Bump github/gh-aw/actions/setup from 0.86.2 to 0.87.3

[dependabot]

Bumps github/gh-aw/actions/setup from 0.86.2 to 0.87.3.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.87.2

🌟 Release Highlights

This release strengthens sandbox security defaults, improves package/workflow update reliability, and ships a batch of linter, docs, and CI reliability fixes.

✨ What's New

• External threat detection enabled by default (#54111) — workflows now get proactive threat-detection coverage out of the box, improving baseline security posture without extra configuration.
• Cloud Hypervisor adopted across 58 agentic workflows (#54346) — broader migration improves sandbox isolation and reliability for agentic runs.
• Scoped ownership for package resources (#54120) and re-resolved manifests during workflow updates (#54119) — package dependencies stay accurate and correctly scoped as workflows evolve.
• New manualpathconcat linter (#54307) flags manual / path concatenation, catching a common class of path-handling bugs at compile time.
• Support for runner groups in custom safe jobs (#53977) gives more control over where custom safe-output jobs execute.

🐛 Bug Fixes & Improvements

• Fixed the logs MCP tool silently truncating explicit date-range queries to a single stale day with no warning (#54110).
• Fixed safe-output inline-backtick neutralization (#54103) and JSON-array expressions in approve-workflow-run safe outputs (#53812).
• Fixed a false-positive heredoc detection on bare (( )) arithmetic in the generatedyamlheredoc linter (#53991).
• Hardened command argument validation for pip/uv checks and npm lockfile execution (#53957), and added regression coverage for pip argv validation before exec (#54282).
• Fixed schedule-triggered workflow false positives and improved root-cause surfacing for disabled workflows in the health monitor (#53881).
• Fixed approve_workflow_run handler load failure caused by an npm minimatch require (#54281).
• Fixed actionlint error from an agent job referencing needs.approval_allowlist without a declared dependency (#54028).
• Restored GHES-compatible artifact action pins (#53966) and hardened post-agent cache Git commits (#53879).

📚 Documentation

• Clarified lock files and workflow setup commands (#54342), documented compiler-generated job authentication (#54100), and made Copilot auth docs easier to scan (#54337).
• Documented PR fast-track triage criteria (#53880) and closed non-Copilot engine parity gaps for gh aw init and custom engine frontmatter (#53834).
• Added workflow wizard links to documentation (#53862) and unbloated the network and safe-outputs PR references (#54104, #53875).> Generated by 🚀 Release · auto · 16.2 AIC · ⊞ 11.7K

---

What's Changed

• Redirect Astro wizard docs to hosted wizard by @​pelikhan with @​Copilot in github/gh-aw#53815
• [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe pkg/cli subtests by @​github-actions[bot] in github/gh-aw#53822
• Add review-agentic-workflows skill for security-first workflow review and optimization triage by @​pelikhan with @​Copilot in github/gh-aw#53775
• Remove hidden README and docs navigation text by @​pelikhan with @​Copilot in github/gh-aw#53816
• Add workflow wizard links to documentation by @​pelikhan with @​Copilot in github/gh-aw#53862
• [test-parallel] test: add t.Parallel() to TestCLIProxyBashDisabledCodemod subtests by @​github-actions[bot] in github/gh-aw#53845
• pr-sous-chef: document GraphQL fetch for reviewThreads (fixes invalid gh pr view field) by @​pelikhan with @​Copilot in github/gh-aw#53833
• docs: close non-Copilot engine parity gaps for gh aw init and custom engine frontmatter by @​pelikhan with @​Copilot in github/gh-aw#53834
• Fix JSON-array expressions in approve workflow run safe outputs by @​pelikhan with @​Copilot in github/gh-aw#53812
• [docs] docs: unbloat safe outputs PR reference by @​github-actions[bot] in github/gh-aw#53875
• Fix chronic Smoke Copilot AOAI dispatch failure and cap per-run AI credits by @​pelikhan with @​Copilot in github/gh-aw#53817
• [test-parallel] Add t.Parallel() to safe codemod test files (batch after codemod_factory_test.go) by @​github-actions[bot] in github/gh-aw#53887
• Infer GitHub App permissions and events from resolved package workflows in add-wizard bootstrap by @​pelikhan with @​Copilot in github/gh-aw#53766
• Document PR fast-track triage criteria by @​pelikhan with @​Copilot in github/gh-aw#53880
• Fix schedule-triggered workflow false positives and surface disabled-workflow root cause in health monitor by @​pelikhan with @​Copilot in github/gh-aw#53881
• [community] Update community contributions in README by @​github-actions[bot] in github/gh-aw#53893
• [test-parallel] test: add t.Parallel() to safe pkg/cli tests (daily batch) by @​github-actions[bot] in github/gh-aw#53931
• [eslint-miner] eslint: extend no-exec-interpolated-command to cover execApi parameter-alias calls by @​github-actions[bot] in github/gh-aw#53947

... (truncated)

Commits

• 466b8ad Add npm registry access to daily-rendering-scripts-verifier network allowlist...
• 734f391 Add actionable guidance to shell completion rc-path errors (#54672)
• d52203c Add step-level failure attribution to Detection Analysis Report (Rule 3) (#54...
• 6d315d0 Include file path in pkg/parser wrapper errors (#54648)
• d11b06c [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe subtests...
• 8dcf606 Paginate daily performance data through its 90-day window (#54679)
• 2512707 docs: unbloat workflow structure reference (#54676)
• 80a44d7 [WIP] Fix failing GitHub Actions job js-integration-live-api (#54650)
• 03f65d8 Add regression coverage for CLI strict-mode default (#54657)
• 0923f14 Fail compilation when safe-outputs step-output token references cannot resolv...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

[learn-build-service-prod]

Learn Build status updates of commit fa6c997:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/docs-from-code.lock.yml	✅Succeeded

For more details, please refer to the build report.