Harden API consistency reviews and scan GitHub Actions

.github/aw/actions-lock.json

@@ -1,10 +1,15 @@
 {
   "entries": {
-    "actions/github-script@v9": {
+    "actions/github-script@v9.0.0": {
       "repo": "actions/github-script",
-      "version": "v9",
+      "version": "v9.0.0",
       "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
+    "github/gh-aw-actions/setup-cli@v0.92.0": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.92.0",
+      "sha": "458b269006dcf88e3b5496b6fbecabe4b9a0f954"
+    },
     "github/gh-aw-actions/setup@v0.92.0": {
       "repo": "github/gh-aw-actions/setup",
       "version": "v0.92.0",

.github/skills/agentic-workflows/SKILL.md

@@ -19,6 +19,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/agent-runtime-instructions.md`
 - `.github/aw/agentic-chat.md`
 - `.github/aw/agentic-workflows-mcp.md`
+- `.github/aw/analyzing-runs.md`
 - `.github/aw/asciicharts.md`
 - `.github/aw/campaign.md`
 - `.github/aw/charts-trending.md`
@@ -32,6 +33,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/create-shared-agentic-workflow.md`
 - `.github/aw/debug-agentic-workflow.md`
 - `.github/aw/debug-model-engine-misconfiguration.md`
+- `.github/aw/debug-playbook.md`
 - `.github/aw/debug-security-review.md`
 - `.github/aw/dependabot.md`
 - `.github/aw/deployment-status.md`
@@ -77,6 +79,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/skills.md`
 - `.github/aw/subagents.md`
 - `.github/aw/syntax-agentic.md`
+- `.github/aw/syntax-checkout.md`
 - `.github/aw/syntax-core.md`
 - `.github/aw/syntax-engine.md`
 - `.github/aw/syntax-tools-imports.md`

.github/workflows/agentic-auto-upgrade.yml

@@ -35,7 +35,7 @@ name: Agentic Auto-Upgrade
 
 on:
   schedule:
-    - cron: "21 3 * * 5"  # Weekly (auto-upgrade)
+    - cron: "19 10 * * 2"  # Weekly (auto-upgrade)
   workflow_dispatch:
 
 permissions:
@@ -52,12 +52,12 @@ jobs:
           persist-credentials: false
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@v0.92.0
+        uses: github/gh-aw-actions/setup-cli@458b269006dcf88e3b5496b6fbecabe4b9a0f954 # v0.92.0
         with:
           version: v0.92.0
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@v0.92.0
+        uses: github/gh-aw-actions/setup@458b269006dcf88e3b5496b6fbecabe4b9a0f954 # v0.92.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 

.github/workflows/codeql.yml

@@ -22,8 +22,13 @@ jobs:
       actions: read
 
     strategy:
+      fail-fast: false
       matrix:
-        language: [go]
+        include:
+          - language: go
+            build-mode: manual
+          - language: actions
+            build-mode: none
 
     steps:
       - name: Checkout repository
@@ -42,9 +47,10 @@ jobs:
         uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
-          build-mode: manual
+          build-mode: ${{ matrix.build-mode }}
 
       - name: Build Go modules
+        if: matrix.language == 'go'
         run: |
           go build ./...
           go -C _catalog build ./...

.github/workflows/copilot-setup-steps.yml

@@ -23,6 +23,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install gh-aw extension
-        uses: github/gh-aw-actions/setup-cli@v0.92.0
+        uses: github/gh-aw-actions/setup-cli@458b269006dcf88e3b5496b6fbecabe4b9a0f954 # v0.92.0
         with:
           version: v0.92.0