Improve API diff PR review workflow

.github/aw/actions-lock.json

@@ -30,15 +30,15 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup-cli@v0.80.9": {
+    "github/gh-aw-actions/setup-cli@v0.82.6": {
       "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.80.9",
-      "sha": "8c7d04ebf1ece56cd381446125da3e0f6896294a"
+      "version": "v0.82.6",
+      "sha": "cec6394202d7db187b02310d928812194988eb20"
     },
-    "github/gh-aw-actions/setup@v0.80.9": {
+    "github/gh-aw-actions/setup@v0.82.6": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.80.9",
-      "sha": "8c7d04ebf1ece56cd381446125da3e0f6896294a"
+      "version": "v0.82.6",
+      "sha": "cec6394202d7db187b02310d928812194988eb20"
     }
   }
 }

.github/scripts/api-diff-generate.sh

@@ -260,8 +260,8 @@ elif [ -n "$existing_pr_number" ]; then
 	}
 
 	tracking_block() {
-		# Emit only the machine-managed state block -- the fenced yaml block the agent writes as the
-		# VERY LAST thing in the body, delimited by the visible `# api-diff:state:begin`/`:end`
+		# Emit only the machine-managed state block -- the fenced yaml block nested in the final
+		# collapsed details element, delimited by the visible `# api-diff:state:begin`/`:end`
 		# comment lines (matched as whole comment lines: leading indent and a trailing CR are tolerated,
 		# but the "# " prefix and ":state:begin"/":state:end" suffix must be exact). Take the LAST
 		# begin..end range so human prose anywhere above it -- a quoted or bulleted "field:" line, an
@@ -279,6 +279,10 @@ elif [ -n "$existing_pr_number" ]; then
 	recorded="$(printf '%s\n' "$body_yaml" | tracking_block | tracking_value "current-version")"
 	watermark="$(printf '%s\n' "$body_yaml" | tracking_block | tracking_value "generated-at")"
 	recorded_status="$(printf '%s\n' "$body_yaml" | tracking_block | tracking_value "status")"
+	has_review_checklist=false
+	if printf '%s\n' "$body_yaml" | tr -d '\r' | grep -Fqx '## Review checklist'; then
+		has_review_checklist=true
+	fi
 
 	# Whether the resolved PR already carries THIS target's marker. An adopted (human-
 	# bootstrapped) PR or one whose marker line a human deleted has no marker yet; we
@@ -318,12 +322,13 @@ elif [ -n "$existing_pr_number" ]; then
 		noop=true
 		echo "::warning::review-activity query failed for PR #${existing_pr_number}; standing down (generated_at not advanced, retried next run)."
 	elif [ "$recorded" = "$current_version" ]; then
-		if [ "$recorded_status" = "$status" ] && [ "$has_marker" = true ] && [ "$has_new_feedback" != true ]; then
+		if [ "$recorded_status" = "$status" ] && [ "$has_marker" = true ] &&
+			[ "$has_new_feedback" != true ] && [ "$has_review_checklist" = true ]; then
 			noop=true
 			echo "::notice::no-op: ${current_version_milestone} unchanged (${current_version}), status '${status}', no new review activity since ${watermark:-<none>}."
 		else
 			metadata_only=true
-			echo "::notice::metadata-only: build unchanged; status '${recorded_status:-?}'->'${status}', new_feedback=${has_new_feedback}, marker_present=${has_marker}."
+			echo "::notice::metadata-only: build unchanged; status '${recorded_status:-?}'->'${status}', new_feedback=${has_new_feedback}, marker_present=${has_marker}, checklist_present=${has_review_checklist}."
 		fi
 	fi
 fi

.github/workflows/agentics-maintenance.yml

@@ -1,13 +1,13 @@
-# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.80.9). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.82.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
-#    ___                   _   _      
-#   / _ \                 | | (_)     
-#  | |_| | __ _  ___ _ __ | |_ _  ___ 
+#    ___                   _   _
+#   / _ \                 | | (_)
+#  | |_| | __ _  ___ _ __ | |_ _  ___
 #  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
-#  | | | | (_| |  __/ | | | |_| | (__ 
+#  | | | | (_| |  __/ | | | |_| | (__
 #  \_| |_/\__, |\___|_| |_|\__|_|\___|
 #          __/ |
-#  _    _ |___/ 
+#  _    _ |___/
 # | |  | |                / _| |
 # | |  | | ___ _ __ _  __| |_| | _____      ____
 # | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
@@ -23,13 +23,13 @@
 #
 # This file defines the generated agentic maintenance workflow for this repository.
 # It runs scheduled cleanup for expiring safe outputs and supports manual maintenance operations.
-# 
+#
 # This workflow is generated automatically when workflows use expiring safe outputs
 # or when repository maintenance features are enabled in .github/workflows/aw.json.
-# 
+#
 # To disable maintenance workflow generation, set in .github/workflows/aw.json:
 # {"maintenance": false}
-# 
+#
 # Agentic maintenance docs:
 # https://github.github.com/gh-aw/reference/ephemerals/#manual-maintenance-operations
 #
@@ -87,16 +87,14 @@ on:
 permissions: {}
 
 jobs:
-  close-expired-entities:
+  close-expired-discussions:
     if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
     runs-on: ubuntu-slim
     permissions:
       discussions: write
-      issues: write
-      pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -108,6 +106,16 @@ jobs:
             setupGlobals(core, github, context, exec, io, getOctokit);
             const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
             await main();
+  close-expired-issues:
+    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: ubuntu-slim
+    permissions:
+      issues: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
 
       - name: Close expired issues
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -117,6 +125,16 @@ jobs:
             setupGlobals(core, github, context, exec, io, getOctokit);
             const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
             await main();
+  close-expired-pull-requests:
+    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
 
       - name: Close expired pull requests
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -134,7 +152,7 @@ jobs:
       actions: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -163,7 +181,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -178,9 +196,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup-cli@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
-          version: v0.80.9
+          version: v0.82.6
 
       - name: Run operation
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -210,7 +228,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -253,10 +271,11 @@ jobs:
         with:
           sparse-checkout: |
             actions
+          clean: false
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -302,7 +321,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -317,9 +336,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup-cli@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
-          version: v0.80.9
+          version: v0.82.6
 
       - name: Create missing labels
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -348,7 +367,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -363,13 +382,13 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup-cli@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
-          version: v0.80.9
+          version: v0.82.6
 
       - name: Restore activity report logs cache
         id: activity_report_logs_cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ./.cache/gh-aw/activity-report-logs
           key: ${{ runner.os }}-activity-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
@@ -384,7 +403,7 @@ jobs:
           GH_AW_CMD_PREFIX: gh aw
         run: |
           ${GH_AW_CMD_PREFIX} logs \
-            --repo "${{ github.repository }}" \
+            --repo "$GITHUB_REPOSITORY" \
             --start-date -1w \
             --count 500 \
             --output ./.cache/gh-aw/activity-report-logs \
@@ -393,7 +412,7 @@ jobs:
 
       - name: Save activity report logs cache
         if: ${{ always() }}
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ./.cache/gh-aw/activity-report-logs
           key: ${{ steps.activity_report_logs_cache.outputs.cache-primary-key }}
@@ -453,7 +472,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -468,13 +487,13 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup-cli@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
-          version: v0.80.9
+          version: v0.82.6
 
       - name: Restore forecast report logs cache
         id: forecast_report_logs_cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ./.github/aw/logs
           key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
@@ -493,7 +512,7 @@ jobs:
         run: |
           mkdir -p ./.cache/gh-aw/forecast
           set +e
-          ${GH_AW_CMD_PREFIX} forecast --repo "${{ github.repository }}" --timeout 30 --verbose --json > ./.cache/gh-aw/forecast/report.json
+          ${GH_AW_CMD_PREFIX} forecast --repo "$GITHUB_REPOSITORY" --timeout 30 --verbose --json > ./.cache/gh-aw/forecast/report.json
           forecast_exit_code=$?
           set -e
           if [ "${forecast_exit_code}" -eq 124 ]; then
@@ -520,7 +539,7 @@ jobs:
 
       - name: Save forecast report logs cache
         if: ${{ always() }}
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ./.github/aw/logs
           key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
@@ -545,7 +564,7 @@ jobs:
       issues: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -582,7 +601,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
 
@@ -597,9 +616,9 @@ jobs:
             await main();
 
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup-cli@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
+        uses: github/gh-aw-actions/setup-cli@cec6394202d7db187b02310d928812194988eb20 # v0.82.6
         with:
-          version: v0.80.9
+          version: v0.82.6
 
       - name: Validate workflows and file issue on findings
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0