build(deps): bump the actions group with 2 updates

[dependabot]

Bumps the actions group with 2 updates: github/gh-aw/actions/setup-cli and actions/deploy-pages.

Updates github/gh-aw/actions/setup-cli from 0.87.3 to 0.88.2

Release notes

Sourced from github/gh-aw/actions/setup-cli's releases.

v0.88.2

🌟 Release Highlights

A focused patch release improving safe-output reliability and CI hygiene: call_workflow inputs no longer get dropped during samples replay, sample-coverage gaps are now surfaced as warnings, and AI credit budgets are validated more safely to close a CodeQL alert.

🐛 Bug Fixes & Improvements

• Fixed call_workflow samples replay dropping workflow_name — ingestion previously stripped workflow_name/inputs for call_workflow safe outputs, causing the apply job to fail with "Workflow name is empty" (#58113).
• Added warnings for uncovered samples — --use-samples compilation now warns when an enabled safe output has no samples: entries, so silent no-op replay runs are easier to catch (#58112).
• Hardened AI credit budget handling — the max AI credits expression moved from inline shell interpolation to step env:, with strict integer validation before configuring the AWF firewall budget, resolving a CodeQL code-injection alert (#58116).

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

Generated by 🚀 Release · copilot · auto · 16.4 AIC · ⊞ 11.8K

---

What's Changed

• Fix call_workflow samples replay dropping workflow_name during ingestion by @​dsyme with @​Copilot in github/gh-aw#58113
• Warn when samples replay has no coverage; add replace-label sample to E2E workflow by @​dsyme with @​Copilot in github/gh-aw#58112
• Move max AI credits expression to step env and validate integer in shell run block by @​pelikhan with @​Copilot in github/gh-aw#58116

Full Changelog: github/gh-aw@v0.88.1...v0.88.2

v0.88.0

🌟 Release Highlights

This release focuses on hardening the sandbox runtime, simplifying browser automation with a new Playwright CLI approach, and fixing dependency resolution for nested workflow imports.

⚠️ Breaking Changes

• Removed built-in Playwright MCP support (#57521). Browser automation now goes through the new Playwright CLI guidance instead of the bundled MCP server — update workflows that relied on the built-in Playwright MCP tool.

✨ What's New

• Sandbox security settings replaced with runtime profiles (#57692) — legacy sandbox security flags are now expressed as declarative runtime profiles, making sandbox configuration easier to reason about. See the sandbox reference.
• Playwright CLI guidance and browser provisioning (#57731, #57691, #57594) — new AWF-aware policy prompts, configuration, and a shared smoke test make it easier to provision and use Playwright safely from agentic workflows.
• gh-aw-firewall v0.28.12 integration (#57514) — pulls in attested Cloud Hypervisor artifacts for stronger supply-chain guarantees on the firewall image.
• Operational value report evaluator and history (#57503) — new tooling to evaluate and track the operational value of agentic workflow runs over time.

🐛 Bug Fixes & Improvements

• Fixed dependency ordering and cycle detection for nested imports (#57746) — resolves incorrect ordering and undetected cycles when shared workflow files import each other transitively. See the imports reference.
• Codex custom tools now classified as invalid-model failures (#57578) — clearer error reporting when Codex is configured with unsupported custom tools.
• Fixed stale skill docs and repo-path guard (#57579) for the action-based JS architecture.
• Super-Linter restricted to Go modules (#57465), reducing noise from linting unrelated file types.
• Added a daily Windows Defender release scan (#57768) to catch malware false positives early.

... (truncated)

Commits

• 8e30bcd Move max AI credits expression to step env and validate integer in shell run ...
• d89d731 Warn when samples replay has no coverage; add replace-label sample to E2E wor...
• 93dcf0e Fix call_workflow samples replay dropping workflow_name during ingestion (#58...
• b4fadaa feat(manifest): add optional icon field supporting emoji, octicon, and SVG re...
• 1e1fbac Restore MicroVM and ARC runner cards on homepage (#58054)
• dc5c0d2 fix(compiler): normalize gateway policy server IDs (#58023)
• 86c0e5a Prevent PR body injection during transfer (#58034)
• 37750b6 Stop suggesting redundant Playwright CLI mode (#58041)
• e96e161 Fix CodeQL code-injection alert for runner.tool_cache in generated shell ru...
• 650574f Add API and storage budgets to logs downloads (#58022)
• Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The changes are limited to bumping pinned GitHub Action SHAs to newer patch versions with no workflow-structure changes.

Pull request overview

Updates pinned GitHub Actions revisions used by repository workflows to pick up upstream fixes and improvements while keeping actions pinned to commit SHAs for supply-chain safety.

Changes:

• Bump actions/deploy-pages from v5.0.0 to v5.0.1 in the GitHub Pages deployment workflow.
• Bump github/gh-aw/actions/setup-cli from v0.87.3 to v0.88.2 in Copilot setup and agentic workflow checks.

File summaries

File	Description
.github/workflows/website-gh-pages.yml	Updates the pinned actions/deploy-pages SHA to v5.0.1 for Pages deployment.
.github/workflows/copilot-setup-steps.yml	Updates the pinned github/gh-aw/actions/setup-cli SHA to v0.88.2 for Copilot environment setup.
.github/workflows/check-agentic-workflows.yml	Updates the pinned github/gh-aw/actions/setup-cli SHA to v0.88.2 for lockfile drift checks.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.