ci: gh-aw toolchain pin is hard-coded to v0.82.14 in 4 places, making Dependabot bumps (#1171) structurally unmergeable

[groupthinking]

Canonical issue

This is the canonical issue for the recurring validate-gh-aw failure on #1171 (and every future github/gh-aw-actions/* Dependabot bump).

Outcome

Filing this so the automated PR-remediation loop stops re-deriving the same diagnosis on every run. #1171 has now been triaged four separate times (comments 5153421012, 5153453550, 5153454764) with the same conclusion. It cannot be fixed by any agent or by ·@·d·ependabot r·ecreate — it needs a one-time human toolchain bump. This issue records the exact change set.

Prior triage said "bump at source and recompile," which is correct but incomplete — it did not identify where the source pin lives. There are four places, and .github/aw/actions-lock.json and the three assertions inside gh-aw-validation.yml were never named.

Root cause

The .lock.yml files are compiler-generated. Dependabot rewrote the pinned SHA inside the generated artifacts; .github/workflows/gh-aw-validation.yml then recompiles from source with a hard-pinned v0.82.14 compiler and git diff --exit-codes the result. The recompile reverts Dependabot's edit, so the diff is non-empty and the job exits 1.

From run 30993992684 (- = committed by Dependabot, + = what the pinned compiler emits):

-        uses: github/gh-aw-actions/setup@fd783ac87efde5e0c0e05d593f1906ea25b5d92e # v0.84.2
+        uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14
##[error]Process completed with exit code 1.

The version is asserted in four independent places, all of which must move together:

#	Location	Current value
1	gh-aw-validation.yml → gh extension install github/gh-aw --pin v0.82.14, plus the ACTUAL_VERSION != v0.82.14 → exit 1 assert	v0.82.14
2	gh-aw-validation.yml → prerelease check gh api repos/github/gh-aw/releases/tags/v0.82.14	v0.82.14
3	gh-aw-validation.yml → "Verify lock declaration" step, which hard-codes both the key and the SHA	key github/gh-aw-actions/setup@v0.82.14, sha b6d1443e05b8716267fa19425b99aa4f12006b4a
4	.github/aw/actions-lock.json → entries["github/gh-aw-actions/setup@v0.82.14"]	{version: v0.82.14, sha: b6d1443e…}

Because step 3 asserts the exact SHA and step 1 asserts the exact compiler version, editing any subset fails a different assertion. This is why no partial fix works.

Scope

• Included: the four call sites above, plus regenerating canonical-pr-remediator.lock.yml and focused-coverage-controller.lock.yml with the v0.84.2 compiler.
• Explicitly excluded: the lock files must be produced by a real gh aw compile run, not hand-edited. v0.84.2 may change more than the setup pin (the lock files also carry a pinned firewall container image, currently ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e868…), so a hand-written diff will fail the same git diff --exit-code gate it is trying to satisfy.

Remediation (one-time, human, needs a real gh CLI environment)

gh extension remove aw || true
gh extension install github/gh-aw --pin v0.84.2

# 1-3: update the three v0.82.14 assertions in .github/workflows/gh-aw-validation.yml
#      -> v0.84.2, and the expected setup SHA -> fd783ac87efde5e0c0e05d593f1906ea25b5d92e
# 4:   update .github/aw/actions-lock.json entry key + version + sha

gh aw compile canonical-pr-remediator focused-coverage-controller --validate --approve
git add .github/workflows/*.lock.yml .github/aw/actions-lock.json .github/workflows/gh-aw-validation.yml

Then either fold that into #1171's branch or land it as a replacement PR and close #1171 as superseded.

Alternative (if the toolchain bump isn't wanted now)

Stop the recurring noise by having Dependabot ignore compiler-managed actions. .github/dependabot.yml currently has no ignore rule for these:

  - package-ecosystem: "github-actions"
    ignore:
      - dependency-name: "github/gh-aw-actions/*"

Risk

• Risk level: low for the alternative; medium for the toolchain bump (touches every agentic workflow's compiled output, so the full validate-gh-aw suite — --actionlint --zizmor --poutine — is the gate).
• Failure mode: a partial edit leaves validate-gh-aw red on a different assertion than before.
• Rollback: revert the commit; the pin is entirely declarative.

Note on a related structural gate

PR Governance also fails on #1171 (run 30993990728) with Canonical issue is missing or still contains only template placeholders … exactly one closing reference is required: Closes #<issue>. Dependabot PRs can never satisfy this — their body is release notes. It is currently non-blocking (mergeable_state is unstable, not blocked), so it is cosmetic, but it will stay red on every bot PR. Related to #1130.

[linear-code]

GRV-330

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#222 - docs: branch-cleanup assessment + reproducible fail-test harness [merged]
#359 - chore(ci): audit .github/workflows — prune broken, fix fragile, document all [merged]
#404 - fix(web): sync package-lock with @vercel/functions (unblocks #277 auto-merge) [merged]
#411 - ci: add agentic verification loop workflow and refactor state log [merged]
#593 - ci(phase-goal-tracker): goal tracker workflow with reviewer findings resolved (supersedes #531) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!