Weekly Update – September 21, 2026

Sep 21, 2026

Another busy week for github/gh-aw! We shipped a fresh release packed with reliability fixes, a smarter logs pipeline, and an updated model catalog — plus our usual dose of documentation polish.

Release: v0.89.17

v0.89.17 landed on September 19th, focused on hardening the AIC accounting pipeline, AWF/firewall integration, and safe-outputs handling.

What’s New

Faster, smarter logs auditing — cached workflow runs are no longer redownloaded during logs audits (#61871), multi-target logs queries are now distributed fairly across targets (#61027), and per-run download duration/size is now tracked in an end-of-run stats summary (#60951).
Updated model catalog — added gemini-3.8-flash and claude-fable-5.1 aliases and corrected pricing for gpt-6-astra/gpt-5.6-sol (#61234).
MCP Gateway and firewall bumped — MCP Gateway updated to v0.4.25 (#61661) and gh-aw-firewall (AWF) updated to v0.28.20 (#61527) and v0.28.17 (#60945).
Better automatic grading — native Copilot tool calls are now included in the automatic grader trace payload for more accurate evaluation (#61426).

Bug Fixes & Improvements

Fixed Code Scanning Fixer timeouts and tool denials (#61605).
Fixed slash command activation failing on CRLF line endings (#61602).
The safeoutputs CLI transport now fails loudly instead of silently failing open, surfacing real errors sooner (#61427).
Imported engine config (including auth) is now preserved when a workflow sets a top-level model (#61424).
Fixed several gaps in daily AIC (AI Credits) accounting, including legacy runs (#61313), pre-harness failures (#61232), and unassigned jobs (#61222).

Notable Pull Requests

Avoid redownloading cached runs during logs audit — a nice efficiency win that speeds up repeated gh aw logs invocations by skipping runs already cached locally.
Fix Copilot SDK multiword shell prefix matching and denial-guard hang — resolves a subtle hang in the tool-denial guard that could stall workflows using multiword shell allowlist prefixes.
Rewrite experiments.<name> in engine.model to valid job-scoped expressions — prevents invalid compiled workflow YAML when experiments reference model names.

Agent of the Week: deployment-incident-monitor

Meet deployment-incident-monitor, the on-call responder of the gh-aw fleet — it watches every deployment_status event and automatically files a deduplicated incident issue with root-cause analysis whenever something breaks.

This was its busiest week yet, firing 19 times — more runs than any other workflow in the repo. Most of the time it stayed quiet (no news is good news for deployments), but on September 19th it caught a real one: the Smoke Copilot - AOAI (Entra) workflow started failing with a 400 error because Azure OpenAI required organization verification for reasoning summaries. The agent didn’t just flag the failure — it traced it back to the exact commit, confirmed the change wasn’t the culprit, and filed issue #61892 with a full evidence trail linking the failing run and deployment.

Its incident history reads like a highlight reel of infra archaeology — Go toolchain mismatches, GitHub Pages queue timeouts, and cancelled sync_actions approvals — and thanks to close-older-issues, it keeps the incident tracker tidy instead of piling up duplicates.

Usage tip: Pair deployment_status-triggered monitors like this one with skip-if-match on your incident label so repeated failures from the same root cause collapse into a single, evolving issue instead of flooding your tracker.

→ View the workflow on GitHub

Try It Out

Update to v0.89.17 today, and check out the full changelog and prior releases on the releases page. As always, feedback and contributions are welcome in github/gh-aw.