build(deps): bump github/gh-aw-actions/setup-cli from 0.81.6 to 0.82.2

[dependabot]

Bumps github/gh-aw-actions/setup-cli from 0.81.6 to 0.82.2.

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.82.2

Sync of actions from gh-aw at v0.82.2.

v0.82.1

Sync of actions from gh-aw at v0.82.1.

v0.82.0

Sync of actions from gh-aw at v0.82.0.

Commits

• 3fac1cf chore: sync actions from gh-aw@v0.82.2 (#178)
• dadd6a0 chore: sync actions from gh-aw@v0.82.1 (#177)
• 2ad2a51 chore: sync actions from gh-aw@v0.82.0 (#176)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 6, 2026, 2:16 AM ET / 06:16 UTC.

Summary
This PR updates the pinned github/gh-aw-actions/setup-cli action commit in .github/workflows/copilot-setup-steps.yml from v0.81.6 to v0.82.2.

Reproducibility: not applicable. this is a GitHub Actions dependency bump rather than a reported product bug. The relevant observable check is the Copilot setup workflow run, which passed on the PR head.

Review metrics: 2 noteworthy metrics.

• Repository diff: 1 workflow line changed. The local change is narrow and limited to the Copilot setup workflow action pin.
• Upstream action delta: 3 commits, 59 files changed upstream. The one-line pin pulls in a larger upstream setup action sync, so maintainers should treat this as automation dependency risk rather than product code churn.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] This changes code that provisions the Copilot Agent gh-aw setup; the setup job passed, but future agent setup behavior still depends on upstream gh-aw-actions changes that normal product tests do not fully exercise.
• [P1] At inspection time, the workflow-specific setup check had passed but the main Windows build and E2E checks were still pending as routine merge gates.

Maintainer options:

1. Merge after required checks (recommended)
   Accept the routine automation dependency risk once the pending required checks complete, since the workflow-specific setup job already passed and the action remains SHA-pinned.
2. Hold for deeper setup proof
   If maintainers want more confidence in upstream gh-aw behavior beyond installation, wait for a real Copilot Agent setup run or inspect the upstream action diff before merging.

Next step before merge

• [P2] No repair job is needed; this PR should proceed through normal CI completion and maintainer merge review.

Security
Cleared: No concrete security or supply-chain defect was found; the action remains pinned to a GitHub-owned commit, though it is still automation-sensitive.

Review details

Best possible solution:

Keep the bump as a one-line pinned action update, then merge only after required checks complete and maintainers accept the routine automation dependency risk.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a GitHub Actions dependency bump rather than a reported product bug. The relevant observable check is the Copilot setup workflow run, which passed on the PR head.

Is this the best way to solve the issue?

Yes; updating the pinned setup action SHA preserves the existing workflow shape and is narrower than changing the installed gh-aw CLI version or workflow behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 43d40ed60acc.

Label changes

Label changes:

• add P3: This is a low-risk maintenance dependency bump to a GitHub Actions setup workflow with limited product blast radius.
• add merge-risk: 🚨 automation: The PR changes the pinned GitHub Action that provisions the Copilot Agent gh-aw setup, so merge risk is in repository automation rather than application behavior.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot workflow dependency bumps are outside the contributor real-behavior proof gate; the PR's copilot-setup-steps check passed on the new pinned action.

Label justifications:

• P3: This is a low-risk maintenance dependency bump to a GitHub Actions setup workflow with limited product blast radius.
• merge-risk: 🚨 automation: The PR changes the pinned GitHub Action that provisions the Copilot Agent gh-aw setup, so merge risk is in repository automation rather than application behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot workflow dependency bumps are outside the contributor real-behavior proof gate; the PR's copilot-setup-steps check passed on the new pinned action.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its workflow/proof guidance informed the automation-risk and validation review for this GitHub Actions change. (AGENTS.md:1, 43d40ed60acc)
• Current main still uses old setup action: Current main pins github/gh-aw-actions/setup-cli to ba6380cc... with comment v0.81.6, so the central dependency update is not already implemented on main. (.github/workflows/copilot-setup-steps.yml:24, 43d40ed60acc)
• PR diff is a one-line pinned action bump: The PR changes only line 24 of .github/workflows/copilot-setup-steps.yml, replacing ba6380cc... # v0.81.6 with 3fac1cfa... # v0.82.2. (.github/workflows/copilot-setup-steps.yml:24, 9cc2a0c26a48)
• Upstream action release exists: GitHub's gh-aw-actions release v0.82.2 was published on 2026-07-02 and points at commit 3fac1cfa..., described as a sync from gh-aw at v0.82.2. (3fac1cfa7a5a)
• Upstream action delta reviewed at summary level: The upstream compare from the previous pinned action commit to v0.82.2 contains 3 commits and 59 files, which is why this remains an automation dependency risk even though the repository diff is one line. (3fac1cfa7a5a)
• Workflow-specific check passed: GitHub reported the copilot-setup-steps check as passing on the PR head; normal Build and Test jobs were still pending during inspection. (9cc2a0c26a48)

Likely related people:

• Scott Hanselman: Current blame for the Copilot setup workflow line points to 4166e0f..., and local history shows earlier gh-aw workflow setup updates under the same path. (role: introduced/current workflow owner; confidence: high; commits: 4166e0fd63f8, b077078ccca1, e46dfe783037; files: .github/workflows/copilot-setup-steps.yml, .github/aw/actions-lock.json)
• Barbara Kudiess: Recent git history shows work that added/touched the same Copilot setup workflow path as part of setup wizard protocol resilience work. (role: recent adjacent contributor; confidence: medium; commits: 84d2e6ab80c8; files: .github/workflows/copilot-setup-steps.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.