Bump github/gh-aw-actions/setup-cli from 0.80.8 to 0.81.6

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.80.8 to 0.81.6.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.81.6

Sync of actions from gh-aw at v0.81.6.

v0.81.5

Sync of actions from gh-aw at v0.81.5.

v0.81.4

Sync of actions from gh-aw at v0.81.4.

v0.81.3

Sync of actions from gh-aw at v0.81.3.

v0.81.2

Sync of actions from gh-aw at v0.81.2.

v0.81.1

Sync of actions from gh-aw at v0.81.1.

v0.81.0

Sync of actions from gh-aw at v0.81.0.

v0.80.9

Sync of actions from gh-aw at v0.80.9.

Commits

• ba6380c chore: sync actions from gh-aw@v0.81.6 (#175)
• 8b1faef chore: sync actions from gh-aw@v0.81.5 (#174)
• 9fba95c chore: sync actions from gh-aw@v0.81.4 (#172)
• a95cb38 chore: sync actions from gh-aw@v0.81.3 (#171)
• b5cde6c chore: sync actions from gh-aw@v0.81.2 (#169)
• 4f64d38 chore: sync actions from gh-aw@v0.81.1 (#168)
• 3c7f3b6 chore: sync actions from gh-aw@v0.81.0 (#167)
• 8c7d04e chore: sync actions from gh-aw@v0.80.9 (#166)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 29, 2026, 2:14 AM ET / 06:14 UTC.

Summary
The PR bumps the pinned github/gh-aw-actions/setup-cli GitHub Action SHA in the Copilot setup workflow from v0.80.8 to v0.81.6.

Reproducibility: not applicable. this is a dependency update PR, not a bug report. The focused runtime evidence is the successful copilot-setup-steps check on the PR head.

Review metrics: 2 noteworthy metrics.

• Workflow diff: 1 file changed, +1/-1. The PR only changes the pinned action reference in one workflow, keeping the review surface small.
• Relevant upstream action files: 0 setup-cli/ files changed. The upstream repo changed broadly, but the action subdirectory used by this workflow did not change between the old and new pinned SHAs.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] The broader Build and Test workflow was still in progress during review, so merge should wait for required checks rather than relying on this read-only review alone.

Maintainer options:

1. Decide the mitigation before merge
   Proceed with the pinned GitHub-owned action bump after required checks finish and maintainers accept the routine Dependabot update.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair lane is needed; this should proceed through normal Dependabot dependency-review and required-check completion.

Security
Cleared: No concrete security or supply-chain regression was found: the action remains pinned to a full SHA, workflow permissions remain minimal, and the used upstream setup-cli/ files are unchanged.

Review details

Best possible solution:

Proceed with the pinned GitHub-owned action bump after required checks finish and maintainers accept the routine Dependabot update.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency update PR, not a bug report. The focused runtime evidence is the successful copilot-setup-steps check on the PR head.

Is this the best way to solve the issue?

Yes; keeping the action pinned to a full SHA while advancing to the upstream v0.81.6 sync is the narrowest maintainable update path, especially because the used setup-cli/ files did not change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 87dc3dc79d7c.

Label changes

Label changes:

• add P3: This is a low-risk GitHub Actions dependency maintenance PR with no product behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so contributor real-behavior proof is not required; the successful Copilot setup check is supplemental workflow evidence.

Label justifications:

• P3: This is a low-risk GitHub Actions dependency maintenance PR with no product behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so contributor real-behavior proof is not required; the successful Copilot setup check is supplemental workflow evidence.

Evidence reviewed

What I checked:

• PR diff is a one-line pinned action update: The only patch replaces the full github/gh-aw-actions/setup-cli SHA and version comment in .github/workflows/copilot-setup-steps.yml; the installed gh-aw CLI version remains v0.72.1. (.github/workflows/copilot-setup-steps.yml:24, 8035c1a28b8b)
• Workflow keeps minimal local permissions: Current main grants only contents: read to the Copilot setup job and runs checkout plus the pinned setup-cli action. (.github/workflows/copilot-setup-steps.yml:17, 87dc3dc79d7c)
• Upstream action entrypoint unchanged in relevant subdir: The upstream compare reported no files under setup-cli/ changed between the old pinned SHA and the new pinned SHA. (ba6380cc6e5b)
• Upstream action shape inspected: At the new pinned SHA, setup-cli/action.yml is still a composite action that runs install.sh with the requested version and optional GitHub token. (github/gh-aw-actions/setup-cli/action.yml:1, ba6380cc6e5b)
• PR head workflow status checked: GitHub reported copilot-setup-steps completed successfully and the PR remained mergeable, while the broader Build and Test jobs were still in progress during review. (8035c1a28b8b)
• Workflow provenance: The Copilot setup workflow was introduced in commit 3e003463c9e2700f2eaf2d402d56f590f59bd071; recent changes to the file are Dependabot action bumps. (.github/workflows/copilot-setup-steps.yml:1, 3e003463c9e2)

Likely related people:

• AlexAlves87: git blame and git log --follow show commit 3e003463c9e2700f2eaf2d402d56f590f59bd071 introduced the Copilot setup workflow and its current structure. (role: introduced workflow; confidence: high; commits: 3e003463c9e2; files: .github/workflows/copilot-setup-steps.yml)
• dependabot[bot]: Recent merged history on this file consists of Dependabot updates for github/gh-aw-actions and actions/checkout, matching this PR’s dependency-bump surface. (role: recent dependency update automation; confidence: high; commits: d4a24b39d6e0, da6b7d19e487; files: .github/workflows/copilot-setup-steps.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.