ci: bump github/gh-aw/actions/setup from 0.81.6 to 0.83.1

[dependabot]

Bumps github/gh-aw/actions/setup from 0.81.6 to 0.83.1.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.83.1

🌟 Release Highlights

This release expands the gh aw compile security pipeline with container vulnerability scanning, license auditing, and YAML linting — while delivering a wave of reliability fixes across the compiler, harness, and PR review workflows.

✨ What's New

• Container vulnerability scanning with Grype — gh aw compile now runs Grype to detect CVEs in gh-* workflow container images before deployment. (#47474)
• SBOM generation with Syft — New --syft flag on gh aw compile produces a Software Bill of Materials for container images. (#47515)
• License scanning with Grant — gh aw compile can now audit container image licenses via Grant. (#47516)
• YAML linting as a static validator — yamllint is now integrated into the compile-time validation pipeline, catching YAML errors early. (#47507)
• Daily firewall container security scan — Automated daily scanning keeps the firewall container image clean. (#47407)
• GitHub suggestion syntax in PR reviews — The PR reviewer now emits proper GitHub suggestion blocks instead of plain code snippets, making review feedback directly applicable. (#47508)
• aw.yml surfaced in add-wizard — The add-wizard now shows existing aw.yml config before prompting for engine setup, reducing accidental overwrites. (#47462)
• Private registry container substitutions — Container image substitutions for private registries are now supported. (#47374)

🐛 Bug Fixes & Improvements

• Flow-sensitive no-unsafe-catch-error-property linter — The rule now respects branch dominance and source order, eliminating false positives in complex control flow. (#47534)
• Hardened report_incomplete signal handling — Fixes a crash when incomplete_signals is missing or empty. (#47533)
• Expression precedence preserved in stringsjoinone autofix — Autofix replacements no longer silently change operator precedence. (#47482)
• Job-level permission shorthands preserved — Custom and safe jobs now correctly retain shorthand permission declarations through the compiler. (#47471)
• Critical CVE cleared — Upgraded gh-aw-firewall v0.27.37 → v0.27.38 to resolve a critical CVE gate. (#47469)
• Harness startup retry extended to push events — Fixes missing retry logic on push-triggered runs and improves Turns=0 driver-handoff diagnostics. (#47384)
• Safe-outputs PR review robustness — Inline comment anchors that are partially invalid no longer cause review failures. (#47356) Self-authored PRs now receive COMMENT instead of REQUEST_CHANGES. (#47400)
• 16 CLI consistency fixes — Resolved a batch of flag, output, and error-message inconsistencies across CLI commands. (#47337)

📚 Documentation

• Clarified compiler-managed skill installation under .github/aw. (#47480)
• Added missing meta/terminal safe-output types to the designer mapping table. (#47506)

Generated by 🚀 Release · sonnet46 22.2 AIC · ⊞ 7.9K

---

What's Changed

• [dead-code] chore: remove dead functions — 5 functions removed by @​github-actions[bot] in github/gh-aw#47339
• fix: use html/template to resolve unsafe-quoting alert in bootstrap page renderer by @​pelikhan with @​Copilot in github/gh-aw#47333
• fix: resolve 16 CLI consistency issues from 2026-07-22 inspection by @​pelikhan with @​Copilot in github/gh-aw#47337
• Scope Tidy workflow to scheduled/explicit runs to eliminate push-driven API bursts by @​pelikhan with @​Copilot in github/gh-aw#47353
• Align glossary and documentation workflows on shared AI Coding Dictionary guidance by @​pelikhan with @​Copilot in github/gh-aw#47358
• Explore Git AI integration opportunities by @​pelikhan with @​Copilot in github/gh-aw#47360
• pkg/cli tests: migrate assert.NoError to require.NoError for fail-fast error handling by @​pelikhan with @​Copilot in github/gh-aw#47355
• Mitigate safe-outputs review failures when inline comment anchors are partially invalid by @​pelikhan with @​Copilot in github/gh-aw#47356
• Auto-Triage: deterministically classify machine-generated aggregate reports by @​pelikhan with @​Copilot in github/gh-aw#47373
• Add regression coverage for PR review path-resolution fallback by @​pelikhan with @​Copilot in github/gh-aw#47380
• [linter-miner] feat(linters): add stringbytesroundtrip linter by @​github-actions[bot] in github/gh-aw#47375

... (truncated)

Commits

• 6268b98 docs: update glossary with grant, syft, yamllint scanner terms (#47548)
• 0f71e5b Make no-unsafe-catch-error-property flow-sensitive to branch dominance and so...
• 56fad0f Harden report_incomplete issue handling when incomplete_signals is missing/...
• 30e222d [eslint-miner] eslint: add no-err-stack-then-string-fallback rule (#47541)
• 128d4e9 Add Grant license scanning to gh aw compile (#47516)
• e17be1c Add yamllint as a static analysis validator (#47507)
• 8e87e11 [instructions] Bring token-optimization.md under 400-line limit (#47537)
• 8127be0 Add --syft container scan support to gh aw compile (#47515)
• c180c1b Add add-wizard integration coverage for manifest bootstrap ordering (#47517)
• 0d9637f docs: add missing meta/terminal safe-output types to designer mapping table (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.