chore: sync actions from gh-aw@v0.89.15

[github-actions]

Automated sync of actions from gh-aw at v0.89.15.

[Copilot]

🟡 Changes recommended

Unresolved critical, moderate, and nit findings remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Synchronizes runtime actions from gh-aw@v0.89.15, adding billing diagnostics, release handling, safe-output metadata, temporary-ID support, and grader improvements.

Changes:

• Adds Copilot billing failure guidance.
• Supports draft-release lookup and artifact-backed IDs.
• Enhances manifests, review handling, metrics, and metadata.

File summaries

File	Reviewed change
setup/md/copilot_org_billing_error.md	Adds billing remediation guidance.
setup/md/agent_failure_issue.md	Adds billing failure context.
setup/md/agent_failure_comment.md	Adds billing failure context.
setup/js/update_release.cjs	Supports draft-release lookup and retries.
setup/js/trace_graders.cjs	Supports multi-metric grader results.
setup/js/temporary_id.cjs	Loads artifact-based ID maps.
setup/js/send_otlp_span.cjs	Removes obsolete grader telemetry.
setup/js/safe_outputs_tools.json	Nit (3 votes): update tag wording to include published or draft releases.
setup/js/safe_output_manifest.cjs	Moderate (1 vote): narrow GitHub provider inference for arbitrary results.
setup/js/safe_output_handler_manager.cjs	Critical (1 vote): preserve the temporary_id_map output or update its callers and contract.
setup/js/push_repo_memory.cjs	Applies artifact-based ID substitutions.
setup/js/pr_review_buffer.cjs	Resolves submitted review comment IDs.
setup/js/operational_value_grader.cjs	Supports metric-array evaluator results.
setup/js/handle_agent_failure.cjs	Detects billing-related failures.
setup/js/generate_usage_activity_summary.cjs	Parses detailed safe-output manifests.
setup/js/create_pull_request.cjs	Returns richer pull request metadata.
setup/js/create_pr_review_comment.cjs	Supports buffered review metadata.
setup/js/create_issue.cjs	Returns richer issue metadata.
setup/js/child_process_timeouts.cjs	Centralizes configurable timeouts.
setup/js/add_labels.cjs	Preserves label provider identifiers.

Review details

Suppressed comments (2)

setup/js/safe_output_handler_manager.cjs:1903

• This removes temporary_id_map from the normal processing path (and the two early-return paths above), but the checked-in generated workflow still exposes process_safe_outputs_temporary_id_map from this step at .github/workflows/daily-runtime-threat-scan.lock.yml:1514. That output will now be empty for every run, breaking callers that use the existing map contract; retain the output (or update all generated callers and the public output contract in the same change) while adding the artifact-backed map.

    // Write temporary ID map to file for inclusion in the safe-outputs-items artifact.
    // This allows reviewers and auditors to inspect the full map of temporary IDs
    // to resolved GitHub resources (issue numbers, repos) without parsing step outputs.
    if (!isStaged) {
      writeTemporaryIdMapFile(processingResult.temporaryIdMap);

setup/js/safe_output_manifest.cjs:238

• The fallback here assigns provider: "github" to every result that does not match the Jira/Linear/Azure prefixes. That includes arbitrary safe-outputs.jobs and custom action handlers, whose results commonly have only an action payload and no GitHub resource; their manifests will therefore claim an external operation was backed by GitHub. Only infer GitHub for known GitHub handlers or resource-bearing results, and otherwise preserve an explicit provider or omit the field.

  const provider = result.provider || result.metadata?.provider || (type.startsWith("jira_") ? "jira" : type.startsWith("linear_") ? "linear" : type.startsWith("ado_") ? "azure-devops" : "github");

• Files reviewed: 20/20 changed files
• Comments generated: 1
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.