chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.84.1

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.83.3 to 0.84.1.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.84.1

Sync of actions from gh-aw at v0.84.1.

v0.84.0

Sync of actions from gh-aw at v0.84.0.

v0.83.5

Sync of actions from gh-aw at v0.83.5.

v0.83.4

Sync of actions from gh-aw at v0.83.4.

Commits

• 0292041 chore: sync actions from gh-aw@v0.84.1 (#203)
• f3ca209 chore: sync actions from gh-aw@v0.84.0 (#202)
• 696e63a chore: sync actions from gh-aw@v0.83.5 (#201)
• e89c65e chore: sync actions from gh-aw@v0.83.4 (#200)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 3, 2026, 12:48 PM ET / 16:48 UTC.

ClawSweeper review

What this changes

The PR updates the immutable github/gh-aw-actions/setup-cli revision in the Copilot setup workflow from v0.83.3 to v0.84.1.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

This PR remains necessary because current main still pins v0.83.3. The one-line update is mechanically correct and retains immutable pinning, but accepting the new third-party executable action revision requires a human supply-chain decision before merge.

Priority: P3
Reviewed head: ce46fc45cb434199b2a53e42fcf57a228d4b7aef
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is narrowly scoped and correctly immutable-pinned, but it depends on human acceptance of the new executable action revision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored one-line workflow pin update is appropriately evaluated with upstream revision review and workflow checks, not contributor runtime media.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored one-line workflow pin update is appropriately evaluated with upstream revision review and workflow checks, not contributor runtime media.
Evidence reviewed	5 items	Current main has not incorporated the update: Current main still invokes the v0.83.3 immutable SHA at the changed workflow line, so this PR's central change is not already implemented. Exact proposed patch: The PR commit changes only the setup-cli SHA and matching version comment, from v0.83.3 to v0.84.1. Established dependency-update surface: The latest current-main change to this workflow was Dependabot's prior setup-cli upgrade from v0.82.13 to v0.83.3, indicating this pin is intentionally managed as a GitHub Actions dependency.
Findings	None	None.
Security	Needs attention	Review the newly executed action revision: The new SHA causes the Copilot setup job to execute setup-cli code that current main does not run. Immutable pinning addresses tag drift, not the safety or compatibility of this revision.

How this fits together

The Copilot setup workflow prepares gh-aw before GitHub Copilot agent tasks run in this repository. Its action pin determines which upstream setup code executes in that automation job.

flowchart LR
  A[Workflow trigger] --> B[Copilot setup workflow]
  B --> C[Checkout repository]
  C --> D[Run pinned setup action]
  D --> E[Install gh-aw]
  E --> F[Copilot agent tasks]

Loading

Decision needed

Question	Recommendation
Should this repository accept github/gh-aw-actions/setup-cli v0.84.1 as executable code in the Copilot setup workflow?	Approve the reviewed pin: Accept v0.84.1 after confirming the upstream revision's behavior and permissions match repository expectations.

Why: The patch is mechanically correct, but accepting a newly executed third-party action revision is a repository trust decision that source-level review cannot safely make for maintainers.

Before merge

• Resolve security concern: Review the newly executed action revision - The new SHA causes the Copilot setup job to execute setup-cli code that current main does not run. Immutable pinning addresses tag drift, not the safety or compatibility of this revision.
• Resolve merge risk (P1) - Merging changes the third-party executable action revision in the Copilot setup job. Immutable SHA pinning prevents mutable-tag drift, but it does not establish that the newly executed upstream revision is acceptable for this repository.
• Complete next step (P2) - A human must accept or decline the third-party executable action revision; there is no narrow repository-side repair for an automated fix lane.

Findings

• [medium] Review the newly executed action revision — .github/workflows/copilot-setup-steps.yml:24

Agent review details

Security

Needs attention: No line-level defect is proven, but the diff changes a third-party executable action revision and needs a maintainer supply-chain decision.

Review metrics

Metric	Value	Why it matters
Workflow surface	1 workflow file, 1 action pin changed	The full diff changes the precise upstream action revision that runs before Copilot automation starts.

Merge-risk options

Maintainer options:

1. Inspect the upstream revision before merge (recommended)
   Compare v0.84.1 with the existing immutable revision and merge only after its executable behavior and permissions are accepted.
2. Decline the revision
   Close this Dependabot update and retain the current pin if maintainers do not want to approve the newer upstream action code.

Technical review

Best possible solution:

Review the upstream v0.84.1 action changes and effective permissions, then merge this exact immutable pin only if that review confirms the Copilot workflow remains safe and compatible.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a pinned CI setup dependency rather than correcting a user-reproducible product failure.

Is this the best way to solve the issue?

Yes, conditional on maintainer approval: retaining immutable SHA pinning is the narrowest update path, but the new executable revision must be reviewed before landing.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6e225e4758e1.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The newly pinned revision is third-party executable workflow code.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P3: This is routine dependency maintenance with a limited workflow-only blast radius.
• merge-risk: 🚨 automation: The update changes the setup action invoked by repository automation.
• merge-risk: 🚨 security-boundary: The newly pinned revision is third-party executable workflow code.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot-authored one-line workflow pin update is appropriately evaluated with upstream revision review and workflow checks, not contributor runtime media.

Evidence

Security concerns:

• [medium] Review the newly executed action revision — .github/workflows/copilot-setup-steps.yml:24
  The new SHA causes the Copilot setup job to execute setup-cli code that current main does not run. Immutable pinning addresses tag drift, not the safety or compatibility of this revision.
  Confidence: 0.98

What I checked:

• Current main has not incorporated the update: Current main still invokes the v0.83.3 immutable SHA at the changed workflow line, so this PR's central change is not already implemented. (.github/workflows/copilot-setup-steps.yml:24, 6e225e4758e1)
• Exact proposed patch: The PR commit changes only the setup-cli SHA and matching version comment, from v0.83.3 to v0.84.1. (.github/workflows/copilot-setup-steps.yml:24, ce46fc45cb43)
• Established dependency-update surface: The latest current-main change to this workflow was Dependabot's prior setup-cli upgrade from v0.82.13 to v0.83.3, indicating this pin is intentionally managed as a GitHub Actions dependency. (.github/workflows/copilot-setup-steps.yml:24, 93ecfe5c284f)
• Repository policy covers this dependency class: Dependabot is configured to update the repository's GitHub Actions dependencies weekly. (.github/dependabot.yml:3, 6e225e4758e1)
• Upstream revision review remains unverified: A read-only GitHub query for the current PR discussion and upstream context could not connect, so this review does not claim to have independently inspected the v0.84.1 action implementation.

Likely related people:

• dependabot[bot]: Dependabot authored the two immediately preceding merged updates to this exact action pin on current main. (role: recent area contributor; confidence: high; commits: 93ecfe5c284f, 865ef15fa5b8; files: .github/workflows/copilot-setup-steps.yml)
• Scott Hanselman: The earliest non-bot commit available in the local history sampled for this workflow is attributable to Scott Hanselman; shallow promisor history prevented deeper provenance tracing. (role: earliest locally visible workflow contributor; confidence: low; commits: 277936553135; files: .github/workflows/copilot-setup-steps.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Review the upstream v0.84.1 revision and its effective permissions before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-08-03T06:13:43.162Z sha ce46fc4 :: needs maintainer review before merge. :: none
• reviewed 2026-08-03T07:59:51.174Z sha ce46fc4 :: needs maintainer review before merge. :: none
• reviewed 2026-08-03T12:50:54.230Z sha ce46fc4 :: needs maintainer review before merge. :: none
• reviewed 2026-08-03T14:56:20.162Z sha ce46fc4 :: needs maintainer review before merge. :: none