build(deps): bump the github-actions-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the github-actions-minor-patch group with 3 updates in the / directory: github/gh-aw/actions/setup, actions/upload-artifact and actions/download-artifact.

Updates github/gh-aw/actions/setup from 0.51.6 to 0.81.6

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.81.6

🌟 Release Highlights

This release focuses on stability and observability — restoring broken fleet-wide token tracking, hardening CI quality gates, and adding release traceability for merged PRs.

✨ What's New

• Release PR notifications — A new post-agent release job now automatically comments on every PR included in each release, making it easy to trace which release shipped your changes (#41834).
• Loop engineering playbook — .github/aw/loop.md codifies patterns from autoloop, goal, and crane into a unified reference for building robust agentic loops (#41833).
• Benchstat regression gate — The CI bench job now compares against a stored baseline using benchstat, preventing silent performance regressions from merging (#41813).

🐛 Bug Fixes & Improvements

• Restored fleet-wide token usage collection — TokenUsage had been reporting 0 across the entire fleet since June 20 due to two co-conspirating bugs in the conclusion job. Both are fixed, restoring accurate AI credit tracking (#41823).
• Security: pinned govulncheck to go.mod version — CI vulnerability scans now use the exact version declared in go.mod and produce reproducible SARIF reports. A local make vuln-sarif target is also available (#41815).
• Hardened BYOK Ollama startup — The daily BYOK Ollama test now gates on explicit model and API readiness before proceeding, eliminating pre-agent failures from incomplete startup (#41838).
• Stabilized Go Logger Enhancement compile — Fixed exit code 126 caused by unsafe shell glob expansion in the workflow tool allowlist (#41840).
• Enforced safe output completion in quality workflow — The daily compiler quality workflow now requires an explicit safe output call, preventing silent no-op runs (#41841).

🔧 Internal

• Refactored 5 extreme function-length hotspots (145–650 lines) in pkg/workflow and pkg/cli into focused, testable units (#41800).
• SortedKeys sweep and deduplication logic consolidation across the codebase (#41829).

Generated by 🚀 Release · 32.9 AIC · ⊞ 8.3K

---

What's Changed

• refactor: split 5 extreme function-length hotspots in pkg/workflow and pkg/cli by @​pelikhan with @​Copilot in github/gh-aw#41800
• fix(security): pin govulncheck to go.mod version in CI, add local SARIF target by @​pelikhan with @​Copilot in github/gh-aw#41815
• Add benchstat regression gate to CI bench job by @​pelikhan with @​Copilot in github/gh-aw#41813
• fix(token-usage): restore fleet-wide TokenUsage collection via non-empty copy guard and correct priority order by @​pelikhan with @​Copilot in github/gh-aw#41823
• Add post-agent release job to comment on PRs included in each release by @​pelikhan with @​Copilot in github/gh-aw#41834
• [community] Update community contributions in README by @​github-actions[bot] in github/gh-aw#41836
• Require explicit safe output completion in daily compiler quality workflow by @​pelikhan with @​Copilot in github/gh-aw#41841
• Harden Daily BYOK Ollama startup path with explicit model/API readiness gating by @​pelikhan with @​Copilot in github/gh-aw#41838
• [aw] Stabilize Go Logger Enhancement compile invocation by @​pelikhan with @​Copilot in github/gh-aw#41840
• refactor: SortedKeys sweep, deduplicate dedup logic, redistribute misplaced helpers by @​pelikhan with @​Copilot in github/gh-aw#41829
• Add .github/aw/loop.md playbook synthesizing loop-engineering patterns from autoloop/goal/crane by @​pelikhan with @​Copilot in github/gh-aw#41833

Full Changelog: github/gh-aw@v0.81.5...v0.81.6

v0.81.5

🌟 Release Highlights

This release focuses on org-mode maturity, performance optimizations, and sandbox hardening — making gh aw update/upgrade --org more robust and production-ready while delivering meaningful speed improvements across the compiler and validator.

... (truncated)

Commits

• eed4304 Add .github/aw/loop.md playbook synthesizing loop-engineering patterns from...
• afff5d5 refactor: SortedKeys sweep, deduplicate dedup logic, redistribute misplaced h...
• a443203 [aw] Stabilize Go Logger Enhancement compile invocation (#41840)
• 51a55d8 Harden Daily BYOK Ollama startup path with explicit model/API readiness gatin...
• 146abd7 Require explicit safe output completion in daily compiler quality workflow (#...
• 1f7fa00 [community] Update community contributions in README (#41836)
• bc0a5e4 Apply remaining changes (#41834)
• b3ffb04 fix(token-usage): restore fleet-wide TokenUsage collection via non-empty copy...
• 4c5f79c Add benchstat regression gate to CI bench job (#41813)
• c24a65f fix(security): pin govulncheck to go.mod version in CI, add local SARIF targe...
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• See full diff in compare view

Updates actions/download-artifact from 8.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in actions/download-artifact#471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

Commits

• 3e5f45b Add regression tests for CJK characters (#471)
• e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
• See full diff in compare view