Weekly Update – July 27, 2026

Jul 27, 2026

It was a busy week in github/gh-aw — four releases landed between Monday and Friday, each one stacking new capabilities on top of the last. Here’s a look at what shipped.

Releases This Week

v0.83.0 — July 22

A focused security and developer-experience release.

Three new ESLint rules ship in one go: stringsjoinone catches unnecessary single-element strings.Join calls, no-setfailed-then-exit-zero prevents masked CI failures, and require-execfilesync-try-catch enforces error handling around execFileSync.
Sub-30s make test-unit — tests now run impacted packages first, giving you fast feedback without waiting for the full suite.
close_issue state-reason — agents that close issues can now pick the closure reason dynamically (completed, not-planned, etc.), making your workflows more expressive.

v0.83.1 — July 23

This one expanded gh aw compile into a proper security pipeline.

Container vulnerability scanning with Grype (#47474) — compile now checks gh-* workflow container images for CVEs before deployment.
License auditing and YAML linting are also now part of the compile pass, catching problems before they hit production.

v0.83.2 — July 24

Reliability and security fixes.

Smarter gh aw add (#47690) — local skill references are now auto-rewritten to fully-qualified specs on gh aw add, so workflows stay portable when you share them.
Shell injection detection improvements and a WIF auth regression fix round out the security hardening.

v0.83.3 — July 25

The biggest release of the week.

Git argument injection fix (VULN-001) (#47957) — a security fix for unvalidated ref/path values in remote import fallbacks that could allow command injection via crafted ref names.
GraphQL injection fix (#47952) — resolved two code scanning alerts for GraphQL injection in getOwnerNodeId.
GitHub MCP Server v1.7.0 (#47923) — all workflows now get the latest MCP tool improvements out of the box.
stringsconcatloop linter (#47894) — a new Go analyzer catches string += inside loops and guides you toward strings.Builder.
Post-update SHA integrity validation (#47959) — actions-lock entries are now SHA-verified after updates, closing a supply-chain tampering vector.
WASM panic recovery (#47854) — playground users will no longer see stuck promises after a compile panic.

Agent of the Week: Daily GitHub Docs SEO Optimizer

The newest addition to the workflow roster — quietly making sure GitHub Docs can actually find gh-aw when you need it.

daily-github-docs-seo-optimizer was shipped in v0.83.3 (#47975) and immediately got to work. Its job is to scan GitHub Docs pages and identify minimal, targeted updates that would help Copilot CLI surface Agentic Workflows as solutions to repository automation tasks. It’s not trying to game search engines — it’s trying to make sure that when a developer asks Copilot “how do I automate issue triage?”, the answer actually mentions gh aw.

Fresh off the assembly line this week, it hasn’t accumulated a rich log history yet (give it time), but the design is interesting: it runs daily on gpt-5.4 with a bare driver and creates issues prefixed [github-docs-seo] when it finds documentation gaps worth flagging. No filesystem writes, no PR spam — just targeted observations filed as issues for humans to review.

Usage tip: If you’re maintaining a library or CLI tool, a similar workflow can continuously audit whether your documentation appears in the right Copilot/LLM context for common developer questions — without needing a dedicated SEO team.

→ View the workflow on GitHub

Try It Out

Upgrade to v0.83.3 to get the full set of security fixes, the new GitHub MCP Server v1.7.0, and the expanded linter suite. Questions and contributions are always welcome in github/gh-aw.