chore(deps): bump github/gh-aw-actions/setup-cli from 0.82.8 to 0.82.13

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.82.8 to 0.82.13.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.82.13

Sync of actions from gh-aw at v0.82.13.

v0.82.12

Sync of actions from gh-aw at v0.82.12.

v0.82.11

Sync of actions from gh-aw at v0.82.11.

v0.82.10

Sync of actions from gh-aw at v0.82.10.

v0.82.9

Sync of actions from gh-aw at v0.82.9.

Commits

• a5d8b7d chore: sync actions from gh-aw@v0.82.13 (#190)
• 23fd0ef chore: sync actions from gh-aw@v0.82.12 (#189)
• 38d6267 chore: sync actions from gh-aw@v0.82.11 (#188)
• 0520543 chore: sync actions from gh-aw@v0.82.10 (#187)
• ca8678c chore: sync actions from gh-aw@v0.82.9 (#186)
• 0dda482 chore: update sync workflow to exclude bash tests (#184)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 20, 2026, 2:14 AM ET / 06:14 UTC.

Summary
Updates the SHA-pinned github/gh-aw-actions/setup-cli action in the Copilot setup workflow from v0.82.8 to v0.82.13.

Reproducibility: not applicable. This PR is a dependency revision rather than a reported runtime defect; its relevant verification is execution of the updated Copilot setup workflow.

Review metrics: 1 noteworthy metric.

• Workflow surface: 1 file changed; 1 line added, 1 line removed. The PR is narrowly scoped to the setup action revision and leaves the workflow’s CLI-version input unchanged.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Provide redacted current-head evidence that the Copilot setup job installs and can invoke the configured gh-aw CLI.
• [P1] Wait for the in-progress required CI and setup E2E checks to finish on this exact head.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body supplies release metadata but no after-fix run of the updated Copilot setup action; before merge, provide a redacted current-head workflow result or terminal/live output showing the setup action installs and invokes the configured gh-aw CLI version. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] Updating a Copilot environment setup action can change agent-workflow installation behavior even though the repository’s requested gh-aw CLI version remains v0.72.1; successful workflow execution on the PR head is the relevant compatibility check.

Maintainer options:

1. Verify the updated setup action in CI (recommended)
   Wait for the current-head Copilot setup workflow and required checks to complete successfully before merging this pinned action upgrade.
2. Pause the update
   Close or defer the dependency bump if the updated setup action cannot be shown to install the pinned gh-aw CLI correctly in the repository workflow.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Require successful current-head workflow checks, including copilot-setup-steps, before merge.

Next step before merge

• [P2] This needs ordinary maintainer review of a pinned automation dependency plus current-head workflow proof, not an automated repair.

Security
Cleared: The patch continues to use a full immutable SHA for the same GitHub-hosted action and does not expand workflow permissions, secrets access, or third-party execution scope.

Review details

Best possible solution:

Land the immutable-SHA update after the Copilot setup workflow and required CI complete successfully, with a short redacted run confirmation if the setup action’s runtime behavior is materially changed.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a dependency revision rather than a reported runtime defect; its relevant verification is execution of the updated Copilot setup workflow.

Is this the best way to solve the issue?

Yes: changing only the immutable action SHA is the narrowest maintainable way to consume the requested patch update while preserving the existing workflow configuration.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against bd6c4bf8e575.

Label changes

Label changes:

• add P3: This is a routine patch-level CI dependency update with no reported user-facing regression.
• add merge-risk: 🚨 automation: The only changed behavior is the action that prepares the Copilot agent workflow environment, so a regression would affect repository automation rather than application runtime.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies release metadata but no after-fix run of the updated Copilot setup action; before merge, provide a redacted current-head workflow result or terminal/live output showing the setup action installs and invokes the configured gh-aw CLI version. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a routine patch-level CI dependency update with no reported user-facing regression.
• merge-risk: 🚨 automation: The only changed behavior is the action that prepares the Copilot agent workflow environment, so a regression would affect repository automation rather than application runtime.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies release metadata but no after-fix run of the updated Copilot setup action; before merge, provide a redacted current-head workflow result or terminal/live output showing the setup action installs and invokes the configured gh-aw CLI version. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Current-main baseline: The PR patch is against current main SHA bd6c4bf8e575d414b5a3da750c7d6c16ea62f526 and replaces its existing setup-cli SHA for v0.82.8 with the v0.82.13 SHA. (.github/workflows/copilot-setup-steps.yml:24, bd6c4bf8e575)
• Narrow pinned dependency update: The branch changes exactly one workflow line, retains an immutable full commit SHA, and does not alter workflow permissions, inputs, or the installed gh-aw CLI version. (.github/workflows/copilot-setup-steps.yml:24, e543b2ff49e6)
• Review and validation state: The PR has no human review comments or review findings in the supplied discussion; the focused copilot-setup-steps and repository-hygiene checks succeeded, while the broader test and setup E2E checks were still in progress. (e543b2ff49e6)

Likely related people:

• shanselman: The repository README identifies Scott Hanselman as a project creator; with no file-history attribution available in the supplied review data, he is the best low-confidence routing candidate for an agent-workflow dependency decision. (role: repository lead; confidence: low; files: README.md, .github/workflows/copilot-setup-steps.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.