v0.70.0

🌟 Release Highlights

This release delivers a wave of community-driven bug fixes alongside significant new features: multi-repo workflow support, advanced credential supply patterns, comment-memory improvements, security hardening, and a new merge-pull-request safe output.

✨ What's New

• on.needs for credential supply jobs — Workflows can now declare on.needs to express dependencies on custom pre_activation/activation jobs, enabling GitHub App credentials to be sourced from upstream job outputs. This unblocks advanced credential-supply patterns that were previously impossible.

• Multi-repo (side-repo) push_to_pull_request_branch — push_to_pull_request_branch now correctly handles multi-repo checkout patterns by scoping all git operations to the target repository's working directory.

• merge-pull-request safe output — Workflows can now merge pull requests directly as a safe output operation.

• Sticky comments — The add_comment safe output now supports sticky (upsert) comments that update in place across runs.

• Configurable fallback labels for create_pull_request — When a PR cannot be created due to branch protection, the fallback issue can now be tagged with custom labels, making it easier to triage and route those issues.

• Container image digest pinning — All built-in container images are now pinned by digest in compiled lock files, ensuring reproducible and tamper-resistant workflow executions.

• add_comment routes to PR review threads — On pull_request_review_comment triggers, add_comment now replies directly in the review thread rather than posting at PR level.

• gh-proxy mode — The GitHub CLI proxy feature is now configured via tools.github.mode: gh-proxy, providing a cleaner and more discoverable API.

• BYOK Copilot defaults — Established sensible defaults for Bring-Your-Own-Key Copilot configurations; the deprecated byok-copilot flag is now flagged for removal.

• MCP-as-CLI progress messages — MCP tools can now emit progress messages on stderr for better real-time visibility during long-running operations.

• Multiple agent assignments per issue — Agents can now be assigned to the same issue multiple times, enabling multi-repo workflows where a single issue drives work across several repositories.

🐛 Bug Fixes & Improvements

• Fixed action pin regression — gh aw compile once again pins all actions to their commit SHA hashes (regression introduced in v0.68.3).
• Fixed push_to_pull_request_branch commit link — The tracking comment now correctly links to the actual pushed commit SHA instead of the pre-push HEAD.
• Fixed macOS case-colliding artifact extraction — gh run download no longer aborts when an artifact contains case-colliding filenames (e.g., MEMORY.md and memory.md) on macOS.
• Fixed allowed-base-branches compile validation — gh aw compile no longer incorrectly reports safe-outputs.create-pull-request.allowed-base-branches as an unknown field.
• Fixed update-project GitHub App permissions — The update-project safe output now includes the required issues: read permission when using a GitHub App token.
• Fixed list_commits filtering on feature branches — Own commits are no longer incorrectly filtered out when listing commits on a feature branch.
• Fixed firewall cleanup permissions — The generated cleanup step now includes the correct chmod for the firewall/audit log directory.
• Fixed PR-context base-branch restore — The base-branch restore step no longer overwrites APM-restored .github/skills before the Copilot agent starts.
• Fixed add_comment disclosure template lookup in comment-memory safe outputs.
• XPIA security hardening — Multiple fixes to close steganographic channels in sanitization paths; disable-xpia-prompt is now rejected at compile time in strict mode.

📚 Documentation

• Self-healing documentation fixes: tools.github.mode gh-proxy documented.
• Protected files defaults updated: .githooks/, .husky/, and DESIGN.md are now protected by default.
• Developer docs consolidation and glossary improvements.

🌍 Community Contributions

A huge thank you to the community members who reported issues that were resolved in this release!

@ahmadabdalla

• list_commits on a feature branch: my own commits get filtered out (direct issue)

@bbonafed

• on.github-app credentials cannot be sourced from a custom job's outputs (jobs.{pre_activation,activation}.pre-steps splicing/needs bugs + missing on.needs API) (direct issue)

@camposbrunocampos

• Assign to agent seems to be limited for 1 assignment per issue, I would like to extend it to multiple assignments so agent can work on multiple repos. (direct issue)

@h3y6e

• update-project safe output missing issues: read when using github-app (direct issue)

@JasonYeMSFT

• 0.68.3 gh aw compile no longer pin actions to commit hash (direct issue)

@jtracey93

• Question: How do I run an agentic workflow for issue triage on issues created prior to the agentic workflow existing? (direct issue)

@microsasa

• Feature request: merge-pull-request safe-output (direct issue)
• Feature request: pin container images by digest in compiled lock files (direct issue)

@shiran-gutsy

• Support configurable labels for create_pull_request fallback issues (direct issue)

@strawgate

• Support sticky comments (direct issue)

@theletterf

• PR-context base-branch restore overwrites APM-restored .github/skills before Copilot starts (direct issue)

@tsm-harmoney

• gh aw compile reports allowed-base-branches as unknown for safe-outputs.create-pull-reques (direct issue)

@yskopets

• bug: push-to-pull-request-branch tracking comment links to wrong commit SHA (direct issue)
• gh run download fails on macOS when artifact contains both MEMORY.md and memory.md (direct issue)
• push_to_pull_request_branch does not support multi-repo (side-repo) checkout pattern (direct issue)
• add_comment: reply to pull_request_review_comment in the review thread, not at PR level (direct issue)

@zkoppert

• Generated cleanup step missing chmod for firewall/audit directory (direct issue)

⚠️ Attribution Candidates Need Review

The following community issues were closed during this release window but could not be automatically linked to a specific merged PR. Please verify whether they should be credited:

• @viktoriyabogdanova for [aw-failures] Workflow timing out at 40min — MCP get_file_contents 37–71s per call, LLM turns 4–10min — closed 2026-04-22, no confirmed PR linkage found (closed as NOT_PLANNED)
• @samuelkahessay for Feature request: force-rerun semantic for workflow_dispatch against the same bound issue — closed 2026-04-23, no confirmed PR linkage found (closed as NOT_PLANNED)

---

For complete details, see CHANGELOG.

Generated by Release · ● 1.1M

---

What's Changed

• Fix smoke-ci safe_outputs failure on schedule-triggered runs by @Copilot in #27705
• [safe-output-integrator] Add missing safe-output test workflows and compiler tests by @github-actions[bot] in #27709
• Standardize USE-001 error codes in comment_memory and merge_pull_request safe-output handlers by @Copilot in #27701
• Enforce SEC-005 allowlist validation for cross-repo comment-memory setup by @Copilot in #27702
• Codex: inject openai-proxy provider in generated config when API proxy is enabled by @Copilot in #27711
• Refactor cli-proxy feature into tools.github.mode (gh-proxy) with codemod migration by @Copilot in #27707
• Update OpenCode/Crush universal LLM consumer backend handling by @Copilot in #27708
• Fix nosprintfhostport lint in codex_engine_test by @Copilot in #27734
• Bump default MCP gateway to v0.2.30 and AWF firewall to v0.25.28 by @Copilot in #27722
• Ignore link_sub_issue failure when already linked to same parent by @Copilot in #27735
• Emit OTEL error signals for cancelled conclusions and success-with-errors runs by @Copilot in #27739
• ci: include runner-guard in cgo security-scan matrix by @Copilot in #27745
• [docs] docs: unbloat footers.md — remove redundant sections by @github-actions[bot] in #27753
• Prevent built-in jobs.* customization entries from creating agent needs duplicates/cycles by @Copilot in #27751
• Fix firewall cleanup permissions to include audit logs directory by @Copilot in #27742
• Preserve error chain in ErrorCollector.FormattedError for multi-error aggregation by @Copilot in #27765
• Fix built-in pre-steps insertion to avoid splitting Setup Scripts YAML blocks by @Copilot in #27750
• Pin builtin container images by digest in compiled lock files and AWF hash-spec configuration by @Copilot in #27762
• [spec-extractor] Update package specifications for agentdrain, cli, console, constants by @github-actions[bot] in #27796
• [docs] docs: Update glossary - daily scan 2026-04-22 by @github-actions[bot] in #27797
• [spec-enforcer] Enforce specifications for actionpins, agentdrain, cli by @github-actions[bot] in #27798
• [instructions] Sync github-agentic-workflows.md with v0.68.3 by @github-actions[bot] in #27803
• [docs] Developer docs consolidation v6.8 by @github-actions[bot] in #27807
• [community] Update community contributions in README by @github-actions[bot] in #27805
• [dead-code] chore: remove dead functions — 1 function removed by @github-actions[bot] in #27818
• Configure Daily Documentation Updater to fall back to review issues on protected-file changes by @Copilot in #27826
• [architecture] Update architecture diagram - 2026-04-22 by @github-actions[bot] in #27792
• Accept deprecated max_tokens for MCP audit/compile and remove conflicting guidance by @Copilot in #27783
• [code-simplifier] refactor: extract lookupContainerPin helper to eliminate duplication (#27762 follow-up) by @github-actions[bot] in #27784
• [docs] Self-healing documentation fixes: document tools.github.mode gh-proxy - 2026-04-22 by @github-actions[bot] in #27839
• Refactor compile helpers: co-locate stats logic, isolate infrastructure concerns, and collapse batch wrapper layers by @Copilot in #27825
• [aw-compat] Close gh aw fix --write gaps for Serena imports, workflow_run branches, and dependabot permissions by @Copilot in #27836
• Increase Q workflow timeout to prevent Copilot engine timeout failures by @Copilot in #27846
• Add progressive NOTE disclosure to comment-memory footer by @Copilot in #27848
• Update smoke-ci haiku cache-memory behavior and issue body count by @Copilot in #27849
• Route add_comment to PR review thread replies on pull_request_review_comment triggers (including relayed workflow contexts) by @Copilot in #27838
• Add issues: read to update-project GitHub App token permissions by @Copilot in #27837
• Resolve CLI help consistency gaps across init, trial, mcp add, and logs by @Copilot in #27861
• Handle PR #27837 review comments for create-project issues permissions by @Copilot in #27868
• Stabilize wasm golden comparison by normalizing AWF --image-tag digest suffixes by @Copilot in #27872
• Disable shell history expansion for bash scripts and MCP CLI wrappers by @Copilot in #27851
• [log] feat(logging): add dedicated debug loggers to 5 pkg files by @github-actions[bot] in #27904
• Add daily Sentry OTel token consumption report workflow by @Copilot in #27916
• test: satisfy testifylint assertions in agentdrain spec test by @Copilot in #27907
• Add github.ref_name and github.head_ref to OTLP span resource attributes by @Copilot in #27903
• build(deps): Bump @xmldom/xmldom from 0.9.9 to 0.9.10 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #27901
• Move detection caution callout to top of agent failure issue/comment bodies by @Copilot in #27896
• Add schema and integration coverage for safe-outputs.create-pull-request.allowed-base-branches by @Copilot in #27885
• build(deps-dev): Bump fast-xml-parser from 5.5.10 to 5.7.1 in /actions/setup/js in the npm_and_yarn group across 1 directory by @dependabot[bot] in #27917
• Fix docs build by updating stale GitHub tools anchor links by @Copilot in #27931
• Handle case-colliding artifact extraction failures on macOS without aborting remaining downloads by @Copilot in #27893
• Add on.needs to support pre_activation/activation dependencies for credential-supply jobs by @Copilot in #27895
• Align package specs with exported API surface in actionpins, parser, and workflow by @Copilot in #27929
• Make BYOK Copilot defaults and deprecate byok-copilot flag by @Copilot in #27902
• Fix activity_report cache persistence when report step fails by @Copilot in #27947
• Add daily skill-optimizer workflow with artifact handoff and 3-improvement issue output by @Copilot in #27948
• Handle side-repo checkouts in push_to_pull_request_branch by scoping git ops to target repo cwd by @Copilot in #27894
• Fix Codex TOML provider ordering so model_provider stays root-level under firewall mode by @Copilot in #27959
• Fix push-to-pull-request-branch commit links to use the actual pushed SHA by @Copilot in #27953
• Simplify activity_report logs download and restore issue generation from downloaded logs by @Copilot in #27956
• [jsweep] Clean check_runs_helpers: add comprehensive test coverage by @github-actions[bot] in #27973
• Fix Codex threat detection job proxy setup by @Copilot in #27974
• [otel-advisor] Add progressive disclosure to generated issue body sections by @Copilot in #27985
• [WIP] Fix dependabot-go-checker workflow to include vulnerability-alerts permission by @Copilot in #27987
• Unblock daily skill-optimizer runs by adding root SKILL surface docs, committed config, and early workflow preflight by @Copilot in #27988
• [WIP] Fix inconsistent logging guard in error constructors by @Copilot in #27990
• [code-simplifier] Apply Enabled() guards consistently to all logger calls in workflow_errors.go by @github-actions[bot] in #27996
• Fix comment-memory disclosure template lookup in safe_outputs by @Copilot in #27989
• feat: add agentic-optimization-kit workflow consolidating token audit, optimizer, and observability kit by @Copilot in #28009
• [architecture] Update architecture diagram - 2026-04-23 by @github-actions[bot] in #28017
• [spec-extractor] Update package specifications for agentdrain, cli, constants by @github-actions[bot] in #28024
• [spec-enforcer] Enforce specifications for actionpins, cli by @github-actions[bot] in #28026
• [instructions] Sync github-agentic-workflows.md with v0.68.3 by @github-actions[bot] in #28030
• [docs] docs: tone scan v6.9 — fix marketing language in hierarchical-agents-quickstart by @github-actions[bot] in #28034
• Run shared APM restore in pre-agent-steps to preserve skills in PR context by @Copilot in #28002
• [fp-enhancer] refactor(actionpins): use slices/maps stdlib for declarative transformations by @github-actions[bot] in #28020
• [docs] Update glossary - daily scan by @github-actions[bot] in #28022
• Add configurable fallback labels for create_pull_request fallback issues by @Copilot in #28004
• fix: strip U+2061–U+2064 invisible mathematical operators in hardenUnicodeText by @Copilot in #28037
• Audit: populate engine/token/turn metrics when aw_info.json is missing by @Copilot in #28003
• Fix MCP CLI bridge numeric arg coercion for schema-less tools by @Copilot in #28005
• Refactor audit workflows with new shared/daily-audit-charts composite import by @Copilot in #28079
• Allow vulnerability-alerts in GitHub Actions schema validation for compiled workflows by @Copilot in #28078
• fix: close XPIA channel in sanitize_content.cjs allowedAliases branch by @Copilot in #28049
• Run pre-agent-steps before MCP gateway startup by @Copilot in #28082
• security: reject disable-xpia-prompt in strict mode at compile time by @Copilot in #28057
• fix(spec-enforcer): recover round-robin state from merged pkg-specifications PRs when cache is empty by @Copilot in #28075
• spec-extractor: initialize rotation state on empty cache and enforce deterministic 4-package round-robin by @Copilot in #28077
• fix: strip Unicode Tag Characters (U+E0020–U+E007F) in hardenUnicodeText by @Copilot in #28059
• fix: apply sanitizeContent to body in create_discussion and create_pull_request handlers by @Copilot in #28053
• fix: close XPIA steganographic channel in allowedAliases sanitization path by @Copilot in #28055
• Improve DDUw Step 1c with direct content verification before Step 2 fallback by @Copilot in #28101
• feat: support MCP-as-CLI progress messages on stderr by @Copilot in #28109
• [aw-compat] Fix Serena codemod output for nested engine config and stale gh-aw source pins by @Copilot in #28080
• Update comment-memory rendering to use six-backtick code regions by @Copilot in #28115
• chore: delete unused .github/actions directory by @Copilot in #28131
• feat: update smoke-ci to use engine command with comment-memory (#27640) by @Copilot in #28132
• fix: fix spellcheck config to select English dictionaries and render step summary (#daily-astrostylelite-markdown-spellcheck) by @Copilot in #28134
• Refactor MCP setup generation to eliminate generateMCPSetup architecture violation by @Copilot in #28114
• [WIP] Add support for multiple assignments to agent per issue by @Copilot in #28103
• fix: sync test expectations with COPILOT_API_KEY injection and BYOK default model by @Copilot in #28136
• Add git hooks and DESIGN.md to protected-files defaults and sync docs by @Copilot in #28127

Full Changelog: v0.69.3...v0.70.0