[Copilot]

The ready_to_code_review, ready_to_make_pr, and ready_to_push_to_pr helper tools were defined under a safe-inputs: frontmatter key, which gh-aw renamed to mcp-scripts: upstream some time ago. The current compiler no longer recognizes safe-inputs: and silently drops it, so the tools never get registered — even though the agent prompts still instruct the model to call them. This causes the PR review agent to fall back to a noop ("tool unavailable") instead of actually reviewing.

Fragment fix

• Renamed safe-inputs: → mcp-scripts: in the 3 affected fragments (same schema, key rename only):
  • safe-output-create-pr.md
  • safe-output-code-review.md
  • safe-output-push-to-pr.md

Compiler bump

• Bumped GH_AW_VERSION / GH_AW_BUILD_VERSION / GH_AW_COMPAT_VERSION from v0.87.5 → v0.87.10 in the Makefile for other upstream reliability fixes.

Recompiled artifacts

• Regenerated all 57 .lock.yml workflow files via make compile.
• Confirmed the mcpscripts MCP server entry now lists ready-to-code-review in the compiled manifest, where before the tool was absent entirely.

Test fixture

• Updated tests/test_safe_input_ready_to_make_pr.py, which read fragment frontmatter via frontmatter["safe-inputs"], to use frontmatter["mcp-scripts"] matching the renamed key.

• Fixes PR review agent has been silently skipping reviews for months #1972

---

The body of this PR is automatically managed by the workflow runtime.

---

The body of this PR is automatically managed by the Trigger Update PR Body workflow.

[fr4nc1sc0-r4m0n]

LGTM

[v1v]

@copilot resolve the merge conflicts in this pull request and also run the make goals require to compile the workflows too

[Copilot]

@copilot resolve the merge conflicts in this pull request and also run the make goals require to compile the workflows too

Merged main into this branch (merge commit, not rebase, since I can't force-push), resolved conflicts in the auto-generated lock files (.github/aw/actions-lock.json, gh-aw-dependency-review.lock.yml, gh-aw-issue-fixer.lock.yml, gh-aw-issue-triage.lock.yml) by taking main's compiled output, then re-ran make setup and make compile to regenerate all lock files against the merged sources. Verified the mcp-scripts rename and gh-aw v0.87.10 pin are still intact, and make lint + make test (64 tests) pass.

[v1v]

/ai analyse what it hactually change between v0.87.10 and v0.87.5 and provide some deeper analyses if any contract or something along those lines need to be taking into account

[v1v]

@copilot analyse what it actually changed between v0.87.10 and v0.87.5 and provide some deeper analyses if any contract or something along those lines need to be taking into account

[Copilot]

@copilot analyse what it actually changed between v0.87.10 and v0.87.5 and provide some deeper analyses if any contract or something along those lines need to be taking into account

Analysis of v0.87.5 → v0.87.10 (gh-aw compiler releases, per upstream release notes for v0.87.8/.87.9/.87.10 — v0.87.6/.87.7 tags don't exist, likely skipped):

Schema/contract changes that could affect authored workflows:

• max-runs must now be a positive value (#56911) — not used anywhere in this repo, no impact.
• Top-level roles: is now rejected by schema validation (#56981) — our only roles: usage (agent-deep-dive.md, agent-efficiency.md, etc.) is nested under on:, not top-level, so unaffected.
• MCP Gateway compiler output migrated agentId/mutually-exclusive agentId/agentIds (#56990, #56939) and gateway bumped to v0.4.14 — this is compiler-generated output only, nothing we author directly.
• Engine domain sets are now explicit opt-in, tightening default network posture (#56447, landed in v0.87.9) — we don't set custom engine.domains, so this only affects the default (already-locked-down) posture, no behavior change for us.
• Agentic Workflow Firewall bumped to v0.28.10 (#56914) — transparent container image bump, no authoring impact.

Reliability/bug fixes relevant to our workflows:

• Fixed safe-output updates for fork PR branches, explicit PR head baseline (#56341, #56119) — directly relevant since several of our workflows (pr-review, pr-review-addresser) operate on PRs, including forks.
• MCP gateway startup-failure fix on non-PR events + extended readiness timeout (#56425, #56315) — reduces the class of startup_failure flakes similar to what triggered this issue.
• Prevented oversized MCP query payloads from exceeding argument limits (#57253) — reduces another failure mode for tool calls.

No schema/contract change directly required the safe-inputs → mcp-scripts rename itself — that rename happened well before v0.87.5 (docs already reference "mcp-scripts reference" as far back as v0.87.8); the bug was purely that our fragments were never migrated off the old key, and the compiler silently drops unknown top-level keys instead of erroring, which is why it went undetected.

Verification performed: all 57 workflows recompiled cleanly with gh-aw v0.87.10 (zero compile errors), make lint passes, and make test (64 tests) passes — no max-runs, top-level roles:, or custom engine.domains usage exists in this repo, so none of the stricter schema checks introduced between v0.87.5 and v0.87.10 trigger here.