallace Breza (wbreza)]

The functional changes look safe (CI passes, destination param is explicitly set everywhere, renamed output isn't referenced). However, the action references need to be pinned to commit SHAs per repo convention.

All 13 occurrences across the 3 .lock.yml files use @v0.65.0 (floating tag) but should be pinned:

# Current:
uses: github/gh-aw/actions/setup@v0.65.0
# Should be:
uses: github/gh-aw/actions/setup@7c193ac298524426fda3c54380651a102cb8813c # v0.65.0

Files affected:

• .github/workflows/analyze-test-run.lock.yml
• .github/workflows/issue-triage.lock.yml
• .github/workflows/weekly-repo-status.lock.yml

[msalaman]

These files should not be edited directly, they should be updated automatically via github AW workflows commands in github cli, currently working on that

[dependabot]

Looks like github/gh-aw is no longer a dependency, so this is no longer needed.

[msalaman]

Properly updated gh-aw with this PR vis GH CLI #1698, this PR can be close

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.