ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.88.2

[dependabot]

Bumps github/gh-aw/actions/setup from 0.81.6 to 0.88.2.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.88.2

🌟 Release Highlights

A focused patch release improving safe-output reliability and CI hygiene: call_workflow inputs no longer get dropped during samples replay, sample-coverage gaps are now surfaced as warnings, and AI credit budgets are validated more safely to close a CodeQL alert.

🐛 Bug Fixes & Improvements

• Fixed call_workflow samples replay dropping workflow_name — ingestion previously stripped workflow_name/inputs for call_workflow safe outputs, causing the apply job to fail with "Workflow name is empty" (#58113).
• Added warnings for uncovered samples — --use-samples compilation now warns when an enabled safe output has no samples: entries, so silent no-op replay runs are easier to catch (#58112).
• Hardened AI credit budget handling — the max AI credits expression moved from inline shell interpolation to step env:, with strict integer validation before configuring the AWF firewall budget, resolving a CodeQL code-injection alert (#58116).

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

Generated by 🚀 Release · copilot · auto · 16.4 AIC · ⊞ 11.8K

---

What's Changed

• Fix call_workflow samples replay dropping workflow_name during ingestion by @​dsyme with @​Copilot in github/gh-aw#58113
• Warn when samples replay has no coverage; add replace-label sample to E2E workflow by @​dsyme with @​Copilot in github/gh-aw#58112
• Move max AI credits expression to step env and validate integer in shell run block by @​pelikhan with @​Copilot in github/gh-aw#58116

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

v0.88.0

🌟 Release Highlights

This release focuses on hardening the sandbox runtime, simplifying browser automation with a new Playwright CLI approach, and fixing dependency resolution for nested workflow imports.

⚠️ Breaking Changes

• Removed built-in Playwright MCP support (#57521). Browser automation now goes through the new Playwright CLI guidance instead of the bundled MCP server — update workflows that relied on the built-in Playwright MCP tool.

✨ What's New

• Sandbox security settings replaced with runtime profiles (#57692) — legacy sandbox security flags are now expressed as declarative runtime profiles, making sandbox configuration easier to reason about. See the sandbox reference.
• Playwright CLI guidance and browser provisioning (#57731, #57691, #57594) — new AWF-aware policy prompts, configuration, and a shared smoke test make it easier to provision and use Playwright safely from agentic workflows.
• gh-aw-firewall v0.28.12 integration (#57514) — pulls in attested Cloud Hypervisor artifacts for stronger supply-chain guarantees on the firewall image.
• Operational value report evaluator and history (#57503) — new tooling to evaluate and track the operational value of agentic workflow runs over time.

🐛 Bug Fixes & Improvements

• Fixed dependency ordering and cycle detection for nested imports (#57746) — resolves incorrect ordering and undetected cycles when shared workflow files import each other transitively. See the imports reference.
• Codex custom tools now classified as invalid-model failures (#57578) — clearer error reporting when Codex is configured with unsupported custom tools.
• Fixed stale skill docs and repo-path guard (#57579) for the action-based JS architecture.
• Super-Linter restricted to Go modules (#57465), reducing noise from linting unrelated file types.
• Added a daily Windows Defender release scan (#57768) to catch malware false positives early.

... (truncated)

Commits

• 8e30bcd Move max AI credits expression to step env and validate integer in shell run ...
• d89d731 Warn when samples replay has no coverage; add replace-label sample to E2E wor...
• 93dcf0e Fix call_workflow samples replay dropping workflow_name during ingestion (#58...
• b4fadaa feat(manifest): add optional icon field supporting emoji, octicon, and SVG re...
• 1e1fbac Restore MicroVM and ARC runner cards on homepage (#58054)
• dc5c0d2 fix(compiler): normalize gateway policy server IDs (#58023)
• 86c0e5a Prevent PR body injection during transfer (#58034)
• 37750b6 Stop suggesting redundant Playwright CLI mode (#58041)
• e96e161 Fix CodeQL code-injection alert for runner.tool_cache in generated shell ru...
• 650574f Add API and storage budgets to logs downloads (#58022)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.