chore: upgrade gh-aw to v0.80.6 and recompile workflows

[lpcox]

Summary

Upgrades the gh-aw extension from v0.79.6 → v0.80.6 (latest pre-release) and recompiles all agentic workflow lock files via gh aw upgrade + the required scripts/ci/postprocess-smoke-workflows.ts post-processing.

Changes

• Compiler bump: compiler_version v0.79.6 → v0.80.6 across all *.lock.yml.
• Action pins:
  • github/gh-aw-actions/setup v0.79.6 → v0.80.6
  • actions/checkout v6.0.3 → v7.0.0 (codemod, applied to .md sources)
  • actions/cache and other action SHAs refreshed in actions-lock.json
• Container pins: firewall images bumped to 0.27.7; github-mcp-server v1.1.2 → v1.3.0.
• Expression-injection codemod: inline ${{ ... }} expressions in run: steps are now hoisted into env: entries (e.g. GH_AW_EXPR_* / EXPR_*), expanded safely at runtime.
• Test updates: refreshed CI workflow expectations for the new pins and the env-based expression-variable pattern in security-guard, export-audit, test-coverage-improver, and test-coverage-reporter workflow tests.

Validation

• npm run build ✅
• npm run lint ✅ (0 errors)
• npm run test:unit ✅ (2859/2859)
• npx jest scripts/ci ✅ (156/156)

Generated lock files were produced by gh aw upgrade + postprocess-smoke-workflows.ts; do not hand-edit.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	97.54%	97.58%	📈 +0.04%
Statements	97.47%	97.50%	📈 +0.03%
Functions	98.85%	98.85%	➡️ +0.00%
Branches	92.87%	92.91%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/workdir-setup.ts	92.7% → 94.5% (+1.82%)	92.7% → 94.5% (+1.82%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Upgrades the repository’s agentic workflow toolchain to gh-aw v0.80.6 and refreshes the generated workflow lock files and related CI tests, including new action/container pins and safer handling of ${{ }} expressions inside run: blocks.

Changes:

• Bump workflow compiler/action pins and refresh .github/aw/actions-lock.json entries (e.g., actions/checkout@v7.0.0, github/gh-aw-actions/setup@v0.80.6, github-mcp-server:v1.3.0).
• Regenerate/adjust agentic workflow sources and lock files (notably smoke workflows and coverage reporter).
• Update CI expectations in scripts/ci/*.test.ts to match the new pins and expression-to-env: pattern.

Show a summary per file

File	Description
scripts/ci/test-coverage-reporter-workflow.test.ts	Updates assertions to validate the new env-based expression variable pattern in the compiled lock.
scripts/ci/test-coverage-improver-workflow.test.ts	Refreshes expected action/container pins for the upgraded workflows.
scripts/ci/security-guard-workflow.test.ts	Refreshes expected setup and github-mcp-server pins.
scripts/ci/export-audit-workflow.test.ts	Refreshes expected github-mcp-server pin.
.github/workflows/test-coverage-reporter.md	Hoists ${{ ... }} expressions into env: and consumes them safely in run:.
.github/workflows/smoke-gemini.lock.yml	Regenerated lock with updated compiler, action/container pins, and new guardrail/cache wiring.
.github/workflows/smoke-copilot.md	Bumps actions/checkout pin in workflow source.
.github/workflows/smoke-codex.md	Bumps actions/checkout pin in workflow source.
.github/workflows/smoke-claude.md	Bumps actions/checkout pin in workflow source.
.github/workflows/smoke-claude.lock.yml	Regenerated lock with updated compiler, action/container pins, and new guardrail/cache wiring.
.github/workflows/duplicate-code-detector.md	Hoists ${{ github.repository }} into env: and uses it in run:.
.github/workflows/doc-maintainer.md	Bumps actions/checkout version in workflow source.
.github/workflows/contribution-check.lock.yml	Regenerated lock with updated compiler/pins and updated runtime wiring.
.github/workflows/ci-cd-gaps-assessment.lock.yml	Regenerated lock with updated compiler/pins and updated runtime wiring.
.github/aw/actions-lock.json	Updates pinned action entries (notably checkout/setup-java/gh-aw actions) for workflow compilation.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 21/53 changed files
• Comments generated: 0