Upgrade gh-aw to pinned main commit and add max-patch-files: 500

[Copilot]

The v0.71.1 create_pull_request handler counts diff --git headers (not unique files) against a hardcoded 100-file limit, which trips E003 on long-running autoloop branches that merge main before committing (~1768 headers for 1–3 actual files). The fix landed on gh-aw main (github/gh-aw#28472) but no release has been cut.

The fix lives in github/gh-aw's actions/setup/js/create_pull_request.cjs. It has not been synced to the separate github/gh-aw-actions repo, so bumping gh-aw-actions/setup would not pick it up. gh aw compile --action-mode release --action-tag <sha> emits lock files that reference github/gh-aw/actions/setup@<sha> directly — bypassing gh-aw-actions entirely.

Changes

• autoloop.md — added max-patch-files: 500 under safe-outputs (now supported by the new handler):

  safe-outputs:
    max-patch-size: 10240
    max-patch-files: 500

• autoloop.lock.yml / evergreen.lock.yml — regenerated against gh-aw a91e3d2deadaf27496e563b7a4591125e1093d22. All github/gh-aw-actions/setup@v0.71.1 references replaced with github/gh-aw/actions/setup@a91e3d2…; max_patch_files":500 now baked into autoloop's handler config. Incidental drift: GH_AW_INFO_VERSION 1.0.35→1.0.36, github-mcp-server v1.0.2→v1.0.3, schedule-scattering offset shifted, and the now-removed Check compile-agentic version step is gone.
• copilot-setup-steps.yml — gh-aw-actions/setup-cli only installs tagged releases. Replaced with actions/setup-go + an inline shallow-fetch + go build of gh-aw at the same pinned SHA into ~/.local/share/gh/extensions/gh-aw/, so the agent's CLI matches what compiled the lock files (avoiding stale-lock-file errors on recompile).

Follow-ups

When the next gh-aw release lands with both #28472 and the corresponding gh-aw-actions JS sync, revert copilot-setup-steps.yml to setup-cli@<new-tag> and recompile with --action-mode action.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/github-script/git/ref/tags/v9
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build1463585797/b254/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.8.linux-amd64/src/mime/multipart/formdata.go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv checkout (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw-actions/contents/setup
  • Triggering command: /usr/bin/curl curl -sL REDACTED (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/a91e3d2deadaf27496e563b7a4591125e1093d22
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a91e3d2deadaf27496e563b7a4591125e1093d22 --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a91e3d2deadaf27496e563b7a4591125e1093d22 --jq [.object.sha, .object.type] | @tsv ux-amd64/src/mat-c=4 (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a91e3d2deadaf27496e563b7a4591125e1093d22 --jq [.object.sha, .object.type] | @tsv INVALID,NEW -j DROP (http block)
• https://api.github.com/repos/github/gh-aw/pulls/28472
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
• https://api.github.com/repos/github/gh-aw/releases
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
• https://api.github.com/repos/github/gh-aw/releases/latest
  • Triggering command: /usr/bin/gh gh extension install github/gh-aw --pin a91e3d2deadaf27496e563b7a4591125e1093d22 --force (http block)
  • Triggering command: /usr/bin/gh gh extension install github/gh-aw --pin v0.71.1 --force (http block)
• https://api.github.com/repos/github/gh-aw/tags
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
  • Triggering command: /usr/bin/curl curl -sL REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[mrjf]

@copilot fix test failures

[Copilot]

@copilot fix test failures

Fixed in a511439 — copilot-setup-steps was failing because gh-aw main's go.mod requires go >= 1.25.8 but I had pinned actions/setup-go to 1.24. Bumped to 1.25 and the job now passes.