docs(references): daily intelligence update 2026-04-18

- Update gh-aw-architecture.md: MCP Gateway v0.1.9 → v0.2.24
- Add AWF version v0.25.24 to gh-aw-architecture.md
- Add SideRepoOps context (workflowRepo/eventRepo) to architecture
- Add resolved 'Redact secrets in logs' gotcha to production-gotchas.md
- Add set_issue_fields, resolve_review_thread tools to tools-reference.md
- Add copilot, pull_request_granular, issues_granular toolsets to tools-reference.md
- Add list_commits path/since/until parameters to tools-reference.md
- Update knowledge-base.md with 2026-04-18 findings
- Add intelligence report outputs/gh-aw-reports/2026-04-18.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

.claude/skills/gh-aw-report/knowledge-base.md

@@ -6,6 +6,28 @@
 
 ---
 
+## [2026-04-18] Intelligence Update
+
+### GitHub MCP Server
+- **v1.0.0 released**: 2026-04-16 — first stable major release
+- **`set_issue_fields` tool** (v1.0.0): Sets/updates/deletes org-level custom field values on issues; in `issues_granular` toolset; feature-flagged under `issues_granular`
+- **MCP Apps** (v1.0.0): Graduated from insiders-only to feature flag `remote_mcp_ui_apps`; insiders mode remains for other experiments
+- **`resolve_review_thread` tool** (v0.33.0): Resolves PR review threads; in `pull_request_granular` toolset
+- **Granular toolsets** (v0.33.0): `pull_request_granular` and `issues_granular` OSS toolsets
+- **`list_commits` parameters** (v0.33.0): Added `path`, `since`, `until` filter params
+- **v0.33.1**: Patch over v0.33.0 (2026-04-14)
+
+### gh-aw Core (as of 2026-04-18)
+- **MCP Gateway**: Current default version **v0.2.24** [SUPERSEDES v0.1.9 noted 2026-04-14]
+- **AWF (Actions Workflow Framework)**: Current default version **v0.25.24**
+- **"Redact secrets in logs" fix**: MCP gateway now runs as runner user with proper uid/gid mapping; eliminates persistent log warnings (PR #26658)
+- **`create_pull_request.base_branch`**: Now honored correctly in safe-output patch generation (PR #26952)
+- **Compile hardening**: `gh aw compile` now hardens MCP stdout handling (PR #26968)
+- **Copilot CLI pinned**: Default Copilot CLI version is v1.0.21 (PR #26963)
+- **`SideRepoOps` context**: Native context providing explicit `workflowRepo` vs `eventRepo` distinction for comment scripts (PR #26953)
+
+---
+
 ## [2026-04-14] Bootstrap Entry — Initial Research
 
 ### gh-aw CLI

.claude/skills/gh-aw-report/references/gh-aw-architecture.md

@@ -9,6 +9,7 @@ Stable architectural facts about the GitHub Agentic Workflows ecosystem. Used by
 - **Install**: `gh extension install github/gh-aw`
 - **Purpose**: Compile markdown workflow definitions into GitHub Actions `.lock.yml` files
 - **Key commands**: `gh aw compile`, `gh aw validate`, `gh aw upgrade`, `gh aw mcp inspect`, `gh aw mcp list`
+- **AWF (Actions Workflow Framework)**: Default version **v0.25.24** (as of 2026-04-18)
 
 ### Workflow File Structure
 - **Source**: `.github/workflows/<name>.md` — markdown with YAML frontmatter
@@ -80,7 +81,7 @@ Stable architectural facts about the GitHub Agentic Workflows ecosystem. Used by
 - **`base_ref` parameter:** On Copilot PR tools for stacked PR / feature branch workflows
 - **Insiders mode:** Opt-in experimental features via `/insiders` URL or config header
 - **HTTP mode:** Enterprise deployment with per-request OAuth token forwarding
-- **MCP Gateway:** Centralized access management for MCP servers (v0.1.9 as of 2026-04-14)
+- **MCP Gateway:** Centralized access management for MCP servers (**v0.2.24** as of 2026-04-18; runs as runner user with uid/gid Docker mapping since v0.2.x)
 
 ### Claude Code
 - Anthropic's CLI agentic coding tool
@@ -100,3 +101,12 @@ Stable architectural facts about the GitHub Agentic Workflows ecosystem. Used by
 - `strict: false` — required for custom domains and untrusted input
 - `lockdown` settings for public repositories
 - Network firewall with ecosystem identifiers: `defaults`, `github`, `containers`, `node`, `python`
+
+## Cross-Repository Context
+
+### SideRepoOps Context (workflowRepo vs eventRepo)
+gh-aw provides a native `SideRepoOps` context that distinguishes between:
+- **`workflowRepo`**: The repository where the gh-aw workflow is defined
+- **`eventRepo`**: The repository that triggered the event (may differ in cross-repo scenarios)
+
+This context is used internally for comment scripts and for cross-repository safe-output operations. The distinction matters when using `target-repo` or `allowed-repos` in safe-outputs, or when writing workflows that operate across repositories. Refactored for native context in gh-aw PR #26953 (2026-04-18).

outputs/gh-aw-reports/2026-04-18.md

@@ -0,0 +1,106 @@
+# gh-aw Intelligence Report — 2026-04-18
+
+**Generated**: 2026-04-18  
+**Coverage**: 2026-04-14 → 2026-04-18  
+**Sources**: GitHub API (github-mcp-server, gh-aw commits), repository data
+
+---
+
+## 1. Summary
+
+Significant activity this week: **GitHub MCP Server reached v1.0.0** (its first stable major release) on 2026-04-16. The gh-aw core also had active development, with the default MCP Gateway bumped to **v0.2.24** and AWF to **v0.25.24**, plus a fix for the persistent "Redact secrets in logs" warning in MCP gateway logs.
+
+---
+
+## 2. GitHub MCP Server
+
+### v1.0.0 (2026-04-16) — First Stable Release 🎉
+- **`set_issue_fields` tool**: New tool in the `issues_granular` toolset. Sets, updates, or deletes organization-level custom field values on issues. Feature-flagged under `issues_granular`.
+- **MCP Apps Feature Flag**: MCP Apps UI support migrated from insiders-only mode to a proper feature flag (`remote_mcp_ui_apps`). Will be rolled out to more users with supported clients over time. Insiders mode remains active for other experiments.
+- **Dependencies**: `modelcontextprotocol/go-sdk` upgraded to v1.5.0; `docker/login-action` to 4.0.0; `docker/setup-buildx-action` to 4.0.0.
+- **Source**: https://github.com/github/github-mcp-server/releases/tag/v1.0.0
+
+### v0.33.1 (2026-04-14) — Patch
+- Patch release over v0.33.0. Full changelog: https://github.com/github/github-mcp-server/releases/tag/v0.33.1
+
+### v0.33.0 (2026-04-14) — OSS Granular Toolsets
+- **`resolve_review_thread` tool**: Resolves PR review threads (in `pull_request_granular` toolset).
+- **Granular toolsets (OSS)**: `pull_request_granular` and `issues_granular` — fine-grained write operations separated from default toolsets.
+- **`list_commits` parameters**: Added `path`, `since`, and `until` filter parameters.
+- **Configurable server name/title** via translation strings.
+- **Source**: https://github.com/github/github-mcp-server/releases/tag/v0.33.0
+
+---
+
+## 3. gh-aw Core
+
+### Version Bumps (2026-04-18)
+- **AWF (Actions Workflow Framework)** bumped to **v0.25.24**
+- **MCP Gateway** bumped to **v0.2.24**
+- **Commit**: `Bump default AWF to v0.25.24 and MCP Gateway to v0.2.24 (#26966)`
+
+### "Redact secrets in logs" Fix (2026-04-18)
+- **Issue**: MCP gateway was previously running as a different user than the runner, causing persistent "Redact secrets in logs" warnings in workflow logs.
+- **Fix**: MCP gateway now runs as runner user with proper uid/gid mapping for Docker socket group.
+- **Impact**: Eliminates noisy log warnings; does not affect functionality.
+- **Commit**: `Eliminate persistent "Redact secrets in logs" warnings by running MCP gateway as runner user (#26658)`
+
+### `create_pull_request.base_branch` Honored (2026-04-18)
+- The configured `create_pull_request.base_branch` safe-output parameter is now honored in safe-output patch generation.
+- **Commit**: `Honor configured create_pull_request.base_branch in safe-output patch generation (#26952)`
+
+### Compile: MCP Stdout Hardening (2026-04-18)
+- `gh aw compile` now hardens MCP stdout handling and has compile stdio pollution coverage tests.
+- **Commit**: `Harden compile MCP stdout handling and add compile stdio pollution coverage (#26968)`
+
+### SideRepoOps Context (2026-04-18)
+- Comment scripts refactored for native `SideRepoOps` context, providing explicit `workflowRepo` vs `eventRepo` distinction.
+- **Commit**: `Refactor comment scripts for native SideRepoOps context (workflowRepo vs eventRepo) (#26953)`
+
+### Copilot CLI Pinned to v1.0.21 (2026-04-17)
+- Default Copilot CLI version reverted/pinned to v1.0.21 and lockfiles recompiled.
+- **Commit**: `Revert default Copilot CLI to v1.0.21 and recompile lockfiles (#26963)`
+
+---
+
+## 4. GitHub Actions / Platform
+
+No significant GitHub Actions platform updates identified in this period beyond what's captured above.
+
+---
+
+## 5. GitHub Copilot
+
+No new Copilot-specific updates beyond what's captured in the gh-aw section above.
+
+---
+
+## 6. Ecosystem / Community
+
+No significant community posts or blog posts identified (web search unavailable; GitHub API only).
+
+---
+
+## 7. Gap Analysis Summary
+
+Gaps identified against reference files (see Phase 4 for detail):
+
+| Gap ID | Priority | File | Description |
+|--------|----------|------|-------------|
+| GAP-1 | outdated (2) | `gh-aw-architecture.md` | MCP Gateway version v0.1.9 → v0.2.24 |
+| GAP-2 | missing (3) | `gh-aw-architecture.md` | AWF version v0.25.24 not documented |
+| GAP-3 | missing (3) | `production-gotchas.md` | "Redact secrets in logs" resolved gotcha not documented |
+| GAP-4 | missing (3) | `tools-reference.md` | `set_issue_fields` tool (v1.0.0) not documented |
+| GAP-5 | missing (3) | `gh-aw-architecture.md` | `SideRepoOps` context (workflowRepo/eventRepo) not documented |
+
+*Note: Gaps from yesterday's run (#32 GAP-1, #33 GAP-2, #34 GAP-3) are still open and excluded from today's new issues.*
+
+---
+
+## 8. Recommended Actions
+
+1. Update `gh-aw-architecture.md` MCP Gateway version to v0.2.24
+2. Add AWF version v0.25.24 to architecture documentation  
+3. Document the "Redact secrets in logs" fix in `production-gotchas.md`
+4. Add `set_issue_fields` to `tools-reference.md` GitHub tools section
+5. Document `SideRepoOps` context in `gh-aw-architecture.md`

skills/aw-author/references/production-gotchas.md

@@ -373,3 +373,25 @@ Repositories with branch protection rulesets that require **signed commits** now
 **Current behavior (early 2026+):** gh-aw correctly signs commits on newly created branches. No configuration change needed.
 
 **Edge case:** Custom tokens (`github-token:` in safe-outputs) using a different App identity may still require signing configuration on the target App.
+
+---
+
+## "Redact secrets in logs" Warnings from MCP Gateway
+
+### Symptom
+
+Persistent `"Redact secrets in logs"` warnings appearing in agent workflow logs at MCP gateway startup.
+
+### Root Cause
+
+MCP gateway Docker container was running as a different user than the GitHub Actions runner, causing file permission/ownership mismatches that triggered GitHub Actions' secret redaction heuristics.
+
+### Resolution
+
+**Fixed in gh-aw MCP Gateway v0.2.x** — gateway now runs as runner user with proper uid/gid Docker socket group mapping (gh-aw PR #26658, merged 2026-04-18).
+
+If still seeing this warning:
+1. Update gh-aw extension: `gh aw upgrade`
+2. Verify MCP gateway is v0.2.24+ by checking workflow logs for the MCP gateway version line.
+
+This was a cosmetic/log-noise issue only — workflow functionality was not impacted.

skills/aw-author/references/tools-reference.md

@@ -127,6 +127,9 @@ tools:
 | `secret_protection` | Secret scanning |
 | `security_advisories` | Security advisory management |
 | `stargazers` | Star information |
+| `copilot` | Copilot job management (`get_copilot_job_status`, `assign_copilot_to_issue`, `create_pull_request_with_copilot`) — default toolset since v0.32.0 |
+| `pull_request_granular` | Fine-grained PR operations (`resolve_review_thread`) — feature flag `pull_request_granular`, added v0.33.0 |
+| `issues_granular` | Granular issue field operations (`set_issue_fields`) — feature flag `issues_granular`, added v0.33.0 |
 
 ### Default Toolsets
 
@@ -170,6 +173,20 @@ tools:
 
 **Token precedence:** GitHub App → `github-token` → `GH_AW_GITHUB_MCP_SERVER_TOKEN` → `GH_AW_GITHUB_TOKEN` → `GITHUB_TOKEN`
 
+### Notable GitHub MCP Tools (v0.32.0–v1.0.0)
+
+New and notable tools added in recent GitHub MCP Server releases:
+
+| Tool | Toolset | Version | Description |
+|------|---------|---------|-------------|
+| `get_copilot_job_status` | `copilot` | v0.32.0 | Get status of a Copilot coding agent job |
+| `assign_copilot_to_issue` | `copilot` | v0.32.0 | Assign Copilot to work on an issue |
+| `create_pull_request_with_copilot` | `copilot` | v0.32.0 | Create a PR with Copilot; supports `base_ref` for stacked PRs |
+| `resolve_review_thread` | `pull_request_granular` | v0.33.0 | Resolve a PR review thread by thread ID |
+| `set_issue_fields` | `issues_granular` | v1.0.0 | Set/update/delete org-level custom field values on issues |
+
+**`list_commits` parameter additions** (v0.33.0): Added `path` (filter by file), `since` (ISO 8601 start date), and `until` (ISO 8601 end date) parameters to filter commit history.
+
 ### App Token Permission Inheritance (CRITICAL)
 
 When using `tools.github.app`, the GitHub MCP server requests **ALL** workflow-level permissions for the App token — not just the ones MCP tools need. If the workflow has `packages: read` (e.g., for GHCR docker login in `steps:`) but the GitHub App doesn't have Packages permission, the App token creation fails with HTTP 422.