Upgrade workflows to gh-aw v0.93.1

.github/agents/agentic-workflows.md

@@ -8,10 +8,20 @@ disable-model-invocation: true
 
 This agent helps you work with **GitHub Agentic Workflows (gh-aw)**, a CLI extension for creating AI-powered workflows in natural language using markdown files.
 
+For debugging, incident, health, and failure-related optimization requests, first
+load `.github/aw/debug-bootstrap.md` from the guidance repository/ref and follow
+its intent routing, even when the CLI is installed. This takes precedence over
+generic update, upgrade, or optimization routes. Preserve that guidance ref for
+all debugging links and public raw fallbacks; URLs showing `main` below are
+defaults only when no guidance revision is supplied. Reuse already-loaded guides.
+The intent index is `.github/aw/debug-scenarios.md`; load only the selected
+specialized route, not every debugging reference.
+
 ## Repository Instructions Overlay
 
-If `.github/aw/instructions.md` exists, load it with:
-@.github/aw/instructions.md
+Load the target repository's `.github/aw/instructions.md`, if present.
+Use `@.github/aw/instructions.md` only in a matching checkout; do not substitute
+a guidance-repository overlay.
 
 Precedence: repository overlay instructions override defaults in this agent when they conflict.
 
@@ -22,6 +32,7 @@ This is a **dispatcher agent** that routes your request to the appropriate speci
 - **Creating new workflows**: Routes to `create` prompt
 - **Updating existing workflows**: Routes to `update` prompt
 - **Diagnosis, patching, and active debugging**: Routes to `debug-agentic-workflow` for the local-first strategy, evidence triage and live gates
+- **Repository-wide debugging or run analysis**: Routes to `analyzing-runs` for existing-run failure clustering before selecting a workflow; supplied run/failure scope takes precedence
 - **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
 - **Creating report-generating workflows**: Routes to `report` prompt — consult this whenever the workflow posts status updates, audits, analyses, or any structured output as issues, discussions, or comments
 - **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
@@ -63,7 +74,7 @@ When you interact with this agent, it will:
 
 ## Available Prompts
 
-> **Note**: The prompt and reference files listed below are located in the [`github/gh-aw`](https://github.com/github/gh-aw) repository and are **not available locally** in this repository. Load them from their public URLs.
+> **Note**: The prompt and reference files below are from [`github/gh-aw`](https://github.com/github/gh-aw). Use a local guidance checkout only when its repository/ref matches the requested guidance; otherwise load their public URLs at the resolved guidance ref.
 
 If GitHub API, `gh api`, or GitHub MCP downloads return HTTP 403 (including a token SAML-authorized for a different organization), do not retry with the same token. Fetch the public file without authentication from `https://raw.githubusercontent.com/github/gh-aw/main/<path>` instead, preserving its repository-relative path (including `.github/`). For example: `curl --fail --silent --show-error --location 'https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-agentic-workflow.md'`. Use the same fallback for referenced instructions and `SKILL.md` files; never send an Authorization header or token to the raw URL. If the public download fails, report that error rather than proceeding without the required instructions. This fallback is for public `github/gh-aw` content only, not private or enterprise repositories.
 
@@ -94,12 +105,25 @@ If GitHub API, `gh api`, or GitHub MCP downloads return HTTP 403 (including a to
 
 The shared strategy distinguishes diagnosis/patching from permitted active debug
 loops using explicit live gates and includes existing-run evidence triage.
+For CLI setup or run-URL scoping in a fresh session, first load
+`https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/debug-bootstrap.md`; it bootstraps
+this same strategy rather than a separate debug procedure.
 
 **Use cases**:
 - "Why is this workflow failing?"
 - "Analyze the logs for workflow X"
 - "Investigate missing tool calls in run #12345"
 
+### Analyze Existing Runs or Repository-Wide Failures
+**Load when**: User asks to debug or optimize agentic workflows generally, without a specific run/failure scope
+
+**Prompt file**: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/analyzing-runs.md`
+
+Start with repository-wide existing-run failure clustering, not an arbitrary
+workflow or a request to pick one. Supplied workflow/run/failure scope takes
+precedence. Use the shared debugging strategy for subsequent fixes; never
+dispatch workflows to obtain evidence.
+
 ### Upgrade Agentic Workflows
 **Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
 
@@ -213,12 +237,12 @@ gh aw init
 gh aw compile [workflow-name]
 
 # Only where permitted and human-validated under debug-agentic-workflow.md:
-gh aw run <workflow-name>             # interactive input collection
-gh aw run <workflow-name> --ref main  # run on a specific branch
+gh aw run <workflow-name> --ref REVIEWED_REF
 
 # Debug workflow runs
-gh aw logs [workflow-name]
-gh aw audit <run-id>
+gh aw logs [workflow-name] --repo HOST/OWNER/REPO
+gh aw audit <run-url>  # preserve host/repository and any job/step scope
+gh aw compile <workflow-name> --dry-run  # first test of workflow changes
 
 # Upgrade workflows
 gh aw fix --write
@@ -238,8 +262,8 @@ gh aw compile --validate
 
 ## Important Notes
 
-- Always reference the instructions file at `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md` for complete documentation
-- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
+- For complete documentation, load `.github/aw/github-agentic-workflows.md` from the resolved guidance repository/ref.
+- Use gh-aw MCP tools only when exposed and authorized; otherwise use available CLI, cached evidence or static source through the CLI/MCP reference.
 - Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
 - **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
 - Follow security best practices: minimal permissions, explicit network access, no template injection

.github/aw/actions-lock.json

@@ -10,15 +10,15 @@
       "version": "v7.0.2",
       "sha": "cf430e030ddbb5b0abf93d22962f4752f3646cd9"
     },
-    "github/gh-aw-actions/setup-cli@v0.92.6": {
+    "github/gh-aw-actions/setup-cli@v0.93.1": {
       "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.92.6",
-      "sha": "8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7"
+      "version": "v0.93.1",
+      "sha": "a9e8b9f9a1449237c6856d2bc8b11ab9c21460e0"
     },
-    "github/gh-aw-actions/setup@v0.92.6": {
+    "github/gh-aw-actions/setup@v0.93.1": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.92.6",
-      "sha": "8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7"
+      "version": "v0.93.1",
+      "sha": "a9e8b9f9a1449237c6856d2bc8b11ab9c21460e0"
     }
   },
   "containers": {
@@ -37,6 +37,11 @@
       "digest": "sha256:80c4ddd927647b636f49807d2557b4cd3ec175c894194e432c9374f5a69e890f",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.28.62@sha256:80c4ddd927647b636f49807d2557b4cd3ec175c894194e432c9374f5a69e890f"
     },
+    "ghcr.io/github/gh-aw-firewall/agent:0.28.70": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.28.70",
+      "digest": "sha256:b15ab48cbbab02904eb9bbd359a398db59690eebbea1e6934d47ed2bb407dd34",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.28.70@sha256:b15ab48cbbab02904eb9bbd359a398db59690eebbea1e6934d47ed2bb407dd34"
+    },
     "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42": {
       "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42",
       "digest": "sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607",
@@ -52,6 +57,11 @@
       "digest": "sha256:ebb9e7b5bec475f6b6c2eb6e999ada7d41d57d0acbacb8493c5bebc0106fd44d",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.28.62@sha256:ebb9e7b5bec475f6b6c2eb6e999ada7d41d57d0acbacb8493c5bebc0106fd44d"
     },
+    "ghcr.io/github/gh-aw-firewall/api-proxy:0.28.70": {
+      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.28.70",
+      "digest": "sha256:9ac8f9c7294e892c916de3da9d2588dfd8cd4931e5c39b00143266d7ed9fd52a",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.28.70@sha256:9ac8f9c7294e892c916de3da9d2588dfd8cd4931e5c39b00143266d7ed9fd52a"
+    },
     "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42": {
       "image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42",
       "digest": "sha256:da006bf96d2d246dd269d57b233c1798d2ad63d6cd64ca02f7bf71045028781f",
@@ -67,6 +77,11 @@
       "digest": "sha256:b23bbe2c025f60ea9aacde67c078ea937b54b4039552bca072ae9610d9e1c294",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.62@sha256:b23bbe2c025f60ea9aacde67c078ea937b54b4039552bca072ae9610d9e1c294"
     },
+    "ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.70": {
+      "image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.70",
+      "digest": "sha256:372ac51a5cccffdfe484f3f7be427d2d1c566e8ae550d55bd45d9fd166a154b4",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.70@sha256:372ac51a5cccffdfe484f3f7be427d2d1c566e8ae550d55bd45d9fd166a154b4"
+    },
     "ghcr.io/github/gh-aw-firewall/squid:0.27.42": {
       "image": "ghcr.io/github/gh-aw-firewall/squid:0.27.42",
       "digest": "sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0",
@@ -82,10 +97,15 @@
       "digest": "sha256:b145850ed8bdffd2d4fcd8f1f3ea5793b56cadee6989700b91f42cff490630ef",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.28.62@sha256:b145850ed8bdffd2d4fcd8f1f3ea5793b56cadee6989700b91f42cff490630ef"
     },
-    "ghcr.io/github/gh-aw-mcpg:v0.4.35": {
-      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.35",
-      "digest": "sha256:35e28671836380c0eae52660ea2ad7e5f6659f63cb20d1abae9271656c670858",
-      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.35@sha256:35e28671836380c0eae52660ea2ad7e5f6659f63cb20d1abae9271656c670858"
+    "ghcr.io/github/gh-aw-firewall/squid:0.28.70": {
+      "image": "ghcr.io/github/gh-aw-firewall/squid:0.28.70",
+      "digest": "sha256:b5bc53f4becfd96e926e63c83831f1b3c9512f713c83161d2b8c9b7204b3e917",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.28.70@sha256:b5bc53f4becfd96e926e63c83831f1b3c9512f713c83161d2b8c9b7204b3e917"
+    },
+    "ghcr.io/github/gh-aw-mcpg:v0.4.37": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.37",
+      "digest": "sha256:9c7f242f6dec2d7d7b55d4c9e07872d59b85377c6cb3de46c915a5d1ffb91442",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.37@sha256:9c7f242f6dec2d7d7b55d4c9e07872d59b85377c6cb3de46c915a5d1ffb91442"
     },
     "ghcr.io/github/gh-aw-node": {
       "image": "ghcr.io/github/gh-aw-node",

.github/skills/agentic-workflows/SKILL.md

@@ -9,12 +9,24 @@ Use this skill when a user asks to design, create, update, debug, or upgrade Git
 
 This skill is a dispatcher: identify the task type, load the matching workflow prompt/skill file, and follow it directly. Keep responses concise and ask a clarifying question if the correct prompt is unclear.
 
+For debugging sessions needing CLI setup or run-URL scoping, first load
+`https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/debug-bootstrap.md`; it bootstraps
+the same shared strategy used by the debugging routes below.
+
+Debugging, incident, health, and failure-related optimization requests use the
+bootstrap's intent routing before generic update, upgrade, or optimization routes,
+even when the CLI is installed. Preserve the supplied guidance repository/ref
+for all debugging links and public raw fallbacks; URLs showing `main` below are
+defaults only when no guidance revision is supplied. Reuse already-loaded guides.
+The intent index is `.github/aw/debug-scenarios.md`; load only the selected
+specialized route, not every debugging reference.
+
 Repository overlay (optional):
-- If `.github/aw/instructions.md` exists, load it with `@.github/aw/instructions.md` after loading the matched prompt/skill.
+- Load the target repository's `.github/aw/instructions.md`, if present, after the matched prompt/skill. Use `@.github/aw/instructions.md` only in a matching checkout; do not substitute a guidance-repository overlay.
 - Precedence: repository overlay instructions override upstream defaults when they conflict.
 
 Read only the files you need:
-Load these files from `github/gh-aw` (they are not available locally).
+Use a local guidance checkout only when its repository/ref matches the requested guidance; otherwise use the resolved guidance repository/ref (default `github/gh-aw`).
 If GitHub API, `gh api`, or GitHub MCP downloads return HTTP 403 (including a token SAML-authorized for a different organization), do not retry with the same token. Fetch the public file without authentication from `https://raw.githubusercontent.com/github/gh-aw/main/<path>` instead, preserving its repository-relative path (including `.github/`). For example: `curl --fail --silent --show-error --location 'https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-agentic-workflow.md'`. Use the same fallback for referenced instructions and `SKILL.md` files; never send an Authorization header or token to the raw URL. If the public download fails, report that error rather than proceeding without the required instructions. This fallback is for public `github/gh-aw` content only, not private or enterprise repositories.
 - `.github/aw/action-container-substitutions.md`
 - `.github/aw/agent-runtime-instructions.md`
@@ -33,13 +45,20 @@ If GitHub API, `gh api`, or GitHub MCP downloads return HTTP 403 (including a to
 - `.github/aw/create-agentic-workflow.md`
 - `.github/aw/create-shared-agentic-workflow.md`
 - `.github/aw/debug-agentic-workflow.md`
+- `.github/aw/debug-bootstrap.md`
+- `.github/aw/debug-compilation.md`
+- `.github/aw/debug-live-testing.md`
 - `.github/aw/debug-model-engine-misconfiguration.md`
 - `.github/aw/debug-playbook.md`
+- `.github/aw/debug-scenarios.md`
 - `.github/aw/debug-security-review.md`
+- `.github/aw/debug-workflow-evidence.md`
+- `.github/aw/debug-workflow-health.md`
 - `.github/aw/dependabot.md`
 - `.github/aw/deployment-status.md`
 - `.github/aw/designer-mappings.md`
 - `.github/aw/designer.md`
+- `.github/aw/documentation-workflows.md`
 - `.github/aw/drive-memory.md`
 - `.github/aw/enclaves.md`
 - `.github/aw/evals.md`
@@ -106,7 +125,7 @@ After loading the matching workflow prompt or skill, follow it directly:
 - Update existing workflows: `.github/aw/update-agentic-workflow.md`
 - Diagnose, patch, audit, or actively debug workflows: `.github/aw/debug-agentic-workflow.md` (local-first strategy, evidence triage and live gates)
 - Analyze existing runs, logs, or recurring failures: `.github/aw/analyzing-runs.md`. General repository-wide debugging or optimization requests start here with failure clustering before selecting a workflow.
-- AWF model/endpoint 400s, silent cross-family sub-agent failures, `model: auto` failures, install-step 404s after a version pin, or questions about version fields: go directly to [Model and engine misconfiguration](https://github.com/github/gh-aw/blob/main/.github/aw/debug-agentic-workflow.md#model-and-engine-misconfiguration) before suggesting model changes.
+- AWF model/endpoint 400s, silent cross-family sub-agent failures, `model: auto` failures, install-step 404s after a version pin, or questions about version fields: go directly to `.github/aw/debug-agentic-workflow.md#model-and-engine-misconfiguration` before suggesting model changes.
 - Upgrade workflows and fix deprecations: `.github/aw/upgrade-agentic-workflows.md`
 - Create shared components or MCP wrappers: `.github/aw/create-shared-agentic-workflow.md`
 - Create report-generating workflows: `.github/aw/report.md`

.github/workflows/agentic-auto-upgrade.yml

@@ -1,4 +1,4 @@
-# This file was automatically generated by pkg/workflow/auto_update_workflow.go (v0.92.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# This file was automatically generated by pkg/workflow/auto_update_workflow.go (v0.93.1). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -52,12 +52,12 @@ jobs:
           persist-credentials: false
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7 # v0.92.6
+        uses: github/gh-aw-actions/setup-cli@a9e8b9f9a1449237c6856d2bc8b11ab9c21460e0 # v0.93.1
         with:
-          version: v0.92.6
+          version: v0.93.1
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7 # v0.92.6
+        uses: github/gh-aw-actions/setup@a9e8b9f9a1449237c6856d2bc8b11ab9c21460e0 # v0.93.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 

.github/workflows/agentic_commands.yml

@@ -1,10 +1,10 @@
-# gh-aw-commands: {"payload_version":"v1","schema_version":"v1","compiler_version":"v0.92.6","commands":["matt"],"workflows":["mattpocock-skills-reviewer"]}
+# gh-aw-commands: {"payload_version":"v1","schema_version":"v1","compiler_version":"v0.93.1","commands":["matt"],"workflows":["mattpocock-skills-reviewer"]}
 # Routing summary (sorted):
 #   slash commands:
 #     /matt -> mattpocock-skills-reviewer [pull_request_comment,pull_request_review_comment] reaction=eyes
 #   labels:
 #     (none)
-# This file was automatically generated by gh-aw (v0.92.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# This file was automatically generated by gh-aw (v0.93.1). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8b9c5e98dfe3472ac4e3f13e0a2441cd078a2ca7 # v0.92.6
+        uses: github/gh-aw-actions/setup@a9e8b9f9a1449237c6856d2bc8b11ab9c21460e0 # v0.93.1
         with:
           destination: ${{ runner.temp }}/gh-aw/actions