chore(deps): bump github/gh-aw-actions/setup-cli from 0.82.13 to 0.83.3

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.82.13 to 0.83.3.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.83.3

Sync of actions from gh-aw at v0.83.3.

v0.83.2

Sync of actions from gh-aw at v0.83.2.

v0.83.1

Sync of actions from gh-aw at v0.83.1.

v0.83.0

Sync of actions from gh-aw at v0.83.0.

v0.82.15

Sync of actions from gh-aw at v0.82.15.

v0.82.14

Sync of actions from gh-aw at v0.82.14.

Commits

• 6f8e8ef chore: sync actions from gh-aw@v0.83.3 (#199)
• 39143c7 chore: sync actions from gh-aw@v0.83.2 (#198)
• 294c570 chore: upgrade and recompile agentic workflows to v0.83.1 (#197)
• 5727e6f chore: upgrade daily-runtime-threat-scan workflow to gh-aw v0.82.14 (#196)
• 8bdba80 chore: sync actions from gh-aw@v0.83.1 (#194)
• 3480243 chore: sync actions from gh-aw@v0.83.0 (#193)
• 511cb6d chore: sync actions from gh-aw@v0.82.15 (#192)
• b6d1443 chore: sync actions from gh-aw@v0.82.14 (#191)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: found issues before merge. Reviewed July 27, 2026, 2:15 AM ET / 06:15 UTC.

ClawSweeper review

What this changes

The branch changes the immutable revision of the setup-cli GitHub Action that installs gh-aw in the Copilot cloud-agent setup workflow.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

This PR should not merge as a standalone Dependabot pin update. The workflow still installs gh-aw v0.72.1, while the action revision is part of the compiler-managed gh-aw action set; upstream guidance says these action pins must be regenerated together rather than bumped directly. (github.github.com)

Priority: P2
Reviewed head: 0271c26f7447228efeae81e7df3501c366de2c96
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is minimal and SHA-pinned, but it conflicts with the documented gh-aw action-generation contract.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored automation-only update does not need contributor runtime media; the relevant proof is a supported coordinated gh-aw regeneration and successful workflow validation.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored automation-only update does not need contributor runtime media; the relevant proof is a supported coordinated gh-aw regeneration and successful workflow validation.
Evidence reviewed	4 items	PR changes a compiler-managed action pin: The branch changes only .github/workflows/copilot-setup-steps.yml, replacing the immutable setup-cli revision while retaining version: v0.72.1; the updated action therefore remains paired with an older gh-aw CLI release. Upstream regeneration policy: The gh-aw compilation documentation states that Dependabot PRs which bump github/gh-aw-actions should not be merged, because action references must be coordinated by gh aw compile or gh aw update-actions. (github.github.com) Action setup is an execution boundary: The official gh-aw setup documentation identifies setup-cli as the action that installs the CLI used by workflow steps; changing its revision changes code executed before those steps. (github.github.com)
Findings	1 actionable finding	[P1] Regenerate this pin through gh aw compile
Security	None	None.

How this fits together

GitHub runs the Copilot setup workflow before a cloud coding agent starts work in this repository. The workflow checks out the source, installs the gh-aw CLI extension, then executes its automated setup steps, so the action revision affects the automation environment rather than the Windows application runtime.

flowchart LR
  Trigger[Copilot setup trigger] --> Workflow[Copilot setup workflow]
  Workflow --> Checkout[Repository checkout]
  Checkout --> SetupAction[Install gh-aw action]
  SetupAction --> GhAw[gh-aw CLI v0.72.1]
  GhAw --> AgentSetup[Cloud agent setup steps]

Loading

Decision needed

Question	Recommendation
Should the repository adopt the newer gh-aw action set through a deliberate compiler upgrade, or retain the current v0.72.1-generated workflow assets?	Retain the current generated pin: Do not merge this standalone Dependabot update; retain the v0.72.1-compatible action revision until a planned gh-aw upgrade is prepared.

Why: The correct action revision depends on the gh-aw compiler release selected for this repository; the PR does not establish that upgrade decision or regenerate the companion assets.

Before merge

• Regenerate this pin through gh aw compile (P1) - This directly changes a github/gh-aw-actions revision while the workflow still installs gh-aw v0.72.1. Upstream gh-aw guidance says Dependabot action-pin updates must not merge independently because compilation coordinates the action revisions with the chosen compiler release. Regenerate the managed workflow references from the intended gh-aw release, or retain the existing pin. (github.github.com)
• Resolve merge risk (P1) - Merging this one-line action revision independently can leave the Copilot setup workflow using a setup-cli implementation that was not generated and version-coordinated with its installed gh-aw v0.72.1 CLI.
• Resolve merge risk (P1) - The affected workflow runs before cloud-agent work begins, so a compatibility failure would block or alter repository automation rather than fail safely inside the Windows application.

Findings

• [P1] Regenerate this pin through gh aw compile — .github/workflows/copilot-setup-steps.yml:24

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow surface	1 workflow file changed, 1 action pin replaced	The small diff changes executable setup code for Copilot cloud-agent automation, so compatibility must be evaluated against the compiler-managed workflow set.

Merge-risk options

Maintainer options:

1. Regenerate from the selected gh-aw release (recommended)
   Replace the hand-updated pin with the complete output of the supported gh-aw compilation or action-update path for the intended CLI version.
2. Hold the current action set
   Close or defer this standalone update and keep the existing generated pin until maintainers schedule a coherent gh-aw toolchain upgrade.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Regenerate gh-aw-managed workflow action references from the selected compiler release, include every resulting coordinated file change, and verify the Copilot setup workflow.

Technical review

Best possible solution:

Keep the existing compiler-managed pin until a deliberate gh-aw upgrade is performed, then regenerate and review every coordinated workflow/action reference from the intended gh-aw release.

Do we have a high-confidence way to reproduce the issue?

Yes, from source and upstream workflow policy: the PR changes only the setup action revision while leaving the workflow on gh-aw v0.72.1, which is the unsupported independent-pin pattern.

Is this the best way to solve the issue?

No. A direct Dependabot pin bump is not the maintainable path here; the supported solution is a coordinated gh-aw compiler or action-update regeneration for the selected release. (github.github.com)

Full review comments:

• [P1] Regenerate this pin through gh aw compile — .github/workflows/copilot-setup-steps.yml:24
  This directly changes a github/gh-aw-actions revision while the workflow still installs gh-aw v0.72.1. Upstream gh-aw guidance says Dependabot action-pin updates must not merge independently because compilation coordinates the action revisions with the chosen compiler release. Regenerate the managed workflow references from the intended gh-aw release, or retain the existing pin. (github.github.com)
  Confidence: 0.97

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against acf4ab1d2b02.

Labels

Label changes:

• add P2: This is a bounded automation compatibility problem that can affect cloud-agent setup if merged, but it does not affect the shipped Windows runtime.
• add merge-risk: 🚨 compatibility: The changed setup action must remain coordinated with the gh-aw CLI version and generated workflow assets already in the repository.
• add merge-risk: 🚨 automation: The action executes in the Copilot setup workflow before agent work begins, so an uncoordinated pin can break or alter repository automation.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This bot-authored automation-only update does not need contributor runtime media; the relevant proof is a supported coordinated gh-aw regeneration and successful workflow validation.

Label justifications:

• P2: This is a bounded automation compatibility problem that can affect cloud-agent setup if merged, but it does not affect the shipped Windows runtime.
• merge-risk: 🚨 compatibility: The changed setup action must remain coordinated with the gh-aw CLI version and generated workflow assets already in the repository.
• merge-risk: 🚨 automation: The action executes in the Copilot setup workflow before agent work begins, so an uncoordinated pin can break or alter repository automation.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This bot-authored automation-only update does not need contributor runtime media; the relevant proof is a supported coordinated gh-aw regeneration and successful workflow validation.

Evidence

What I checked:

• PR changes a compiler-managed action pin: The branch changes only .github/workflows/copilot-setup-steps.yml, replacing the immutable setup-cli revision while retaining version: v0.72.1; the updated action therefore remains paired with an older gh-aw CLI release. (.github/workflows/copilot-setup-steps.yml:24, 0271c26f7447)
• Upstream regeneration policy: The gh-aw compilation documentation states that Dependabot PRs which bump github/gh-aw-actions should not be merged, because action references must be coordinated by gh aw compile or gh aw update-actions. (github.github.com)
• Action setup is an execution boundary: The official gh-aw setup documentation identifies setup-cli as the action that installs the CLI used by workflow steps; changing its revision changes code executed before those steps. (github.github.com) (.github/workflows/copilot-setup-steps.yml:24, 0271c26f7447)
• Repository precedent is mixed, not an override: The repository release history contains earlier Dependabot gh-aw action-pin updates, but that history does not supersede the current upstream requirement to regenerate coordinated pins from the selected gh-aw compiler release. (github.com)

Likely related people:

• shanselman: The released repository history credits this contributor with CI and dependency-maintenance work, making them the strongest available human routing candidate for a compiler-managed workflow decision. (role: adjacent CI and automation contributor; confidence: low; files: .github/workflows/copilot-setup-steps.yml)
• dependabot[bot]: The repository release history records multiple earlier gh-aw action dependency updates from this bot, so it is connected to the existing pin-update path, though it is not the decision owner. (role: prior automated action-pin updater; confidence: medium; files: .github/workflows/copilot-setup-steps.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Regenerate gh-aw-managed action pins from the intended compiler release.
• Show that the regenerated Copilot setup workflow succeeds before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.