ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.89.21

[dependabot]

Bumps github/gh-aw/actions/setup from 0.81.6 to 0.89.21.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.89.21

🌟 Release Highlights

This release brings native web-search support for the Copilot engine, more flexible reusable-workflow failure reporting, and hardened safe-outputs checkout detection.

✨ What's New

• Native web-search on the Copilot engine — tools: web-search: now compiles to Copilot's built-in web_search tool (--allow-tool web_search) instead of producing a compile warning, making web search usable even in repos without GitHub tooling (e.g. Azure DevOps-hosted). See Web Search reference. (#62957)
• Dynamic failure-issue-repo for reusable workflows — safe-outputs.failure-issue-repo now accepts ${{ inputs.* }} expressions, matching existing support for report-failure-as-issue and report-failed-jobs, so reusable (workflow_call) workflows can route failure issues per caller without patching the compiled lock file. (#62945)
• Gateway steering events in audit output — gh aw audit now surfaces token_steering and timeout_steering events (type, message, timestamp) as gateway_steering_events in both JSON and console output, making it easier to see when runs are approaching AI Credit or time limits. (#62943)

🐛 Bug Fixes & Improvements

• Fixed cancelled AIC component accounting — cancelled compiler-owned component jobs are now only counted as zero AI Credits when GitHub job metadata proves execution never started; jobs with assigned runners, steps, or incomplete metadata are still accounted for correctly. (#62984)
• Safe-outputs checkout detection fixed for nested repos — the find_repo_checkout git-scan fallback now trusts scanned repositories cloned via a steps: entry or manual actions/checkout, fixing a regression where the containerized safe-outputs MCP server (different UID) couldn't read nested checkouts due to git's safe.directory trust not propagating beyond GITHUB_WORKSPACE. (#62944)

📚 Documentation

• Stale lock-file detection guidance — new docs explain how to detect stale/missing compiled .lock.yml files via gh aw list --json for CI enforcement, plus remediation steps for contributors. (#62947)
• Portable OTLP helper paths — OpenTelemetry/qmd examples now resolve the helper via RUNNER_TEMP instead of a hardcoded /tmp, for portability across runner environments. (#62940)

🔧 Internal

• Updated GitHub Actions versions and refreshed parser/repoutil/semverutil/sliceutil spec extractions.

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

• o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

Generated by 🚀 Release · copilot · auto · 21.7 AIC · ⊞ 11.6K

---

What's Changed

• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @​github-actions[bot] in github/gh-aw#62922

... (truncated)

Changelog

Sourced from github/gh-aw/actions/setup's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• c353937 Report gateway steering events in audit output (#62943)
• 7f9138d Fix cancelled daily AIC component accounting (#62984)
• 9ef513c Support native web-search on the Copilot engine (#62957)
• 73bc75d Document stale agentic workflow lock detection (#62947)
• d424601 Allow ${{ inputs.* }} expressions in safe-outputs.failure-issue-repo for ...
• 403aefe Add Agent of the Day blog post for 2026-09-23: Daily Caveman Optimizer (#62969)
• bd6aa2e Use portable path for OTLP helper guidance (#62940)
• 7334b08 [actions] Update GitHub Actions versions - 2026-09-23 (#62899)
• 273c72c Update package specifications for parser, repoutil, semverutil, sliceutil (#6...
• 606cfab docs: unbloat repo assist example (#62822)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.