agent pipeline: update to v0.2.2

.github/aw/actions-lock.json

@@ -1,9 +1,9 @@
 {
   "entries": {
-    "github/gh-aw-actions/setup@v0.88.2": {
+    "github/gh-aw-actions/setup@v0.88.7": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.88.2",
-      "sha": "9271a1804551c0dc4fb0085a97979950aa2f8489"
+      "version": "v0.88.7",
+      "sha": "5e508589e03a7757a7e05b26e834292f5445bfb6"
     }
   },
   "containers": {

.github/aw/packages/bootc-dev-gh-agentic-workflows-5ee70eab2ffd.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": 1,
+  "package": "bootc-dev/gh-agentic-workflows",
+  "source": "bootc-dev/gh-agentic-workflows@8b8fddc621b42cc44f82f93bc2970dafaeda113a",
+  "resolvedCommit": "8b8fddc621b42cc44f82f93bc2970dafaeda113a",
+  "installer": "gh-aw v0.88.7",
+  "files": [
+    {
+      "source": ".github/workflows/drafter.md",
+      "destination": ".github/workflows/drafter.md",
+      "sha256": "b84b4cc1a66dd42106ee5a030033aaf2d694fa2dd8916a20013b66e5dc2a7eb2"
+    },
+    {
+      "source": ".github/workflows/fix.md",
+      "destination": ".github/workflows/fix.md",
+      "sha256": "a1ad52f62eec3ffce63d136cdcf932576f70c131ec06b332ffea4f5cb87f65c2"
+    },
+    {
+      "source": ".github/workflows/install-labels.yml",
+      "destination": ".github/workflows/install-labels.yml",
+      "sha256": "9d92d5ce3cdd58bc134f2d4faaa4ad1d3cddc5853407ad4426d007c9dc731552"
+    },
+    {
+      "source": ".github/workflows/merge.yml",
+      "destination": ".github/workflows/merge.yml",
+      "sha256": "06e79b2edc82a62b0fa12031aa065dbd1e6667bf70a0a6aec3a07434aa99b095"
+    },
+    {
+      "source": ".github/workflows/review.md",
+      "destination": ".github/workflows/review.md",
+      "sha256": "0e2921f12303dd7344b3e29799e5d5abce6fef0166004f57fa5f4494f24518af"
+    },
+    {
+      "source": ".github/workflows/upgrade.yml",
+      "destination": ".github/workflows/upgrade.yml",
+      "sha256": "f2016111f09f29e5351ce2cdfdc51e48752b1a0a30d7cede1c9094170c4b76fc"
+    }
+  ]
+}

.github/skills/agentic-workflows/SKILL.md

@@ -24,7 +24,6 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/charts-trending.md`
 - `.github/aw/charts.md`
 - `.github/aw/cli-commands.md`
-- `.github/aw/compat.md`
 - `.github/aw/configure-agentic-engine.md`
 - `.github/aw/context.md`
 - `.github/aw/create-agentic-workflow-trigger-details.md`
@@ -44,7 +43,6 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/github-mcp-server-tools.md`
 - `.github/aw/github-mcp-server.md`
 - `.github/aw/instructions.md`
-- `.github/aw/intent.md`
 - `.github/aw/jobs.md`
 - `.github/aw/linter-workflows.md`
 - `.github/aw/llms.md`
@@ -59,7 +57,6 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/network.md`
 - `.github/aw/optimize-agentic-workflow.md`
 - `.github/aw/patterns.md`
-- `.github/aw/playwright.md`
 - `.github/aw/pr-reviewer.md`
 - `.github/aw/release-workflow.md`
 - `.github/aw/report.md`
@@ -107,6 +104,5 @@ After loading the matching workflow prompt or skill, follow it directly:
 - Choose workflow architecture and patterns: `.github/aw/patterns.md`
 - Optimize token usage and cost: `.github/aw/token-optimization.md`
 - Design long-running multi-agent research workflows: `.github/aw/multi-agent-research.md`
-- Add skills or agent plugins requested by the user (`skills:` / `plugins:` frontmatter, never on-the-fly installs): `.github/aw/skills.md`
 
 When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.

.github/workflows/drafter.md

@@ -18,25 +18,15 @@ permissions:
 model: claude-sonnet-4-5-20250929
 engine:
   id: claude
-# bcvk is Rust; without this, cargo can't reach crates.io from behind
-# gh-aw's default egress firewall and build/test validation silently stalls
-# or fails (see "Repository setup checklist" in gh-agentic-workflows' README).
-network:
-  allowed:
-    - defaults
-    - rust
-
 tools:
   bash: ["*"]
   github:
     toolsets: [issues]
-    # Without this, content authored by our own bot (e.g. the fallback issue
-    # it files when a push is rejected) defaults to `unapproved`/`none`
-    # integrity on this public repo and gets filtered from the agent's view
-    # before it can read it - see "Trusting the pipeline's own bot" in
-    # README.md.
-    min-integrity: approved
-    trusted-users: ["${{ vars.GH_AW_APP_BOT_SLUG }}"]
+
+network:
+  allowed:
+    - defaults
+    - rust
 
 safe-outputs:
   github-app:
@@ -91,7 +81,7 @@ jobs:
         with:
           client-id: ${{ vars.GH_AW_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_AW_APP_PRIVATE_KEY }}
-      - name: Add agent/draft-working label
+      - name: Add agent/drafter-working label
         # ISSUE_NUMBER/REPO must be passed via env: rather than inlined
         # directly into the run: script below (as `${{ github.* }}`): gh-aw's
         # compiler sanitizes any inline `${{ github.* }}` expressions it
@@ -108,7 +98,7 @@ jobs:
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
-          gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --add-label agent/draft-working || true
+          gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --add-label agent/drafter-working || true
   remove_working_label:
     needs: [pre_activation, activation, agent, detection, safe_outputs]
     # Only tear down the label this same run put up: gating on this run's own
@@ -128,18 +118,18 @@ jobs:
         with:
           client-id: ${{ vars.GH_AW_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_AW_APP_PRIVATE_KEY }}
-      - name: Remove agent/draft-working label (best-effort)
-        # See the "Add agent/draft-working label" step above for why
+      - name: Remove agent/drafter-working label (best-effort)
+        # See the "Add agent/drafter-working label" step above for why
         # ISSUE_NUMBER/REPO are passed via env: instead of inlined in run:.
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           REPO: ${{ github.repository }}
         run: |
-          gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label agent/draft-working || true
+          gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label agent/drafter-working || true
 
-timeout-minutes: 30
-source: bootc-dev/gh-agentic-workflows@c198cfb31a783dd6e372775c9ceb32f31c216b5e
+timeout-minutes: 15
+source: bootc-dev/gh-agentic-workflows@8b8fddc621b42cc44f82f93bc2970dafaeda113a
 ---
 
 # Drafter
@@ -165,9 +155,15 @@ implementation.
    lockfiles before opening the pull request: run `just setup && just
    compile` (this recompiles *all* workflows, not just the one you touched —
    every `.lock.yml` must stay in sync with its `.md` source).
-6. Once validation passes, open a pull request via the `create-pull-request`
+6. Check if the originating issue #${{ github.event.issue.number }} has the
+   `agent/workflow-edits-allowed` label by reading its labels. If it does,
+   you must propagate this label to the pull request so that subsequent
+   fix iterations (via `fix.md`) can also push changes to protected files.
+7. Once validation passes, open a pull request via the `create-pull-request`
    safe-output. The PR description should summarize the change and state
-   how it was validated.
+   how it was validated. If the originating issue has the
+   `agent/workflow-edits-allowed` label (checked in step 6), pass it in the
+   `labels` parameter when creating the PR.
 
 ## Constraints
 
@@ -179,4 +175,4 @@ implementation.
   references content that doesn't exist), do not open a PR and do not
   fabricate content to match the issue; instead stop without emitting a
   `create-pull-request` safe-output (using `noop` or similar to explain why,
-  if available).
+  if available).