build(deps): bump github/gh-aw/actions/setup from 0.83.4 to 0.84.3 - #8487

Sourced from github/gh-aw/actions/setup's releases.

v0.84.3

🌟 Release Highlights

This release brings a new shellcheck-based linting phase for run steps, expanded agent job gating controls, and a large batch of security hardening and reliability fixes.

✨ What's New

• Shellcheck linting for run steps — Compiled workflow run steps are now validated with shellcheck, with a Docker-based fallback for systems lacking a native binary. Enabled by default and opt-out via flags.
• First-class agent job gating — Added jobs.agent.needs and jobs.agent.if support, giving workflow authors finer control over when the agent job executes.
• dispatch_workflow ref parameter — The ref input is now exposed in the per-workflow tool schema when allowed-refs is configured, enabling more precise cross-workflow dispatch targeting.
• Daily arXiv researcher workflow — A new built-in workflow scans recent papers for gh-aw improvement opportunities.

🐛 Bug Fixes & Improvements

• Fixed on.needs incorrectly leaking into the compiled workflow's on: section, and activation job needs not populating from engine.env expressions.
• Fixed stale merged PR handling in update_pull_request branch refresh so it no longer fails safe-outputs processing.
• Corrected pull_request_target trigger to support the ready_for_review activity type.
• Fixed false-positive credit-ceiling and timeout detections, and rescued Copilot runs incorrectly classified as authentication_failed.
• Restored MCP telemetry observability by moving the Python venv out of the agent artifact upload path.
• Fixed comment-only frontmatter handling in shared workflow parsing.

🔒 Security

• Removed or disabled several container images with unresolved critical/high CVEs, including mcp/markitdown, mcp/notion, semgrep/semgrep, cli-proxy:0.27.42, and vulnerable gh-aw-firewall pins.
• Patched a brace-expansion vulnerability in the gh-aw-node npm overlay (GHSA-mh99-v99m-4gvg).
• Pinned node:lts-alpine, python:alpine, and Serena MCP images to remediated digests.

📚 Documentation

• Split developer/SKILL.md into task-scoped sub-skills for easier navigation.
• Added AI crawler allow-list entries to the docs site robots.txt.
• Documented the search_repositories repo: qualifier limitation and fixed several frontmatter reference inaccuracies.

🔧 Internal

• Added multiple new linters (uncheckedflushreturn, walkfuncerrshadow, wgdonenotdeferred, contextcancelnotdeferred, stringsindexhasprefix) and enforced them in CI.
• Removed dead code and refactored large functions across the CLI and workflow engine for maintainability.

Generated by 🚀 Release · auto · 22.3 AIC · ⊞ 11.1K

---

What's Changed

• fix(eslint): gate replaceWithGetErrorMessage suggestion on hasResolvableLocalBinding in no-err-stack-then-string-fallback by @​pelikhan with @​Copilot in github/gh-aw#49501
• eslint-factory: recognize JSDoc @param {typeof import('@actions/core')} as core-alias signal by @​pelikhan with @​Copilot in github/gh-aw#49502
• Add llms.txt to repo root for AI tool discoverability by @​pelikhan with @​Copilot in github/gh-aw#49560
• [docs] Update documentation for features from 2026-08-01 by @​github-actions[bot] in github/gh-aw#49568
• Align package READMEs with exported API surface for spec-librarian audit findings by @​pelikhan with @​Copilot in github/gh-aw#49585
• docs: add Applebot-Extended to robots.txt AI crawler allow rules by @​pelikhan with @​Copilot in github/gh-aw#49599
• Allow add-labels to opt out of pull-requests: write by @​pelikhan with @​Copilot in github/gh-aw#49477
• engine: forward timeout-minutes to execution step for codex, gemini, pi, antigravity by @​pelikhan with @​Copilot in github/gh-aw#49495
• SPDD spec sync: fixture traceability, outcome-eval crosswalk, and OTLP credential redaction norms by @​pelikhan with @​Copilot in github/gh-aw#49596
• Add fixture-driven formal conformance tests for intent attribution compliance by @​pelikhan with @​Copilot in github/gh-aw#49594

... (truncated)

• 5325893 docs: multi-scenario evaluation example and failure classification for agenti...
• e8ef5d5 Add debug logging to under-instrumented pkg/ files (#49896)
• 2f8f3e1 docs: fix dispatch_workflow default max (3 → 1) in safe-outputs-specification...
• 379e063 spec: add CTR-022 (git subprocess argument injection) and CTR-023 (bash allow...
• 24f6c45 [aw] Raise Semantic Function Refactoring turn budget to prevent invocation-ca...
• 1d66a45 Add weekly blog post for 2026-08-03 (#49890)
• aee4c09 [community] Update community contributions in README (#49884)
• 846bb17 feat: shellcheck disabled by default, opt-in via --shellcheck/--validate, par...
• ec66db5 Handle stale merged PRs in update_pull_request branch refresh without faili...
• ce22854 Handle comment-only frontmatter in shared workflow parsing (#49875)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)