chore(deps): bump github/gh-aw-actions/setup-cli from 0.84.1 to 0.86.1

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.84.1 to 0.86.1.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.86.1

Sync of actions from gh-aw at v0.86.1.

v0.86.0

Sync of actions from gh-aw at v0.86.0.

v0.85.4

Sync of actions from gh-aw at v0.85.4.

v0.85.1

Sync of actions from gh-aw at v0.85.1.

v0.85.0

Sync of actions from gh-aw at v0.85.0.

v0.84.4

Sync of actions from gh-aw at v0.84.4.

v0.84.3

Sync of actions from gh-aw at v0.84.3.

v0.84.2

Sync of actions from gh-aw at v0.84.2.

Commits

• 8914f47 chore: sync actions from gh-aw@v0.86.1 (#211)
• 19356ac chore: sync actions from gh-aw@v0.86.0 (#210)
• 2709137 chore: sync actions from gh-aw@v0.85.4 (#209)
• b078ca2 chore: sync actions from gh-aw@v0.85.1 (#208)
• 32d9b58 chore: sync actions from gh-aw@v0.85.0 (#207)
• 4f46189 chore: sync actions from gh-aw@v0.84.4 (#206)
• c863074 chore: sync actions from gh-aw@v0.84.3 (#205)
• fd783ac chore: sync actions from gh-aw@v0.84.2 (#204)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 2:14 AM ET / 06:14 UTC.

ClawSweeper review

What this changes

The PR updates the immutable revision of the GitHub Action that installs the gh-aw CLI in the Copilot setup workflow from v0.84.1 to v0.86.1.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open. This is a narrow, correctly pinned workflow dependency update, but it needs current-head real workflow output before merge because the PR supplies only check status.

Likely related people: dependabot[bot] for recent updates to this action pin, and Caleb Eden for the surrounding Copilot setup workflow history.

Priority: P3
Reviewed head: a736fad27d98e1bbe5bda04ac0ddaf608c175317

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	4 items	Current main action pin: Current main still uses the v0.84.1 immutable action revision, so the requested v0.86.1 update is not already implemented. Narrow branch diff: The submitted change replaces only the full SHA and matching version comment for the existing setup-cli action. Feature history: Recent merged Dependabot updates established the same immutable-pin maintenance pattern for this action.
Findings	None	None.
Security	None	None.

How this fits together

The Copilot setup workflow prepares a GitHub-hosted development environment and installs the gh-aw CLI before setup steps run. This action pin affects that automation path, not the Windows node runtime.

flowchart LR
  A[Workflow trigger] --> B[Copilot setup job]
  B --> C[Checkout repository]
  C --> D[Install gh-aw CLI]
  D --> E[Run setup steps]
  E --> F[Prepared development environment]

Loading

Before merge

• Resolve merge risk (P1) - The updated third-party action controls Copilot environment setup; status-only CI does not show the actual updated action completing its installation path on the PR head.
• Complete next step (P2) - No code repair is indicated; the outstanding merge gate is contributor-provided current-head workflow evidence.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow scope	1 file, +1/-1	The branch changes only the immutable revision and version annotation of one existing workflow action.

Merge-risk options

Maintainer options:

1. Add current-head setup evidence (recommended)
   Attach a redacted job-log excerpt or live output that shows the v0.86.1 action completed the Copilot setup path.
2. Accept status-only evidence
   Merge based on the successful check while explicitly accepting that the action's observed setup output was not reviewed.

Technical review

Best possible solution:

Keep the full-SHA pin, attach a redacted current-head Copilot setup job excerpt that shows the updated action completed, then merge if the observed setup remains successful.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a GitHub Actions dependency update rather than a reported product failure; the relevant proof is a current-head workflow run.

Is this the best way to solve the issue?

Unclear: the immutable SHA update follows the existing maintenance pattern, but a direct after-fix setup result is needed to establish that this revision remains compatible.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 582a44713860.

Labels

Label changes:

• add P3: This is a routine CI dependency maintenance update with no reported user-facing regression.
• add merge-risk: 🚨 automation: The updated action runs in the Copilot setup workflow, so an upstream behavior change could disrupt repository automation.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Label justifications:

• P3: This is a routine CI dependency maintenance update with no reported user-facing regression.
• merge-risk: 🚨 automation: The updated action runs in the Copilot setup workflow, so an upstream behavior change could disrupt repository automation.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• Current main action pin: Current main still uses the v0.84.1 immutable action revision, so the requested v0.86.1 update is not already implemented. (.github/workflows/copilot-setup-steps.yml:24, 582a44713860)
• Narrow branch diff: The submitted change replaces only the full SHA and matching version comment for the existing setup-cli action. (.github/workflows/copilot-setup-steps.yml:24, a736fad27d98)
• Feature history: Recent merged Dependabot updates established the same immutable-pin maintenance pattern for this action. (.github/workflows/copilot-setup-steps.yml:24, 1835bfa2f79e)
• Direct workflow status: The PR reports a successful copilot-setup-steps check, but no current-head job output showing the updated action's observed setup result. (.github/workflows/copilot-setup-steps.yml:24, a736fad27d98)

Likely related people:

• dependabot[bot]: Authored the two most recent merged updates to this exact action pin. (role: recent action-version updater; confidence: high; commits: 1835bfa2f79e, 93ecfe5c284f; files: .github/workflows/copilot-setup-steps.yml)
• Caleb Eden: Authored the earlier current-history change to the Copilot setup workflow. (role: recent workflow contributor; confidence: medium; commits: d0fca93d5f61; files: .github/workflows/copilot-setup-steps.yml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.