chore(deps): bump github/gh-aw from 0.52.1 to 0.53.0

[dependabot]

Bumps github/gh-aw from 0.52.1 to 0.53.0.

Release notes

Sourced from github/gh-aw's releases.

v0.53.0

🌟 Release Highlights

This release focuses on reliability and polish — fixing a cluster of real-world bugs reported by the community while strengthening core workflows around PR creation, model configuration, memory persistence, and the upgrade experience.

✨ What's New

• Configurable activation token — The on: section now supports github-token and github-app fields, letting you use a custom PAT or GitHub App token for activation-job reactions and status comments. (#19427)
• Graceful PR-permission fallback — When GitHub Actions lacks permission to create PRs, create_pull_request now opens a fallback issue with a one-click link to open the PR manually, so your pushed branch is never left dangling. (#19466)
• Strategy schema for custom jobs — The strategy field (with matrix, fail-fast, max-parallel) is now fully usable in custom job definitions, and strategy values are properly extracted by the compiler. (#19405)
• Workflow call ID in comments — The add_comment action now appends a gh-aw-workflow-call-id marker to comments when a caller workflow ID is present, enabling better cross-workflow traceability. (#19525)
• Smarter history link types — Generated GitHub search URLs now include a type= parameter scoped to the correct content type (issues, PRs, discussions), reducing irrelevant results. (#19507)

🐛 Bug Fixes & Improvements

• gh aw upgrade SHA-pins setup-cli — Upgrade now writes a SHA-pinned reference for the setup-cli action instead of a bare version tag, consistent with all other action references. (#19496)
• Copilot model path fixed — The fallback model configuration now correctly uses the COPILOT_MODEL environment variable instead of the unsupported --model CLI flag, making org-level model overrides work as expected. (#19509)
• push_repo_memory retry/backoff — Concurrent agents racing on the repo-memory branch no longer cause non-fast-forward failures; the push step now retries with exponential backoff and a job-level concurrency group. (#19494)
• ENOENT noise eliminated — Pre-agent failures (sandbox crash, network timeout) no longer cause downstream ENOENT errors from a missing agent-output artifact. Failure issues also now include richer context in their title. (#19505)
• runtime-import in .github repos — Compiling a workflow inside a repository literally named .github no longer produces duplicated paths like .github/.github/workflows/…. (#19518)
• safe-inputs script runner fixed — The script: runner for safe inputs was always returning {"stdout":"","stderr":""} instead of actual output; the generated .cjs now correctly calls execute() when run as a subprocess. (#19493)
• stderr suppressed in non-git directories — get_current_branch.cjs no longer leaks fatal: not a git repository to stderr when invoked outside a git repo. (#19499)
• MCP audit error clarity — Debug log lines are now filtered from the audit tool error response, so callers see the actual error instead of a wall of internal diagnostics when DEBUG=* is set. (#19506)

📚 Documentation

• Updated docs for the new on.github-token and on.github-app activation fields. (#19502)
• trial-ops.md trimmed by 24% — same content, much easier to scan. (#19478)

🌍 Community Contributions

A huge thank you to the community members who reported issues that were resolved in this release:

• @MatthewLabasan-NBCU for Bug: gh-aw compile incorrectly prepends repository name to #runtime-import paths in .github repositories (#19500)
• @samuelkahessay for push_repo_memory.cjs has no retry/backoff, fails on concurrent pushes (#19476)
• @samuelkahessay for get_current_branch.cjs leaks stderr when not in a git repository (#19475)
• @samuelkahessay for Unconditional agent-output artifact download causes ENOENT noise on pre-agent failures (#19474)
• @samuelkahessay for Copilot engine fallback model path uses --model CLI flag instead of COPILOT_MODEL env var (#19473)
• @dsyme for "GitHub Actions is not permitted to create or approve pull requests." (#19465)
• @rspurgeon for Bug: gh aw upgrade does not set a sha for setup-cli in copilot-setup-steps.yml (#19451)

---

For complete details, see CHANGELOG.

Generated by Release

---

... (truncated)

Commits

• 8c53fd1 [WIP] Update generated footer to include gh-aw-workflow-call-id (#19525)
• 02b8f7c [aw] Updates available (#19527)
• ce0e3a1 Fix runtime-import path duplication when repo is named .github (#19518)
• 038c4c9 Update history link generation to set type in search query (#19507)
• ac7a7f6 Fix copilot fallback model path to use COPILOT_MODEL env var instead of --mod...
• 25631fc Fix ENOENT noise from unconditional agent-output env var and add pre-agent fa...
• 567fee9 Fix safe-inputs script: runner always returning {"stdout":"","stderr":""}...
• 677910a fix(mcp): filter debug log lines from audit tool error response (#19506)
• e8df24a fix: retry/backoff for push_repo_memory + job-level concurrency group (#19494)
• 1c93efc fix: SHA-pin setup-cli action reference in copilot-setup-steps.yml on upgrade...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)