build(deps): bump github/gh-aw-actions/setup-cli from 0.82.2 to 0.82.8

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.82.2 to 0.82.8.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.82.8

Sync of actions from gh-aw at v0.82.8.

v0.82.7

Sync of actions from gh-aw at v0.82.7.

v0.82.6

Sync of actions from gh-aw at v0.82.6.

v0.82.5

Sync of actions from gh-aw at v0.82.5.

v0.82.4

Sync of actions from gh-aw at v0.82.4.

v0.82.3

Sync of actions from gh-aw at v0.82.3.

Commits

• 99d9d88 chore: sync actions from gh-aw@v0.82.8 (#185)
• bf7ba42 chore: sync actions from gh-aw@v0.82.7 (#183)
• cec6394 chore: sync actions from gh-aw@v0.82.6 (#182)
• 55402c5 chore: sync actions from gh-aw@v0.82.5 (#181)
• cba13b4 chore: sync actions from gh-aw@v0.82.4 (#180)
• eb6dc28 chore: sync actions from gh-aw@v0.82.3 (#179)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 13, 2026, 2:15 AM ET / 06:15 UTC.

Summary
The PR updates the pinned github/gh-aw-actions/setup-cli action from v0.82.2 to v0.82.8 in .github/workflows/copilot-setup-steps.yml.

Reproducibility: not applicable. This PR is a routine GitHub Actions dependency update rather than a reported product defect.

Review metrics: 2 noteworthy metrics.

• Diff size: 1 file, 1 addition, 1 deletion. The change is confined to one immutable GitHub Action dependency pin.
• Focused workflow: 1 directly affected workflow check passed. The copilot-setup-steps job successfully exercised the proposed action version.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• [P2] No repair is needed; ordinary required checks and merge policy should gate the exact PR head.

Security
Cleared: The update retains an immutable SHA pin, preserves the action contract and configured CLI version, and passes the directly affected workflow check.

Review details

Best possible solution:

Merge the immutable patch-level action pin after the remaining required checks complete, without changing the separately pinned gh-aw CLI version in this PR.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR is a routine GitHub Actions dependency update rather than a reported product defect.

Is this the best way to solve the issue?

Yes; updating the existing immutable action pin through a one-line Dependabot PR is the narrowest maintainable approach, and the focused setup workflow passes on the proposed head.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 06b4f6362594.

Label changes

Label changes:

• add P3: This is low-risk patch-level CI dependency maintenance with no user-facing product behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored workflow dependency update is bot maintenance, and the directly affected GitHub Actions job supplies the appropriate execution evidence.

Label justifications:

• P3: This is low-risk patch-level CI dependency maintenance with no user-facing product behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored workflow dependency update is bot maintenance, and the directly affected GitHub Actions job supplies the appropriate execution evidence.

Evidence reviewed

What I checked:

• Current main still uses the old pin: The PR patch shows current main using commit 3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a for v0.82.2, so the proposed dependency update is not already implemented. (.github/workflows/copilot-setup-steps.yml:24, 06b4f6362594)
• Narrow immutable update: The sole code change replaces the action pin with immutable commit 99d9d888952ee25fce70c6b3120ca490d7d8da95 and updates its version comment to v0.82.8; the configured gh-aw CLI version remains unchanged. (.github/workflows/copilot-setup-steps.yml:24, 33a6cc7add4d)
• Focused workflow execution passed: The copilot-setup-steps check completed successfully on the proposed head, directly exercising the changed workflow and action pin. (.github/workflows/copilot-setup-steps.yml:24, 33a6cc7add4d)
• Upstream action contract preserved: At the proposed upstream SHA, setup-cli/action.yml remains a composite action accepting the requested CLI version and GitHub token and invoking its installer with those values. (.github/workflows/copilot-setup-steps.yml:24, 99d9d888952e)
• Repository dependency-update precedent: Release v0.6.12 includes the prior setup-cli bump from Bump github/gh-aw-actions/setup-cli from 0.80.8 to 0.81.6 #885, indicating this action pin is maintained through routine Dependabot updates. (.github/workflows/copilot-setup-steps.yml:24, 4166e0fd63f8)

Likely related people:

• shanselman: Recent merged build and release workflow work around v0.6.12 provides the strongest available human routing signal for this Copilot setup dependency update, although direct ownership of this exact line is unclear. (role: adjacent workflow and release contributor; confidence: low; files: .github/workflows/copilot-setup-steps.yml, .github/workflows)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.