ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.87.7

[dependabot]

Bumps github/gh-aw/actions/setup from 0.81.6 to 0.87.7.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.87.5

🌟 Release Highlights

This release delivers 226 merged pull requests focused on hardening the compiler, expanding safe-output tooling, and strengthening the automated linting and grading systems that keep gh-aw's self-maintaining workflows healthy.

✨ What's New

• gh aw models adds a catalog command for pricing, alias resolution, and observed automation models (#55148).
• Experimental schema-aware gh aw edit enables structured, validated editing of workflow frontmatter (#55475).
• PR steering is now available for compatible create-pull-request workflows, replacing the legacy pre-create flow (#55171, #55249, #55285, #55250).
• daily-storify workflow adds episode-based daily narrative analysis (#55248), and a new daily harness experiment proposer automates experiment ideation (#55120).
• Generated footers now render the agentic engine used and improved spacing/consistency (#55192, #55372).
• Added secret-scanning-alerts permission scope and attestations/models permission documentation (#54904, #54856).
• New drive-backed workflow memory support for persistent state across runs (#54662, #54892).

🐛 Bug Fixes & Improvements

• Fixed Codex credential check crashes and 401 errors by disabling WebSocket transport (#55106, #55089).
• Hardened Cloud Hypervisor sandboxing: fixed Copilot SDK crashes and cache-memory write failures (#55495, #55427).
• Corrected conclusion job permission derivation and skip-dominated workflow health metrics (#55529, #54729).
• Fixed github-discussion-query payload scaling to avoid jq argument growth (#55560).
• Improved MCP CLI wrapper script permissions (0o700 instead of 0o755) for tighter security (#55587).
• Numerous CodeQL and static-analysis findings addressed, including allocation-size guards and actionlint fixes (#55480, #55011).

🔧 Internal & Quality

• Continued rollout of custom linters (eslint-factory rules, Go analyzers) catching duplicate scene IDs, unsafe string fallbacks, path-join misuse, and more across the codebase.
• Large-scale test parallelization effort (t.Parallel()) applied across dozens of Go test files to speed up CI.
• Ongoing refactors split oversized files (awf_config.go, progress.go, safe-output handler registries) into focused modules for maintainability.
• Migrated dozens of internal agentic workflows to sandboxed/codex engine runtimes for improved isolation.

📚 Documentation

• Unbloated and refreshed docs for custom agents, GitHub tools reference, glossary, and frontmatter conventions.
• Clarified quick-start install instructions and cache-memory retention semantics.

No community-labeled issues were closed in this release window.

Generated by 🚀 Release · copilot · auto · 28.1 AIC · ⊞ 11.8K

---

What's Changed

• [test-parallel] Add t.Parallel() to TestExtractGitHubToolsets by @​github-actions[bot] in github/gh-aw#54723
• Fix skip-dominated workflow health metrics by @​pelikhan with @​Copilot in github/gh-aw#54729
• Normalize mixed-type workflow run IDs by @​pelikhan with @​Copilot in github/gh-aw#54731
• Add accessible name to docs home logo link by @​pelikhan with @​Copilot in github/gh-aw#54748
• Fix sync exec timeout detection for defaulted option spreads by @​pelikhan with @​Copilot in github/gh-aw#54749
• lenstringzero: report the actual expression in diagnostic messages by @​pelikhan with @​Copilot in github/gh-aw#54721
• Make error-message lint advisory by @​pelikhan with @​Copilot in github/gh-aw#54800
• Rename panic-in-library-code internals for intent-driven discoverability by @​pelikhan with @​Copilot in github/gh-aw#54795
• Fix impacted test selection under shallow (fetch-depth 1) checkouts by @​pelikhan with @​Copilot in github/gh-aw#54793

... (truncated)

Commits

• d7426cc Merge branch 'main' of https://github.com/github/gh-aw
• 800a37a update gallery
• 3360378 update gallery
• 37f5904 Add daily grader audit workflow (#56359)
• d78321a Fix user-rate-limit alias schema and event fallback (#56328)
• 51e3415 Clarify prerelease upgrade guidance (#56351)
• 9807018 Include grader evaluator scripts in workflow packages (#56268)
• fcf78d2 Always configure OTLP from enterprise default variables and secrets (#56353)
• 569a4d6 update docs
• 1f0ec3a update docs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.