Bump github/gh-aw from 0.61.0 to 0.62.3

[dependabot]

Bumps github/gh-aw from 0.61.0 to 0.62.3.

Release notes

Sourced from github/gh-aw's releases.

v0.62.3

🌟 Release Highlights

This release focuses on extensibility and reliability — bringing custom GitHub Actions into the safe-outputs toolkit, hardening the MCP Gateway, and shaving ~20 seconds off every workflow run.

✨ What's New

• Custom Actions as Safe Output Tools (#21752) Expose any GitHub Action as an MCP tool via the new safe-outputs.actions block. The compiler resolves action.yml at compile time to derive the tool schema and inject it into the agent — no custom wiring required. Learn more

• trustedBots support in MCP Gateway (#21865) Workflows can now pass an allowlist of additional GitHub bot identities to the MCP Gateway via the new trustedBots field, enabling safe cross-bot collaboration in guarded environments.

• gh-aw-metadata v3 with agent & model tracking (#21899) Compiled lock files now embed the configured agent ID/model and detection agent ID/model in the gh-aw-metadata comment, making it easier to audit which model drove each workflow run.

• Raised update_issue / update_discussion safe output limits to 256 (#21902) The previous cap of 100 operations blocked high-throughput workflows. The maximum is now 256, giving busy automation more headroom.

⚡ Performance

• ~20 seconds faster per workflow run (#21873) Bumped DefaultFirewallVersion to v0.24.5, which eliminates a 10-second container shutdown delay for both the main agent and the threat detection container combined.

🐛 Bug Fixes & Improvements

• MCP Gateway no longer crashes when only min-integrity is set (#21893) — repos now defaults to "all" when the field is omitted, fixing a silent config-generation failure introduced by Gateway v0.1.19.

• Schema validation errors now show the correct line number (#21853) — Errors like timeout-minutes: -10 previously always reported file.md:1:1. They now point to the actual offending line and use a cleaner message prefix.

• Staged safe-output handlers no longer acquire write permissions (#21903) — Handlers that only emit step-summary previews were incorrectly merging write permissions; they now run with the minimal permissions they actually need.

• CLI help text consistency fixes (#21907) — Corrected misleading flag descriptions in add, trial, audit, and mcp inspect commands.

• Protected Files warning now appears in the correct position (#21841) — When create_pull_request falls back to an issue, the "Protected Files" section is now inserted before the footer rather than after it.

📚 Documentation

• /gh-aw (no trailing slash) now redirects correctly (#21906) — Previously returned a 404 with a doubled canonical URL.
• Documentation updated for the new --filtered-integrity logs flag and safe-outputs.actions configuration.

---

For complete details, see CHANGELOG.

Generated by Release

---

... (truncated)

Commits

• 458e90f fix: recompile stale lock files and restore Daily Workflow Updater (#21916)
• 8471702 fix(workflow): normalize report formatting in prompt-clustering-analysis (#21...
• 906c3e7 Skip write permissions for staged safe output handlers (#21903)
• 085622c Recompile workflows to sync lock files (#21913)
• 7171b31 fix: resolve 4 CLI consistency issues from automated inspection (#21907)
• 641d855 refactor: semantic function clustering — move functions to better-aligned fil...
• d61b1ff fix(docs): redirect /gh-aw (no trailing slash) to /gh-aw/ (#21906)
• ce98106 refactor: extract shared renderStandardJSONMCPConfig helper across engine MCP...
• 7112bf0 Bump absolute maximum for update_issue and update_discussion safe outputs...
• db46391 docs: update documentation for 2026-03-20 changes (#21904)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud