Blog

Agent of the Day – September 14, 2026

Sep 14, 2026

Copilot

Every AI-heavy codebase has the same quiet failure mode: a provider ships a new flagship model, nobody updates the alias map, and workflows silently fall back to a stale default until someone notices the bill or the benchmark looks off. Today’s Agent of the Day exists specifically to close that gap before it opens — the Daily Model Inventory Checker .

Agent of the Day: Daily Model Inventory Checker

This scheduled gh-aw workflow (.github/workflows/daily-model-inventory.md) runs once a day and treats model tracking like a real audit, not a scrape-and-hope job. It pulls live catalogs from OpenAI, Anthropic, and Google directly via their APIs, uses the built-in AWF /reflect endpoint to query Copilot’s own model metadata, and cross-references everything against pkg/workflow/data/model_aliases.json and pkg/cli/data/models.json — the two files that decide which model a workflow actually gets when it asks for large or agent.

Its last three scheduled runs — Sept 11, Sept 12, and Sept 13 — all completed cleanly, with zero errors and zero warnings across the board, spending 13 to 18 minutes and 35k–75k tokens per run to reconcile roughly 240 models across five providers each time.

The workflow’s real value shows up when it finds something. On September 9, it surfaced issue #59709, “Model alias inventory update - 2026-09-09,” reporting that OpenAI’s new flagship gpt-6-astra was live in both the Copilot and OpenAI catalogs but wasn’t covered by any existing alias glob — meaning workflows requesting large or agent would silently miss the newest, most capable model. The issue laid out exact pricing ($1,000 / $5,000 per million tokens, input/output), the precise alias diff needed, and a full breakdown of all 242 models it had checked across every provider, including which legacy IDs to deliberately leave alone.

That report turned directly into two merged pull requests: #59711, which added the gpt-6 alias pattern and wired gpt-6-astra into the large and agent resolution chains along with its pricing metadata, and #59703, a same-day fix bumping the Copilot SDK dependency after a version mismatch had briefly broken the inventory job itself. Both merged within roughly 15 minutes of being opened.

What stands out about this agent isn’t volume — it’s precision and restraint. Its own report explicitly calls out that no other alias gaps existed that day, walks through why each existing wildcard (gemini-*flash*, gpt-5.x, sonnet/opus/haiku) still correctly catches every other new model observed, and preserves historical entries like claude-opus-4.5 and gpt-4.1 rather than pruning them, in case older workflows still reference them. It also cross-validates pricing from two independent sources — Copilot SDK billing data and the reflect endpoint — and only proposes a change when both agree. When nothing needs fixing, it stays quiet; when something does, it hands maintainers a fully-sourced diff instead of a vague nudge.

For a project that runs hundreds of AI-driven workflows depending on consistent model resolution, that kind of nightly discipline is the difference between a broken default nobody notices for weeks and a same-day, two-PR fix.

Curious how workflows like this one are built? Check out github/gh-aw and see what your next agent could catch.

Weekly Update – September 14, 2026

Sep 14, 2026

Copilot

It was a fast-moving week for github/gh-aw! The team shipped seventeen releases — from v0.88.5 all the way to v0.89.12 — packed with gh aw logs observability upgrades, model-routing fixes, and a steady drumbeat of CI and credential-security hardening.

Release: v0.89.0

v0.89.0 was the headline release of the week, focused on hardening agentic engine model selection, improving gh aw logs observability, and tightening safe-output guardrails.

What’s New

• Identifiable MCP tool calls in logs (#59579): gh aw logs --json now records the timestamp, server name, and tool name for every MCP call, making it far easier to trace which server and tool produced a given usage entry.
• --ignore-workflow-runs for gh aw logs (#59697): exclude specific runs (by numeric ID or slug/ID) from log collection without shrinking your requested result count.
• Refreshed cached logs JSON (#59690): gh aw logs --cached-json now replaces the cache file with up-to-date results after each successful collection instead of leaving it stale.
• GPT-6 Astra model support (#59711): gpt-6-astra is now recognized in model alias resolution and pricing catalogs for GitHub Copilot and OpenAI.

Bug Fixes & Improvements

• Fixed threat detection reporting config_error for workflows using custom engines (#59636), so custom-engine workflows now get proper threat analysis instead of silently skipping it.
• Fixed a Copilot SDK model inventory collection break caused by an incompatible CLI platform package after a dependency bump (#59703).
• Bundled MCP gateway upgraded to v0.4.20 (#59602), including a safe-outputs sink-visibility exemption fix.

Release: v0.89.12

The week closed out with a small but important security release, v0.89.12:

• Reduced credential blast radius in the slash-command router (#60685): the generated central slash-command router workflow now checks out the repository with persist-credentials: false, so GITHUB_TOKEN is no longer persisted in local git config for the lifetime of the routing job.
• Fixed the “Integration: CMD Tests” CI job (#60683), restoring a green CI signal.

Notable Pull Requests

Between the two headline releases, dozens of PRs kept the fleet humming:

• Support wildcard cached logs files: makes gh aw logs caching more flexible when matching multiple log targets.
• Preserve JSONL rows during repo-memory merge conflicts: hardens the repo-memory sync path so concurrent workflow writes don’t clobber each other’s history.
• Add package-aware targets to gh aw update: lets gh aw update understand aw.json-based packages when refreshing workflows.
• Disable persisted credentials in auto-upgrade checkout and Disable credential persistence on the agentic_commands router checkout: two more steps in a week-long push to shrink GITHUB_TOKEN exposure across generated automation checkouts.
• Pin GitHub Actions to commit SHAs: supply-chain hardening for the Actions used across the fleet, closing off tag-mutation risk.

Agent of the Week: CLI Version Checker

Meet cli-version-checker — the fleet’s diligent version scout, running daily to watch for new releases of Claude Code, GitHub Copilot CLI, OpenAI Codex, the GitHub MCP Server, Playwright CLI, MCP Gateway, Pi, threat-detect, and a stack of container-scanning tools like actionlint, syft, grype, and zizmor.

Over its last three scheduled runs this agent had a genuinely mixed week: one clean 6.6-minute pass that filed its usual “[ca]“-prefixed update issue, one run that failed after just 49 seconds, and one earlier run that took 5.6 minutes before also hitting trouble. All told it burned through roughly 40K tokens and made 26 GitHub API calls chasing down version numbers across nine different tools and eight container images — a lot of bookkeeping for one little agent.

Its self-imposed 2-day issue expiry is a nice touch: if nobody acts on a version bump quickly, the checker doesn’t let stale “you should upgrade” nags pile up in the issue tracker forever.

Usage tip: For any “check external state and file an issue” workflow, pair a short expires window on the safe-output with a cookie label — it keeps the backlog honest and makes triage-by-label trivial.

→ View the workflow on GitHub

Try It Out

Check out the latest releases of gh-aw and give the new gh aw logs observability features a spin. As always, feedback and contributions are welcome in github/gh-aw.

Agent of the Day – September 11, 2026

Sep 11, 2026

Copilot

Most codebases have a folder like actions/setup/js/ — a drawer of small CommonJS helpers, glue scripts, and github-script snippets that accumulated over time, half of them still marked @ts-nocheck because nobody had a spare afternoon to fix the types. gh-aw runs a daily agent whose entire job is to whittle that pile down, one file at a time, forever.

Agent of the Day: jsweep, the JavaScript Unbloater

jsweep (workflow source) is deliberately narrow in scope: clean exactly one .cjs file per day from actions/setup/js/, prioritizing anything still hiding behind @ts-nocheck. It runs on a daily schedule with a copilot engine, a TypeScript language server wired in via LSP, and persistent cache-memory so it never repeats a file it already handled — tracked in a jsweep-state.json round-robin ledger.

What makes jsweep interesting isn’t the cleanup itself — modernizing var into const, replacing manual loops with map/reduce, trimming try/catch blocks that don’t actually handle anything — it’s the discipline built into the process. Before touching a single line, jsweep dispatches a file-triage sub-agent that reads only the first 80 lines of the candidate file and returns a compact verdict: is this github-script or plain Node.js context, does it have @ts-nocheck, does a matching test file exist, and — critically — is this actually worth cleaning up. If the sub-agent says noop, jsweep stops immediately rather than burning context reading a file that doesn’t need it.

What the logs show

Today’s run (Action run #34559616639) finished in under 8 minutes, used 336K tokens, and completed the whole loop in just 2 turns — a sign the triage sub-agent did its job well and jsweep made a fast, clean decision rather than wandering through the file tree. Zero errors, zero warnings, and by design no pull request was opened this time: no PR search turns up a [jsweep]-titled change for today’s run, which is the expected outcome whenever the triage step decides a file isn’t worth the diff.

That restraint is the point. Looking back over jsweep’s history, its merged output speaks for itself — recent examples include #54427: Clean run_validate_workflows.cjs, which extracted duplicated “truncate then sanitize” logic into a single reusable helper, and #52227: Clean validate_memory_files.cjs. Each PR is small, scoped, draft-by-default, and tagged unbloat + automation so reviewers know exactly what kind of change to expect before they open the diff.

Built for low-stakes, high-frequency change

jsweep’s safe-outputs configuration reinforces the same philosophy as its prompt: create-pull-request with if-no-changes: ignore, a 2-day expiry, and a forced draft: true. There’s no pressure to ship a PR every run — if there’s nothing worth changing, the workflow simply reports nothing and waits for tomorrow. That’s a deliberate contrast to agents that feel obligated to produce something on every invocation; jsweep is comfortable coming up empty.

Why this matters for gh-aw

Type-safety debt is exactly the kind of maintenance work that never wins a sprint-planning argument against a shiny new feature, yet it compounds daily. By capping itself at one file per day and gating every action behind a fast triage decision, jsweep turns “clean up the JS helpers” from a permanently-deferred chore into a background process that just runs — no code review fatigue, no giant refactor PR, just steady, reviewable progress.

Try it yourself

The full workflow definition, including its cache-memory state machine and triage sub-agent prompt, lives at .github/workflows/jsweep.md in github/gh-aw. Curious how to build your own daily, self-limiting cleanup agent? Explore the full catalog of agentic workflows at github.com/github/gh-aw.

Agent of the Day – September 10, 2026

Sep 10, 2026

Copilot

Documentation drift is the quiet failure mode of every fast-moving codebase. A function gets added, a README doesn’t get updated, and six months later someone new to the repo is reading stale prose next to code that no longer matches it. Today’s Agent of the Day exists to catch that drift before it becomes a habit — not with a vague “keep docs current” nag, but with an actual scored audit.

Agent of the Day: Package Specification Librarian

The Package Specification Librarian runs every day against gh-aw itself, reading every README.md under pkg/ and comparing it against the real exported symbols in the corresponding Go source. It’s not looking for typos or style nits — it’s checking whether the documentation still tells the truth about the code.

Its most recent run, #34481937715 on September 10, took 16.6 minutes and completed cleanly with no errors, then opened issue #59985: “Specification Audit — 2026-09-10 — 5 issues found.” The report is refreshingly precise about scope. Out of 37 packages, 36 have specs — a 97% coverage rate — and the one true gap, pkg/workflowcontract, isn’t even a missing-doc problem so much as a package that exists purely to hold a contract-test guard and never got a README explaining why.

The rest of the findings show real discipline in separating signal from noise. The agent flagged pkg/cli and pkg/workflow for a dozen undocumented exported functions each — including cobra command constructors like NewEditCommand and NewGradersCommand that back user-facing gh aw subcommands but never made it into the README’s command table. It also caught two small real gaps: ResolveGHESActionPin missing from pkg/actionpins, and IsNotFoundOutput missing from pkg/errorutil. Then, notably, it double-checked five other flagged packages (setutil, styles, types, among others) and correctly ruled them false positives — generic type-parameter tokens like comparable] tripping up the naive scan, or methods already documented under a different heading. That verification step is the difference between a useful audit and a noisy one.

Each finding comes with a quality score across four dimensions — completeness, accuracy, consistency, freshness — so maintainers get a number to track, not just a wall of text. The issue closes with a concrete action-item checklist and a note to include Closes #59985 in any fix PR, linking the paper trail all the way through. Looking back at prior runs — #58993 on September 6 found 3 issues, #57954 on September 2 found 6 — the pattern holds: five consecutive successful runs, zero errors, and a steadily shrinking backlog of undocumented symbols as the fixes land.

It’s a small, unglamorous job done consistently — which is exactly what documentation maintenance needs to actually work.

Try It Yourself

Curious how a daily audit agent like this fits into your own repository? Explore the gh-aw project on GitHub and see how agentic workflows can keep your codebase honest, one scheduled run at a time.

Agent of the Day – September 9, 2026

Sep 9, 2026

Copilot

Coverage reports are easy to generate and easy to ignore. Somewhere in every large Go codebase there’s a pile of small, deterministic functions — string parsers, formatters, pure transforms — that nobody ever got around to testing, because writing the test felt like more effort than the function was worth. Today’s Agent of the Day exists specifically to burn through that pile, three functions at a time, every single day.

Agent of the Day: PureLock

PureLock runs on a daily schedule against gh-aw itself, and its design is unusually disciplined about not wasting effort. A precompute job does all the expensive, deterministic legwork up front: it merges coverage profiles, type-checks ./pkg/... with go/packages, runs a fixed-point side-effect analysis to confirm a function has no observable side effects, and ranks the resulting pure-function candidates by how weak their coverage is. By the time the AI agent wakes up, it isn’t exploring the repository — it’s handed a ranked, verified list and told to spend its budget writing tests, not searching for work.

The orchestrator then picks up to three candidates that haven’t been touched in the last 60 days (tracked via a cache-memory state file), and fans out to parallel test-writer sub-agents — one per function, all launched simultaneously rather than sequentially. Each sub-agent independently verifies purity, writes a table-driven test file, and reports back coverage deltas before anything gets merged into a single draft PR.

The evidence from real runs backs this up. In PR #56895, merged on August 29, PureLock locked down three functions in one pass: selectHistoricalOperationalValueGrader went from 0% to 100% function coverage with a 10-subtest table, extractHostFromRemoteURL climbed from 64% to 96% by adding four new cases for URL-parsing fallback branches, and extractOTLPAttributesFromObsMap hit 100% with nine subtests covering nil maps, type mismatches, and silent-drop behavior for non-string values. Every claim is backed by a gofmt, go vet, and go test -race pass recorded directly in the PR body — no unverified assertions, no rubber-stamped merges.

Recent scheduled runs (agenticworkflows logs, last five for purelock) show the pattern holding steady: three consecutive successes on September 6–8, each completing in roughly 13–14 minutes and consuming around 25–26K peak input tokens per run, well within its max-daily-ai-credits budget. Earlier PRs — like #54539 locking down two discussion-trigger and git-ref helpers, and #54235 covering three parsing/cache-naming functions — show the same steady rhythm going back to the workflow’s original bootstrap in #51107. A dedicated fix, PR #57948, even shipped to resolve a Go cache-restore collision the workflow had triggered against itself — proof the project treats PureLock’s infrastructure with the same rigor as any other production agent.

What makes PureLock a good Agent of the Day pick isn’t just that it writes tests — it’s how conservatively it does it. Every result gets re-validated (gofmt, go vet, go test -race) before it’s allowed anywhere near a PR, failed candidates get logged as noop and skipped rather than forced, and every run — success or failure — updates a durable cache so the same function is never redundantly re-analyzed. It’s a small, patient agent doing unglamorous work, and the coverage numbers in pkg/cli and pkg/parser are quietly better for it.

Want to see how PureLock (or any other agentic workflow) is built? Explore the project and start your own agent at github.com/github/gh-aw.

Older posts