Fix PR duplicate check not running on external contributor submissions (#2188)

* Initial plan

* Fix PR duplicate check not running on external contributor submissions

Add forks: [\"*\"] and roles: all to pr-duplicate-check.md so the
agentic workflow runs for all PR authors, including external contributors
submitting from forks. Previously, the generated lock.yml contained:
- A fork repository check blocking all fork PRs from running
- A team membership check (admin/maintainer/write) blocking external contributors

Recompiled with gh aw compile to regenerate pr-duplicate-check.lock.yml.
The pre_activation job (which held the membership gate) is now removed,
and the activation job runs unconditionally for all pull_request events.

Closes #2121

Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* fixing a bunch of warnings on all the agentic workflows

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

.github/aw/actions-lock.json

@@ -20,15 +20,15 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup@v0.80.9": {
+    "github/gh-aw-actions/setup@v0.81.6": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.80.9",
+      "version": "v0.81.6",
-      "sha": "8c7d04ebf1ece56cd381446125da3e0f6896294a"
+      "sha": "ba6380cc6e5be5d21677bebe04d52fb48e3abec7"
     },
-    "github/gh-aw/actions/setup@v0.80.9": {
+    "github/gh-aw/actions/setup@v0.81.6": {
       "repo": "github/gh-aw/actions/setup",
-      "version": "v0.80.9",
+      "version": "v0.81.6",
-      "sha": "a3624368c4e7d877586ff2784b61de73405e2cdd"
+      "sha": "eed4304d8740f0593f2797276cb8299d228ffd9b"
     }
   }
 }

.github/skills/agentic-workflows/SKILL.md

@@ -27,8 +27,12 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/experiments.md`
 - `.github/aw/github-agentic-workflows.md`
 - `.github/aw/github-mcp-server.md`
+- `.github/aw/instructions.md`
 - `.github/aw/llms.md`
+- `.github/aw/loop.md`
+- `.github/aw/lsp.md`
 - `.github/aw/mcp-clis.md`
+- `.github/aw/memory-stateful-patterns.md`
 - `.github/aw/memory.md`
 - `.github/aw/messages.md`
 - `.github/aw/network.md`

.github/workflows/agentics-maintenance.yml

@@ -1,614 +0,0 @@
-# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.80.9). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
-#
-#    ___                   _   _      
-#   / _ \                 | | (_)     
-#  | |_| | __ _  ___ _ __ | |_ _  ___ 
-#  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
-#  | | | | (_| |  __/ | | | |_| | (__ 
-#  \_| |_/\__, |\___|_| |_|\__|_|\___|
-#          __/ |
-#  _    _ |___/ 
-# | |  | |                / _| |
-# | |  | | ___ _ __ _  __| |_| | _____      ____
-# | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
-# \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
-#  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
-#
-#
-# To regenerate this workflow, run:
-#   gh aw compile
-# Not all edits will cause changes to this file.
-#
-# For more information: https://github.github.com/gh-aw/introduction/overview/
-#
-# This file defines the generated agentic maintenance workflow for this repository.
-# It runs scheduled cleanup for expiring safe outputs and supports manual maintenance operations.
-# 
-# This workflow is generated automatically when workflows use expiring safe outputs
-# or when repository maintenance features are enabled in .github/workflows/aw.json.
-# 
-# To disable maintenance workflow generation, set in .github/workflows/aw.json:
-# {"maintenance": false}
-# 
-# Agentic maintenance docs:
-# https://github.github.com/gh-aw/reference/ephemerals/#manual-maintenance-operations
-#
-name: Agentic Maintenance
-
-on:
-  schedule:
-    - cron: "37 0 * * *"  # Daily (based on minimum expires: 30 days)
-  workflow_dispatch:
-    inputs:
-      operation:
-        description: 'Optional maintenance operation to run'
-        required: false
-        type: choice
-        default: ''
-        options:
-          - ''
-          - 'disable'
-          - 'enable'
-          - 'update'
-          - 'upgrade'
-          - 'safe_outputs'
-          - 'create_labels'
-          - 'activity_report'
-          - 'close_agentic_workflows_issues'
-          - 'clean_cache_memories'
-          - 'update_pull_request_branches'
-          - 'validate'
-          - 'forecast'
-      run_url:
-        description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
-        required: false
-        type: string
-        default: ''
-  workflow_call:
-    inputs:
-      operation:
-        description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate, forecast)'
-        required: false
-        type: string
-        default: ''
-      run_url:
-        description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
-        required: false
-        type: string
-        default: ''
-    outputs:
-      operation_completed:
-        description: 'The maintenance operation that was completed (empty when none ran or a scheduled job ran)'
-        value: ${{ jobs.run_operation.outputs.operation || inputs.operation }}
-      applied_run_url:
-        description: 'The run URL that safe outputs were applied from'
-        value: ${{ jobs.apply_safe_outputs.outputs.run_url }}
-
-permissions: {}
-
-jobs:
-  close-expired-entities:
-    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-slim
-    permissions:
-      discussions: write
-      issues: write
-      pull-requests: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Close expired discussions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
-            await main();
-
-      - name: Close expired issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
-            await main();
-
-      - name: Close expired pull requests
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
-            await main();
-
-  cleanup-cache-memory:
-    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Cleanup outdated cache-memory entries
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/cleanup_cache_memory.cjs');
-            await main();
-
-  run_operation:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && inputs.operation != 'forecast' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-      contents: write
-      pull-requests: write
-    outputs:
-      operation: ${{ steps.record.outputs.operation }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          version: v0.80.9
-
-      - name: Run operation
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_AW_OPERATION: ${{ inputs.operation }}
-          GH_AW_CMD_PREFIX: gh aw
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/run_operation_update_upgrade.cjs');
-            await main();
-
-      - name: Record outputs
-        id: record
-        env:
-          GH_AW_OPERATION: ${{ inputs.operation }}
-        run: echo "operation=$GH_AW_OPERATION" >> "$GITHUB_OUTPUT"
-
-  update_pull_request_branches:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'update_pull_request_branches' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Update pull request branches
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/update_pull_request_branches.cjs');
-            await main();
-
-  apply_safe_outputs:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    permissions:
-      actions: read
-      contents: write
-      discussions: write
-      issues: write
-      pull-requests: write
-    outputs:
-      run_url: ${{ steps.record.outputs.run_url }}
-    steps:
-      - name: Checkout actions folder
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          sparse-checkout: |
-            actions
-          persist-credentials: false
-
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Apply Safe Outputs
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_AW_RUN_URL: ${{ inputs.run_url }}
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/apply_safe_outputs_replay.cjs');
-            await main();
-
-      - name: Record outputs
-        id: record
-        env:
-          GH_AW_RUN_URL: ${{ inputs.run_url }}
-        run: echo "run_url=$GH_AW_RUN_URL" >> "$GITHUB_OUTPUT"
-
-  create_labels:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          version: v0.80.9
-
-      - name: Create missing labels
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_AW_CMD_PREFIX: gh aw
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/create_labels.cjs');
-            await main();
-
-  activity_report:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 120
-    permissions:
-      actions: read
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          version: v0.80.9
-
-      - name: Restore activity report logs cache
-        id: activity_report_logs_cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ./.cache/gh-aw/activity-report-logs
-          key: ${{ runner.os }}-activity-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
-          restore-keys: |
-            ${{ runner.os }}-activity-report-logs-${{ github.repository }}-
-            ${{ runner.os }}-activity-report-logs-
-      - name: Download activity report logs
-        timeout-minutes: 20
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_AW_CMD_PREFIX: gh aw
-        run: |
-          ${GH_AW_CMD_PREFIX} logs \
-            --repo "${{ github.repository }}" \
-            --start-date -1w \
-            --count 500 \
-            --output ./.cache/gh-aw/activity-report-logs \
-            --format markdown \
-            --report-file ./.cache/gh-aw/activity-report-logs/report.md
-
-      - name: Save activity report logs cache
-        if: ${{ always() }}
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ./.cache/gh-aw/activity-report-logs
-          key: ${{ steps.activity_report_logs_cache.outputs.cache-primary-key }}
-
-      - name: Generate activity report issue
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const fs = require('node:fs');
-            const reportPath = './.cache/gh-aw/activity-report-logs/report.md';
-            if (!fs.existsSync(reportPath)) {
-              core.warning('Activity report markdown not found at ' + reportPath + '; skipping issue creation.');
-              return;
-            }
-            let reportBody = '';
-            try {
-              reportBody = fs.readFileSync(reportPath, 'utf8').trim();
-            } catch (error) {
-              core.warning('Failed to read activity report markdown at ' + reportPath + ': ' + error.message);
-              return;
-            }
-            if (!reportBody) {
-              core.warning('Activity report markdown is empty at ' + reportPath + '; skipping issue creation.');
-              return;
-            }
-            const repoSlug = context.repo.owner + '/' + context.repo.repo;
-            const body = [
-              '### Agentic workflow activity report',
-              '',
-              'Repository: ' + repoSlug,
-              'Generated at: ' + new Date().toISOString(),
-              '',
-              reportBody,
-            ].join('\n');
-            const createdIssue = await github.rest.issues.create({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              title: '[aw] agentic status report',
-              body,
-              labels: ['agentic-workflows'],
-            });
-            core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);
-
-  forecast_report:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'forecast' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 60
-    permissions:
-      actions: read
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          version: v0.80.9
-
-      - name: Restore forecast report logs cache
-        id: forecast_report_logs_cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ./.github/aw/logs
-          key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
-          restore-keys: |
-            ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-
-            ${{ runner.os }}-forecast-report-logs-
-
-      - name: Generate forecast report
-        id: generate_forecast_report
-        timeout-minutes: 30
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEBUG: "*"
-          GH_AW_CMD_PREFIX: gh aw
-        run: |
-          mkdir -p ./.cache/gh-aw/forecast
-          set +e
-          ${GH_AW_CMD_PREFIX} forecast --repo "${{ github.repository }}" --timeout 30 --verbose --json > ./.cache/gh-aw/forecast/report.json
-          forecast_exit_code=$?
-          set -e
-          if [ "${forecast_exit_code}" -eq 124 ]; then
-            echo '{"outcome":"timeout","message":"Forecast computation timed out after 30 minutes."}' > ./.cache/gh-aw/forecast/error.json
-            echo "::error::Forecast computation timed out after 30 minutes."
-            exit 1
-          fi
-          if [ "${forecast_exit_code}" -ne 0 ]; then
-            echo '{"outcome":"error","message":"Forecast computation failed before producing a report."}' > ./.cache/gh-aw/forecast/error.json
-            echo "::error::Forecast computation failed with exit code ${forecast_exit_code}."
-            exit 1
-          fi
-
-      - name: Debug forecast logs folder
-        if: ${{ always() }}
-        shell: bash
-        run: |
-          if [ ! -d ./.github/aw/logs ]; then
-            echo "Logs directory not found: ./.github/aw/logs"
-            exit 0
-          fi
-          echo "Files under ./.github/aw/logs:"
-          find ./.github/aw/logs -type f | sort
-
-      - name: Save forecast report logs cache
-        if: ${{ always() }}
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ./.github/aw/logs
-          key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
-
-      - name: Generate forecast issue
-        if: ${{ always() }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          FORECAST_STEP_OUTCOME: ${{ steps.generate_forecast_report.outcome }}
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/create_forecast_issue.cjs');
-            await main();
-
-  close_agentic_workflows_issues:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'close_agentic_workflows_issues' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-slim
-    permissions:
-      issues: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Close no-repro agentic-workflows issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_agentic_workflows_issues.cjs');
-            await main();
-
-  validate_workflows:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-
-      - name: Check admin/maintainer permissions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
-            await main();
-
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
-        with:
-          version: v0.80.9
-
-      - name: Validate workflows and file issue on findings
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_AW_CMD_PREFIX: gh aw
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/run_validate_workflows.cjs');
-            await main();

.github/workflows/cli-for-beginners-sync.md

@@ -5,6 +5,7 @@ on:
   schedule: weekly
 permissions:
   contents: read
+  copilot-requests: write
 tools:
   github:
     toolsets: [repos]

.github/workflows/codeowner-update.md

@@ -8,6 +8,7 @@ permissions:
   contents: read
   pull-requests: read
   issues: read
+  copilot-requests: write
 tools:
   github:
     toolsets: [default]

.github/workflows/copilot-setup-steps.yml

@@ -21,6 +21,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install gh-aw extension
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup-cli@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
         with:
-          version: v0.80.9
+          version: v0.81.6

.github/workflows/duplicate-resource-detector.md

@@ -5,6 +5,7 @@ on:
 permissions:
   contents: read
   issues: read
+  copilot-requests: write
 tools:
   github:
     toolsets: [repos, issues]

.github/workflows/learning-hub-updater.md

@@ -6,6 +6,7 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+  copilot-requests: write
 tools:
   bash: ["curl", "gh"]
   edit:
@@ -85,4 +86,4 @@ Create a pull request with your changes, using the `main` branch as the base bra
 2. What sections of the guide were updated
 3. Links to the source announcements
 
-The PR should target the `main` branch and include the labels `automated-update` and `copilot-updates`.
+The PR should target the `main` branch and include the labels `automated-update` and `copilot-updates`.

.github/workflows/pr-duplicate-check.md

@@ -1,11 +1,14 @@
 ---
 description: 'Checks PRs for potential duplicate agents, instructions, skills, and workflows already in the repository'
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
+  roles: all
+checkout: false
 permissions:
   contents: read
   pull-requests: read
+  copilot-requests: write
 tools:
   github:
     toolsets: [repos, pull_requests]

.github/workflows/resource-staleness-report.md

@@ -4,6 +4,7 @@ on:
   schedule: weekly
 permissions:
   contents: read
+  copilot-requests: write
 tools:
   github:
     toolsets: [repos]