[ci] Upgrade and automate gh-aw workflows

[jonathanpeppers]

Summary

Upgrade the repository's remaining gh-aw configuration to the latest stable release, v0.86.2, and add a weekly job that installs the latest stable gh-aw release and creates or updates one upgrade pull request.

The three existing agentic workflow lock files were already generated with v0.86.2. The local CLI was upgraded from v0.84.3 before running gh aw upgrade; newer v0.86.3/v0.87.x releases are currently prereleases and were intentionally excluded.

Changes

• Migrated skill-runner.md from deprecated expires: 30 syntax to expires: 30d and regenerated its lock-file metadata.
• Refreshed the agentic-workflows dispatcher skill with the new enclaves.md and jobs.md references.
• Updated validate-pat-pool.yml from the v0.81.6 gh-aw setup action to the v0.86.2 SHA pin.
• Added agentic-auto-upgrade-pr.yml, scheduled Mondays at 04:17 UTC.
• Recompiled all three executable agentic workflows. android-reviewer.lock.yml and nightly-fix-finder.lock.yml remained unchanged because they were already current; shared/pat_pool.md is an imported component rather than a standalone compiled workflow.

Weekly automation

The scheduled job:

• Runs only on the repository's default branch and never on forks.
• Uses the protected copilot-pat-pool environment and requires GH_AW_GITHUB_TOKEN to update workflow files.
• Resolves and installs GitHub's latest stable gh-aw release before upgrading.
• Runs gh aw upgrade and then recompiles every agentic workflow with validation.
• Includes all changes under .github/agents, .github/aw, .github/skills, and .github/workflows; unexpected changes outside those paths fail visibly instead of being discarded.
• Reuses the bot-owned automation/gh-aw-upgrade branch and updates its existing open PR, preventing duplicate upgrade PRs.
• Serializes scheduled and manual runs with a non-cancelling concurrency group.

Validation

• gh aw compile .github/workflows --validate: 3 succeeded, 0 warnings
• Scheduled workflow passes actionlint v1.7.12
• Repository-wide search confirms exactly three *.lock.yml files
• Useful description of why the change is necessary
• Links to issues fixed: N/A
• Unit tests: workflow compile, schema validation, and actionlint

[Copilot]

Pull request overview

Upgrades the repository’s remaining gh-aw configuration to the v0.86.2 toolchain and adds a scheduled workflow that invokes the generated agentic maintenance “upgrade” operation to open an upgrade PR when allowlisted files change.

Changes:

• Updated validate-pat-pool to use the v0.86.2 pinned github/gh-aw-actions/setup SHA.
• Migrated skill-runner.md safe-outputs expires syntax from 30 to 30d and regenerated lock metadata accordingly.
• Added a weekly scheduled workflow (agentic-auto-upgrade-pr.yml) that calls the reusable agentics-maintenance.yml workflow with operation: upgrade, and refreshed the agentic-workflows dispatcher skill references.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/validate-pat-pool.yml	Updates the gh-aw setup action pin to v0.86.2 for PAT pool validation.
.github/workflows/skill-runner.md	Switches deprecated expires: 30 to expires: 30d for gh-aw safe outputs behavior.
.github/workflows/skill-runner.lock.yml	Regenerated gh-aw lock metadata after the expires frontmatter change.
.github/workflows/agentic-auto-upgrade-pr.yml	Adds a scheduled/manual dispatcher to run the generated maintenance workflow’s upgrade operation.
.github/skills/agentic-workflows/SKILL.md	Refreshes upstream gh-aw reference list with new enclaves.md / jobs.md docs.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

Four automation blockers remain in the v0.86.2 upgrade path:

• The called maintainer check accepts only permission == admin|maintain, but GitHub reports repository maintainers as permission: write, role_name: maintain, so normal maintainers are rejected before upgrade runs.
• gh aw upgrade mutates workflow source/locks, but the handler stages only a non-workflow allowlist and does not report excluded changes; source codemods such as expires: 30→30d are silently discarded and cannot be recreated by compile alone.
• Every weekly run creates a timestamped branch/new fixed-title PR without searching for an existing upgrade PR, so serialized runs still duplicate open PRs.
• Manual dispatch can select a non-default ref; the reusable workflow branches from it and opens against main, including unrelated commits.

Please fix maintain-role detection, surface/handle excluded workflow migrations, deduplicate upgrade PRs, and force/guard the default branch.

[jonathanpeppers]

@dalexsoto Thanks — all four blockers were relevant. I replaced the reusable maintenance call with a default-branch-only updater that:

• installs the latest stable gh-aw release before upgrading;
• includes workflow sources and lock files, and fails on unexpected changed paths;
• reuses one bot-owned branch and updates its existing open PR;
• runs only from the default branch, inside the protected environment;
• no longer relies on the upstream maintainer-role helper.

The workflow still keeps a non-cancelling concurrency group, and the branch remains a single commit. All three agentic workflows compile with validation and the updater passes actionlint.

stale