build(deps): bump the actions group across 1 directory with 6 updates

[dependabot]

Bumps the actions group with 6 updates in the / directory:

Package	From	To
github/gh-aw/actions/setup-cli	0.87.3	0.88.7
github/codeql-action/init	4.37.9	4.38.0
github/codeql-action/autobuild	4.37.9	4.38.0
github/codeql-action/analyze	4.37.9	4.38.0
pnpm/action-setup	6.0.10	6.1.0
actions/deploy-pages	5.0.0	5.0.1

Updates github/gh-aw/actions/setup-cli from 0.87.3 to 0.88.7

Release notes

Sourced from github/gh-aw/actions/setup-cli's releases.

v0.88.7

🌟 Release Highlights

This release focuses on hardening logs tooling, tightening security around agent outputs and secrets, and polishing documentation.

✨ What's New

• Smarter logs downloads: workflow logs can now be pruned with an oldest-run mode, remote workflow names are resolved automatically, and cache size diagnostics/pruning have been improved for concurrent downloads (#59453, #59454, #59338, #59336).
• Safer agent workflows: workflows now fail fast when agents report incomplete work, keeping runs honest instead of silently succeeding (#59316). Agent artifact packaging is now restricted to known files to reduce accidental data exposure (#59334).
• Repo-memory validation: disallowed files are now filtered out before validation/upload rather than failing the push downstream, making the repo-memory workflow more resilient (#58120).
• Flexible output mapping: aw.yml now supports wildcard mapping destination folders (#59317).
• Hardened OTLP handling: OTLP endpoints are now guarded against scheme-only authorization headers to prevent malformed configs from leaking credentials (#59315).
• More reliable provisioning: Node.js is now provisioned for external Copilot threat detection, and transient slash-command provenance checks are retried instead of failing outright (#59314, #59313).
• Claude debug logs have been relocated outside the agent data directory to avoid interfering with agent output packaging (#59450).

🐛 Bug Fixes & Improvements

• Fixed Archie's nested Mermaid fences rendering incorrectly (#59311).

📚 Documentation

• Updated the glossary via the daily documentation scan (#59429).
• Corrected a claim about delegation control listener reachability in the enclaves docs (#59310).
• Clarified fallback issue paths for manual PR creation (#56572).
• Documented the Copilot org-billing tip opt-out (#56564).

Generated by 🚀 Release · copilot · auto · 17 AIC · ⊞ 11.8K

---

What's Changed

• docs(enclaves): correct delegation control listener reachability claim by @​lpcox in github/gh-aw#59310
• Fix Archie’s nested Mermaid fences by @​pelikhan with @​Copilot in github/gh-aw#59311
• Support wildcard mapping destination folders in aw.yml by @​pelikhan with @​Copilot in github/gh-aw#59317
• Fail workflows when agents report incomplete by @​pelikhan with @​Copilot in github/gh-aw#59316
• Retry transient slash-command provenance checks by @​pelikhan with @​Copilot in github/gh-aw#59313
• Guard OTLP endpoints against scheme-only authorization headers by @​pelikhan with @​Copilot in github/gh-aw#59315
• [log] Add debug logging to audit command dispatch by @​github-actions[bot] in github/gh-aw#59357
• Improve logs cache size diagnostics by @​pelikhan with @​Copilot in github/gh-aw#59336
• Prune logs cache during concurrent downloads by @​pelikhan with @​Copilot in github/gh-aw#59338
• Restrict agent artifact packaging to known files by @​pelikhan with @​Copilot in github/gh-aw#59334
• repo-memory: filter disallowed files before validation/upload instead of failing downstream in push by @​dsyme with @​Copilot in github/gh-aw#58120
• Document Copilot org-billing tip opt-out by @​dsyme with @​Copilot in github/gh-aw#56564
• Clarify fallback issue paths for manual PR creation by @​dsyme with @​Copilot in github/gh-aw#56572
• [instructions] Sync instruction files with release v0.88.2 by @​github-actions[bot] in github/gh-aw#59404
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @​github-actions[bot] in github/gh-aw#59419
• [docs] Update glossary - daily scan by @​github-actions[bot] in github/gh-aw#59429
• Provision Node.js for external Copilot threat detection by @​pelikhan with @​Copilot in github/gh-aw#59314
• Relocate Claude debug log outside agent data directory by @​pelikhan with @​Copilot in github/gh-aw#59450
• Resolve remote workflow names for logs targets by @​pelikhan with @​Copilot in github/gh-aw#59454
• Add oldest-run pruning mode to logs downloads by @​pelikhan with @​Copilot in github/gh-aw#59453

... (truncated)

Commits

• bde3679 Add oldest-run pruning mode to logs downloads (#59453)
• 6eb5fd8 Resolve remote logs workflow names (#59454)
• 313f1a6 Relocate Claude debug log outside agent data (#59450)
• 853a3c3 Provision Node.js for external Copilot threat detection (#59314)
• 0971077 [docs] Update glossary - daily scan (#59429)
• c29baaf Update package specifications for parser, repoutil, semverutil, sliceutil (#5...
• 195ec6e [instructions] Sync instruction files with release v0.88.2 (#59404)
• e28414d Clarify fallback issue paths for manual PR creation (#56572)
• bc74362 Document Copilot org-billing tip opt-out (#56564)
• 6f06340 repo-memory: filter disallowed files before validation/upload instead of fail...
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/autobuild from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/autobuild's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates pnpm/action-setup from 6.0.10 to 6.1.0

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.0

What's Changed

• feat: support pnpm v12 by @​zkochan in pnpm/action-setup#288

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

Commits

• ea17c68 feat: support pnpm v12 (#288)
• See full diff in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The shared composite setup action retains the old pnpm pin and should be updated or explicitly documented.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates pinned GitHub Actions used by CI, CodeQL, Copilot setup, and website deployment workflows.

Changes:

• Updates CodeQL actions to v4.38.0.
• Updates gh-aw, pnpm/action-setup, and deploy-pages.
• Refreshes immutable action pins.

File summaries

File	Summary
.github/workflows/website-gh-pages.yml	Updates the Pages deployment action.
.github/workflows/external-integration.yml	Updates pnpm/action-setup; the shared composite setup action still uses v6.0.10 (moderate, 3 votes).
.github/workflows/copilot-setup-steps.yml	Updates the gh-aw setup action.
.github/workflows/codeql.yml	Updates CodeQL init, autobuild, and analyze actions.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.