Merge branch 'main' into copilot/recreate-pr-for-current-main

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.changeset/patch-runtime-safe-outputs-tools-generation.md

@@ -33,7 +33,7 @@ jobs:
         id: precompute
         uses: actions/github-script@v8
         with:
-          github-token: ${{ secrets.GH_AW_BOT_DETECTION_TOKEN || secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const { owner, repo } = context.repo;
             const HOURS_BACK = 6;

.github/workflows/bot-detection.md

@@ -19,6 +19,7 @@ safe-outputs:
   create-pull-request:
     expires: 2d
     title-prefix: "[ci-coach] "
+    protected-files: fallback-to-issue
 timeout-minutes: 30
 imports:
   - shared/ci-data-analysis.md

.github/workflows/ci-coach.md

@@ -1,5 +1,5 @@
 ---
-description: Monitors and updates agentic CLI tools (Claude Code, GitHub Copilot CLI, OpenAI Codex, GitHub MCP Server, Playwright MCP, Playwright Browser, MCP Gateway) for new versions
+description: Monitors and updates agentic CLI tools (Claude Code, GitHub Copilot CLI, OpenAI Codex, GitHub MCP Server, Playwright MCP, Playwright Browser, MCP Gateway, APM) for new versions
 on:
   schedule: daily
   workflow_dispatch:
@@ -31,7 +31,7 @@ timeout-minutes: 45
 
 # CLI Version Checker
 
-Monitor and update agentic CLI tools: Claude Code, GitHub Copilot CLI, OpenAI Codex, GitHub MCP Server, Playwright MCP, Playwright Browser, and MCP Gateway.
+Monitor and update agentic CLI tools: Claude Code, GitHub Copilot CLI, OpenAI Codex, GitHub MCP Server, Playwright MCP, Playwright Browser, MCP Gateway, and APM (Agent Package Manager).
 
 **Repository**: ${{ github.repository }} | **Run**: ${{ github.run_id }}
 
@@ -74,6 +74,11 @@ For each CLI/MCP server:
   - Release Notes: https://github.com/github/gh-aw-mcpg/releases
   - Docker Image: `ghcr.io/github/gh-aw-mcpg:v{VERSION}`
   - Used as default sandbox.agent container (see `pkg/constants/constants.go`)
+- **APM (Agent Package Manager)**: `https://api.github.com/repos/microsoft/APM/releases/latest`
+  - Repository: https://github.com/microsoft/APM
+  - Release Notes: https://github.com/microsoft/APM/releases
+  - Pinned via `DefaultAPMVersion` constant in `pkg/constants/constants.go`
+  - Used as the `version:` input in generated `microsoft/apm-action` steps
 
 **Optimization**: Fetch all versions in parallel using multiple npm view or WebFetch calls in a single turn.
 
@@ -119,6 +124,9 @@ For each update, analyze intermediate versions:
   - Parse release body for changelog entries
   - **CRITICAL**: Convert PR/issue references to full URLs (e.g., `https://github.com/github/gh-aw-mcpg/pull/123`)
   - Note: Used as default sandbox.agent container in MCP Gateway configuration
+- **APM**: Fetch release notes from https://github.com/microsoft/APM/releases/tag/{VERSION}
+  - Parse release body for changelog entries
+  - **CRITICAL**: Convert PR/issue references to full URLs (e.g., `https://github.com/microsoft/APM/pull/123`)
 
 **NPM Metadata Fallback**: When GitHub release notes are unavailable, use:
 - `npm view <package> --json` for package metadata
@@ -267,6 +275,7 @@ Legacy template reference (adapt to use Report Structure Pattern above):
   - GitHub MCP Server: Always fetch from https://github.com/github/github-mcp-server/releases
   - Playwright Browser: Always fetch from https://github.com/microsoft/playwright/releases
   - MCP Gateway: Always fetch from https://github.com/github/gh-aw-mcpg/releases
+  - APM: Always fetch from https://github.com/microsoft/APM/releases
   - Copilot CLI: Try to fetch, but may be inaccessible (private repo)
   - Playwright MCP: Check NPM metadata, uses Playwright versioning
 - **EXPLORE SUBCOMMANDS**: Install and test CLI tools to discover new features via `--help` and explore each subcommand

.github/workflows/cli-version-checker.md

@@ -15,7 +15,8 @@ env:
 tools:
   github:
     toolsets: [default]
-    lockdown: false
+    repos: all
+    min-integrity: none
 safe-outputs:
   create-issue:
     title-prefix: "[Contribution Check Report]"

.github/workflows/contribution-check.md

@@ -16,16 +16,17 @@ permissions:
 tracker-id: daily-multi-device-docs-tester
 engine:
   id: claude
-  max-turns: 50  # Prevent runaway token usage (10 devices × ~3 turns + build/setup/report)
+  max-turns: 80  # 10 devices × ~5 turns each + setup/report overhead
 strict: true
 timeout-minutes: 30
 tools:
+  timeout: 120  # Playwright navigation on Astro dev server can take >60s; increase to 120s
   playwright:
     version: "v1.56.1"
   bash:
     - "npm install*"
-    - "npm run build*"
-    - "npm run preview*"
+    - "npm run dev*"
+    - "npx astro*"
     - "npx playwright*"
     - "curl*"
     - "kill*"
@@ -70,20 +71,19 @@ You are a documentation testing specialist. Your task is to comprehensively test
 
 ## Your Mission
 
-Build the documentation site locally, serve it, and perform comprehensive multi-device testing. Test layout responsiveness, accessibility, interactive elements, and visual rendering across all device types. Use a single Playwright browser instance for efficiency.
+Start the documentation development server and perform comprehensive multi-device testing. Test layout responsiveness, accessibility, interactive elements, and visual rendering across all device types. Use a single Playwright browser instance for efficiency.
 
-## Step 1: Build and Serve
+## Step 1: Install Dependencies and Start Server
 
-Navigate to the docs folder and build the site:
+Navigate to the docs folder and install dependencies:
 
 ```bash
 cd ${{ github.workspace }}/docs
 npm install
-npm run build
 ```
 
 Follow the shared **Documentation Server Lifecycle Management** instructions:
-1. Start the preview server (section "Starting the Documentation Preview Server")
+1. Start the dev server (section "Starting the Documentation Preview Server")
 2. Wait for server readiness (section "Waiting for Server Readiness")
 
 ## Step 2: Device Configuration
@@ -100,10 +100,18 @@ Test these device types based on input `${{ inputs.devices }}`:
 
 Playwright is provided through an MCP server interface, **NOT** as an npm package. You must use the MCP Playwright tools:
 
-- ✅ **Correct**: Use MCP tools like `mcp__playwright__browser_navigate`, `mcp__playwright__browser_run_code`, etc.
+- ✅ **Correct**: Use `mcp__playwright__browser_run_code` with `page.goto(..., { waitUntil: 'domcontentloaded' })`
 - ❌ **Incorrect**: Do NOT try to `require('playwright')` or create standalone Node.js scripts
 - ❌ **Incorrect**: Do NOT install playwright via npm - it's already available through MCP
 
+**⚠️ CRITICAL: Navigation Timeout Prevention**
+
+The Astro development server uses Vite, which loads many JavaScript modules per page. Using the default `waitUntil: 'load'` or `waitForLoadState('networkidle')` will cause 60s timeouts because the browser waits for all modules to finish. **Always use `waitUntil: 'domcontentloaded'`** for navigation:
+
+- ✅ **Correct**: `page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 })`
+- ❌ **Never use**: `page.waitForLoadState('networkidle')` — causes guaranteed timeouts
+- ❌ **Never use**: `mcp__playwright__browser_navigate` for first load — it uses default 'load' wait which times out
+
 **Example Usage:**
 
 ```bash
@@ -117,10 +125,11 @@ echo "Playwright server URL: http://${SERVER_IP}:4321/gh-aw/"
 // Use browser_run_code to execute Playwright commands.
 // IMPORTANT: Replace 172.30.0.20 below with the actual SERVER_IP from the bash command above.
 // Do NOT use "localhost" — Playwright runs with --network host so its localhost differs.
+// ALWAYS use waitUntil: 'domcontentloaded' to prevent timeout on the Vite dev server.
 mcp__playwright__browser_run_code({
   code: `async (page) => {
     await page.setViewportSize({ width: 390, height: 844 });
-    await page.goto('http://172.30.0.20:4321/gh-aw/');  // substitute actual SERVER_IP
+    await page.goto('http://172.30.0.20:4321/gh-aw/', { waitUntil: 'domcontentloaded', timeout: 30000 });  // substitute actual SERVER_IP
     return { url: page.url(), title: await page.title() };
   }`
 })

.github/workflows/daily-multi-device-docs-tester.md

@@ -12,7 +12,6 @@ tracker-id: daily-syntax-error-quality
 engine: copilot
 tools:
   github:
-    lockdown: false
     toolsets:
       - default
   bash:

.github/workflows/daily-syntax-error-quality.md

@@ -11,6 +11,7 @@ permissions:
 engine: copilot
 timeout-minutes: 30
 tools:
+  timeout: 120  # Playwright navigation on Astro dev server can take >60s; increase to 120s
   playwright:
   edit:
   bash:
@@ -62,16 +63,48 @@ Follow the shared **Documentation Server Lifecycle Management** instructions:
 1. Start the preview server (section "Starting the Documentation Preview Server")
 2. Wait for server readiness (section "Waiting for Server Readiness")
 
+**Get the bridge IP for Playwright access** (run this after the server is ready):
+
+```bash
+SERVER_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{print $7; exit}')
+if [ -z "$SERVER_IP" ]; then SERVER_IP=$(hostname -I | awk '{print $1}'); fi
+echo "Playwright server URL: http://${SERVER_IP}:4321/gh-aw/"
+```
+
+Use `http://${SERVER_IP}:4321/gh-aw/` (NOT `localhost:4321`) for all Playwright navigation below.
+
 ## Step 2: Navigate Documentation as a Noob
 
+**IMPORTANT: Using Playwright in gh-aw Workflows**
+
+Playwright is provided through an MCP server interface. Use the bridge IP obtained in Step 1 for all navigation:
+
+- ✅ **Correct**: `browser_run_code` with `page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 })`
+- ✅ **Correct**: `browser_navigate` to `http://${SERVER_IP}:4321/gh-aw/` (use the bridge IP, NOT localhost)
+- ❌ **Incorrect**: Using `http://localhost:4321/...` — Playwright runs with `--network host` so its localhost is the Docker host, not the agent container
+
+**⚠️ CRITICAL: Navigation Timeout Prevention**
+
+The Astro development server loads many JavaScript modules per page. Always use `waitUntil: 'domcontentloaded'`:
+
+```javascript
+// ALWAYS use domcontentloaded - replace SERVER_IP with the actual IP from Step 1
+mcp__playwright__browser_run_code({
+  code: `async (page) => {
+    await page.goto('http://SERVER_IP:4321/gh-aw/', { waitUntil: 'domcontentloaded', timeout: 30000 });
+    return { url: page.url(), title: await page.title() };
+  }`
+})
+```
+
 Using Playwright, navigate through the documentation site as if you're a complete beginner:
 
-1. **Visit the home page** at http://localhost:4321/gh-aw/
+1. **Visit the home page** at `http://${SERVER_IP}:4321/gh-aw/`
    - Take a screenshot
    - Note: Is it immediately clear what this tool does?
    - Note: Can you quickly find the "Get Started" or "Quick Start" link?
 
-2. **Follow the Quick Start Guide** at http://localhost:4321/gh-aw/setup/quick-start/
+2. **Follow the Quick Start Guide** at `http://${SERVER_IP}:4321/gh-aw/setup/quick-start/`
    - Take screenshots of each major section
    - Try to understand each step from a beginner's perspective
    - Questions to consider:
@@ -81,12 +114,12 @@ Using Playwright, navigate through the documentation site as if you're a complet
      - Do code examples work as shown?
      - Are error messages explained?
 
-3. **Check the CLI Commands page** at http://localhost:4321/gh-aw/setup/cli/
+3. **Check the CLI Commands page** at `http://${SERVER_IP}:4321/gh-aw/setup/cli/`
    - Take a screenshot
    - Note: Are the most important commands highlighted?
    - Note: Are examples provided for common use cases?
 
-4. **Explore Creating Workflows guide** at http://localhost:4321/gh-aw/setup/creating-workflows/
+4. **Explore Creating Workflows guide** at `http://${SERVER_IP}:4321/gh-aw/setup/creating-workflows/`
    - Take screenshots of confusing sections
    - Note: Is the workflow format explained clearly?
    - Note: Are there enough examples?

.github/workflows/docs-noob-tester.md

@@ -68,7 +68,7 @@ jobs:
 
       - name: Install dependencies
         working-directory: ./docs
-        run: npm ci
+        run: npm ci --legacy-peer-deps
 
       - name: Build documentation
         working-directory: ./docs

.github/workflows/docs.yml

@@ -13,8 +13,9 @@ permissions:
 engine: copilot
 tools:
   github:
-    lockdown: false
     toolsets: [default, discussions]
+    repos: all
+    min-integrity: none
 safe-outputs:
   create-issue:
     expires: 2d