Upgrade gh-aw to v0.71.0 and recompile workflows

[Copilot]

Lock files were on gh-aw v0.68.3, which suffers from the action SHA pin regression and missing container digest pinning, and lacks the upstream push_to_pull_request_branch reliability fixes implicated in the suffixed-branch / 100-file patch failures.

Changes

• .github/workflows/copilot-setup-steps.yml — bump github/gh-aw-actions/setup-cli to v0.71.0 (49157453228f9641824955e35cbeccbca74ee0fd).
• autoloop.lock.yml / evergreen.lock.yml — regenerated with gh aw compile using v0.71.0:
  • compiler_version and github/gh-aw-actions/setup → v0.71.0
  • container images now digest-pinned: gh-aw-firewall 0.25.20 → 0.25.28, gh-aw-mcpg v0.2.19 → v0.2.30, github-mcp-server v0.32.0 → v1.0.0, node:lts-alpine pinned by sha256
  • emits the Setup Node.js step required by the Copilot threat-detection driver (v0.71 fix)
  • adds the save_base_github_folders.sh step that prevents the base-branch restore from overwriting APM-restored .github/skills (v0.69 fix)

Out of scope

Cleanup of the 54 stale suffixed remote branches mentioned in the issue is a destructive remote operation and is not handled here; it should be done via a separate admin action once the upgrade is confirmed to stop creating new suffixed branches.

Notes for reviewers

• v0.71.0 is currently tagged as a pre-release upstream (the /releases/latest redirect still points at v0.68.3); chosen because the issue explicitly asks for v0.68.3+ and the v0.69/v0.70/v0.71 line contains the relevant push_to_pull_request_branch and SHA-pin fixes.
• References to v0.65.6 remain in .github/agents/agentic-workflows.agent.md; that path is excluded from agent edits and was left untouched.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh auth status (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v9
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.71.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.71.0 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/refs/tags/v0.71.0
  • Triggering command: /usr/bin/curl curl -sL REDACTED (http block)
• https://api.github.com/repos/github/gh-aw/releases/latest
  • Triggering command: /usr/bin/gh gh extension upgrade aw (http block)
  • Triggering command: /usr/bin/gh gh extension install github/gh-aw --pin v0.71.0 (http block)
• https://api.github.com/repos/githubnext/gh-aw/releases/latest
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
  • Triggering command: /usr/bin/curl curl -sSL REDACTED (http block)
• https://api.github.com/repos/githubnext/tsessebe/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --all --json id,name,path,state (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[mrjf]

@copilot recompile all agentic workflows

[Copilot]

@copilot recompile all agentic workflows

Both autoloop.lock.yml and evergreen.lock.yml are the only .md-based workflows in .github/workflows/, and both are already compiled with compiler_version: v0.71.0 in commit f568414. Re-running gh aw compile just now produces no diff (verified working tree clean). Let me know if there are other workflows you'd like recompiled.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/github-script/git/ref/tags/v9
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.71.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.71.0 --jq [.object.sha, .object.type] | @tsv (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)