chore: upgrade gh-aw workflows to v0.42.0 and fix strict mode violations (#552)

- Run `gh aw upgrade` to update agent files, action pins, and recompile all workflows
- Fix issue-monster.md: replace write permissions with read (safe-outputs handles writes)
- Update 10 GitHub Actions to latest versions (setup v0.42.7, checkout v4.3.1, etc.)
- Run post-processing to use local awf build in CI smoke/build-test workflows
- Add recompile-workflows skill for consistent future workflow regeneration

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Mossaka

.claude/skills/recompile-workflows/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: recompile-workflows
+description: Regenerate and post-process all agentic workflows. Use when gh-aw is updated, workflow .md files change, or when asked to recompile/regenerate workflows.
+allowed-tools: Bash(gh:*), Bash(npx:*), Read, Glob, Edit
+---
+
+# Recompile Agentic Workflows
+
+Use this skill when you need to regenerate all agentic workflow lock files and apply post-processing.
+
+## IMPORTANT: Post-processing is required after EVERY lock file change
+
+Any time `.lock.yml` files are regenerated — whether via `gh aw compile`, `gh aw upgrade`, or any other gh-aw command — you MUST run the post-processing script afterward. This is not optional.
+
+## Steps
+
+### 1. Compile or upgrade workflows
+
+Use whichever command is appropriate:
+
+```bash
+# Full upgrade (updates agents, actions, codemods, then compiles)
+gh aw upgrade
+
+# Just recompile (when only .md workflow files changed)
+gh aw compile
+```
+
+If any workflow fails to compile (e.g., strict mode violations like `contents: write`), fix the `.md` source file and re-run.
+
+### 2. Run post-processing script (ALWAYS)
+
+**This step MUST run every time lock files are regenerated, regardless of how they were generated.**
+
+The post-processing script replaces the "Install awf binary" step in smoke and build-test workflows with local build+install steps, so CI tests the repo's own code instead of a released binary.
+
+```bash
+npx ts-node scripts/ci/postprocess-smoke-workflows.ts
+```
+
+This updates these lock files:
+- `smoke-copilot.lock.yml`
+- `smoke-claude.lock.yml`
+- `smoke-chroot.lock.yml`
+- `build-test-node.lock.yml`
+- `build-test-go.lock.yml`
+- `build-test-rust.lock.yml`
+- `build-test-java.lock.yml`
+- `build-test-cpp.lock.yml`
+- `build-test-deno.lock.yml`
+- `build-test-bun.lock.yml`
+
+## Common Issues
+
+### Strict mode violations
+Newer gh-aw versions enforce strict mode which disallows write permissions like `contents: write`, `issues: write`, etc. Workflows should use `safe-outputs` for write operations and only request `read` permissions.
+
+### Discussion category warnings
+Warnings about "General" vs "general" discussion category casing are non-blocking.
+
+## Verification
+
+After both steps, run `git diff --stat` to review all changed files. Expect changes in:
+- `.github/agents/` - Updated agent files
+- `.github/aw/actions-lock.json` - Updated action pins
+- `.github/workflows/*.lock.yml` - Regenerated lock files
+- `.github/workflows/*.md` - If codemods applied fixes

.github/agents/agentic-workflows.agent.md

@@ -17,12 +17,17 @@ This is a **dispatcher agent** that routes your request to the appropriate speci
 - **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
 - **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
 
+Workflows may optionally include:
+
+- **Project tracking / monitoring** (GitHub Projects updates, status reporting)
+- **Orchestration / coordination** (one workflow assigning agents or dispatching and coordinating other workflows)
+
 ## Files This Applies To
 
 - Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
 - Workflow lock files: `.github/workflows/*.lock.yml`
 - Shared components: `.github/workflows/shared/*.md`
-- Configuration: `.github/aw/github-agentic-workflows.md`
+- Configuration: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/github-agentic-workflows.md
 
 ## Problems This Solves
 
@@ -44,7 +49,7 @@ When you interact with this agent, it will:
 ### Create New Workflow
 **Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
 
-**Prompt file**: `.github/aw/create-agentic-workflow.md`
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/create-agentic-workflow.md
 
 **Use cases**:
 - "Create a workflow that triages issues"
@@ -54,7 +59,7 @@ When you interact with this agent, it will:
 ### Update Existing Workflow  
 **Load when**: User wants to modify, improve, or refactor an existing workflow
 
-**Prompt file**: `.github/aw/update-agentic-workflow.md`
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/update-agentic-workflow.md
 
 **Use cases**:
 - "Add web-fetch tool to the issue-classifier workflow"
@@ -64,7 +69,7 @@ When you interact with this agent, it will:
 ### Debug Workflow  
 **Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
 
-**Prompt file**: `.github/aw/debug-agentic-workflow.md`
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/debug-agentic-workflow.md
 
 **Use cases**:
 - "Why is this workflow failing?"
@@ -74,7 +79,7 @@ When you interact with this agent, it will:
 ### Upgrade Agentic Workflows
 **Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
 
-**Prompt file**: `.github/aw/upgrade-agentic-workflows.md`
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/upgrade-agentic-workflows.md
 
 **Use cases**:
 - "Upgrade all workflows to the latest version"
@@ -84,19 +89,43 @@ When you interact with this agent, it will:
 ### Create Shared Agentic Workflow
 **Load when**: User wants to create a reusable workflow component or wrap an MCP server
 
-**Prompt file**: `.github/aw/create-shared-agentic-workflow.md`
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/create-shared-agentic-workflow.md
 
 **Use cases**:
 - "Create a shared component for Notion integration"
 - "Wrap the Slack MCP server as a reusable component"
 - "Design a shared workflow for database queries"
 
+### Orchestration and Delegation
+
+**Load when**: Creating or updating workflows that coordinate multiple agents or dispatch work to other workflows
+
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/orchestration.md
+
+**Use cases**:
+- Assigning work to AI coding agents
+- Dispatching specialized worker workflows
+- Using correlation IDs for tracking
+- Orchestration design patterns
+
+### GitHub Projects Integration
+
+**Load when**: Creating or updating workflows that manage GitHub Projects v2
+
+**Prompt file**: https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/projects.md
+
+**Use cases**:
+- Tracking items and fields with update-project
+- Posting periodic run summaries
+- Creating new projects
+- Projects v2 authentication and configuration
+
 ## Instructions
 
 When a user interacts with you:
 
 1. **Identify the task type** from the user's request
-2. **Load the appropriate prompt** using `.github/aw/<prompt-name>.md`
+2. **Load the appropriate prompt** from the GitHub repository URLs listed above
 3. **Follow the loaded prompt's instructions** exactly
 4. **If uncertain**, ask clarifying questions to determine the right prompt
 
@@ -106,9 +135,6 @@ When a user interacts with you:
 # Initialize repository for agentic workflows
 gh aw init
 
-# Create a new workflow
-gh aw new <workflow-name>
-
 # Compile workflows
 gh aw compile [workflow-name]
 
@@ -133,7 +159,7 @@ gh aw compile --validate
 
 ## Important Notes
 
-- Always reference the instructions file at `.github/aw/github-agentic-workflows.md` for complete documentation
+- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.42.0/.github/aw/github-agentic-workflows.md for complete documentation
 - Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
 - Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
 - Follow security best practices: minimal permissions, explicit network access, no template injection

.github/aw/actions-lock.json

@@ -1,60 +1,50 @@
 {
   "entries": {
-    "actions/checkout@v4": {
+    "actions/checkout@v4.3.1": {
       "repo": "actions/checkout",
-      "version": "v4",
+      "version": "v4.3.1",
       "sha": "34e114876b0b11c390a56381ad16ebd13914f8d5"
     },
     "actions/github-script@v8": {
       "repo": "actions/github-script",
       "version": "v8",
       "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
     },
-    "actions/setup-node@v4": {
+    "actions/setup-node@v4.4.0": {
       "repo": "actions/setup-node",
-      "version": "v4",
+      "version": "v4.4.0",
       "sha": "49933ea5288caeca8642d1e84afbd3f7d6820020"
     },
-    "actions/upload-artifact@v4": {
+    "actions/upload-artifact@v4.6.2": {
       "repo": "actions/upload-artifact",
-      "version": "v4",
+      "version": "v4.6.2",
       "sha": "ea165f8d65b6e75b540449e92b4886f43607fa02"
     },
-    "docker/build-push-action@v5": {
+    "docker/build-push-action@v5.4.0": {
       "repo": "docker/build-push-action",
-      "version": "v5",
+      "version": "v5.4.0",
       "sha": "ca052bb54ab0790a636c9b5f226502c73d547a25"
     },
-    "docker/login-action@v3": {
+    "docker/login-action@v3.7.0": {
       "repo": "docker/login-action",
-      "version": "v3",
-      "sha": "5e57cd118135c172c3672efd75eb46360885c0ef"
+      "version": "v3.7.0",
+      "sha": "c94ce9fb468520275223c153574b00df6fe4bcc9"
     },
-    "docker/setup-buildx-action@v3": {
+    "docker/setup-buildx-action@v3.12.0": {
       "repo": "docker/setup-buildx-action",
-      "version": "v3",
+      "version": "v3.12.0",
       "sha": "8d2750c68a42422c14e847fe6c8ac0403b4cbd6f"
     },
-    "github/gh-aw/actions/setup@v0.37.3": {
-      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.37.3",
-      "sha": "55503f44aef44813947980f65655a67b5ed8702f"
-    },
-    "github/gh-aw/actions/setup@v0.38.1": {
-      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.38.1",
-      "sha": "98493c96da3fb6a59dc232e32a7b990a4c4e8969"
-    },
-    "github/gh-aw/actions/setup@v0.40.0": {
-      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.40.0",
-      "sha": "76d37d925abd44fee97379206f105b74b91a285b"
-    },
     "github/gh-aw/actions/setup@v0.42.0": {
       "repo": "github/gh-aw/actions/setup",
       "version": "v0.42.0",
       "sha": "a7134347103ecf66b4bd422c3e9ce6466d400c02"
     },
+    "github/gh-aw/actions/setup@v0.42.7": {
+      "repo": "github/gh-aw/actions/setup",
+      "version": "v0.42.7",
+      "sha": "b16be66a3f0089b92ad39c580f42421b7104a849"
+    },
     "softprops/action-gh-release@v1": {
       "repo": "softprops/action-gh-release",
       "version": "v1",

.github/workflows/agentics-maintenance.yml

@@ -33,7 +33,7 @@ name: Agentic Maintenance
 
 on:
   schedule:
-    - cron: "37 0 * * *"  # Daily (based on minimum expires: 30 days)
+    - cron: "37 0 * * *"  # Daily (based on minimum expires: 7 days)
   workflow_dispatch:
 
 permissions: {}