fix(gh-aw): require 0.89.22 for central ops

Closes octodemo/zava-social-cao-ops-20260929111840#18

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: bradygaster

.changeset/bright-gh-aw-central-ops.md

@@ -0,0 +1,6 @@
+---
+"@bradygaster/squad-cli": patch
+"@bradygaster/squad-sdk": patch
+---
+
+Require gh-aw v0.89.22 across the Squad workflow package, enlistment guidance, integrity contract, CI, and hosted E2E controller for central agentic ops compatibility.

.github/workflows/squad-ci.yml

@@ -173,7 +173,7 @@ jobs:
         # than skipping — a skipped gate is indistinguishable from no gate. This
         # includes the shell input security contract gate (#1834) and the compile
         # contract (#1732).
-        run: gh extension install --pin v0.89.21 github/gh-aw
+        run: gh extension install --pin v0.89.22 github/gh-aw
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Build
@@ -749,10 +749,10 @@ jobs:
           npm config set registry "https://packagefeedproxy.microsoft.io/npm/"
           npm ci --ignore-scripts
 
-      - name: Install gh-aw v0.89.21 (pinned)
+      - name: Install gh-aw v0.89.22 (pinned)
         run: |
-          gh extension install --force --pin v0.89.21 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.21
+          gh extension install --force --pin v0.89.22 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.22
         env:
           GH_TOKEN: ${{ github.token }}
 

.github/workflows/squad-gh-aw-hosted-e2e.yml

@@ -50,8 +50,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh extension install --force --pin v0.89.21 github/gh-aw
-          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.21
+          gh extension install --force --pin v0.89.22 github/gh-aw
+          test "$(gh aw --version 2>&1 | awk '{print $NF}')" = v0.89.22
 
       - name: Verify trusted default-branch controller
         env:

.squad-templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

docs/src/content/docs/guide/gh-aw.md

@@ -31,8 +31,8 @@ set -euo pipefail
 gh auth status
 owner_repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
 default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')"
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # 2. Require GitHub Issues, then allow GitHub Actions to create pull requests
 issues_enabled="$(gh api "repos/${owner_repo}" --jq '.has_issues')"
@@ -341,7 +341,7 @@ gh aw compile --strict
 ```
 
 Run this exact command after any required first-install approval and before
-committing. With gh-aw v0.89.21, require exactly two warnings, one occurrence
+committing. With gh-aw v0.89.22, require exactly two warnings, one occurrence
 of each exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->
@@ -1849,7 +1849,7 @@ prints the exact safe recovery commands.
 
 The schema-v2 integrity manifest records two complete compiled lock digests per
 workflow: `lock_sha256` for a per-workflow source annotation and
-`package_lock_sha256` for a package-root annotation. gh-aw v0.89.21 emits
+`package_lock_sha256` for a package-root annotation. gh-aw v0.89.22 emits
 `bradygaster/squad/workflows@SHA` for direct package includes, but can emit
 `bradygaster/squad/workflows/package/<workflow>.md@SHA` when installing dispatched
 dependencies. Fresh and forced installs can therefore contain different mixtures.
@@ -1859,7 +1859,7 @@ URLs, action pins, permissions and runtime bytes remain integrity-checked.
 No additional fields are removed during lock normalization.
 
 Manifest generation and installation test fixtures seed isolated compiler action
-locks with the immutable `setup` and `setup-cli` pins for gh-aw v0.89.21. Both
+locks with the immutable `setup` and `setup-cli` pins for gh-aw v0.89.22. Both
 source variants use the real strict compiler and validate its version and emitted
 action pins. This avoids a second network resolution returning a mutable version
 tag when credentials or the API are unavailable. Missing or altered pins fail

packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

templates/skills/gh-aw-enlistment/SKILL.md

@@ -60,15 +60,15 @@ default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.n
 echo "Repo: ${owner_repo}  Default branch: ${default_branch}"
 
 # Install the package-capable compiler version used by the distribution contract
-gh extension install --force --pin v0.89.21 github/gh-aw
-test "$(gh aw --version | awk '{print $NF}')" = "v0.89.21"
+gh extension install --force --pin v0.89.22 github/gh-aw
+test "$(gh aw --version | awk '{print $NF}')" = "v0.89.22"
 
 # Git state must be understood and clean enough to isolate the install
 git status --short
 ```
 
 > **Portability — compiler check:** use the equivalent PowerShell commands to
-> force-install `github/gh-aw` at `v0.89.21`, then confirm `gh aw --version`
+> force-install `github/gh-aw` at `v0.89.22`, then confirm `gh aw --version`
 > reports that exact version before installation.
 
 - **STOP** if `gh auth status` is not logged in, or is logged in as the wrong
@@ -222,7 +222,7 @@ This must run after any first-install approval and before committing. Success
 criteria:
 
 - All eight workflows compile successfully.
-- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each
+- With gh-aw v0.89.22, require exactly two warnings, one occurrence of each
   exact diagnostic header below (including its workflow path):
 
 <!-- compile-warning-allowlist-start -->

test/gh-aw-enlistment-skill.test.ts

@@ -277,7 +277,7 @@ describe('gh-aw-enlistment skill', () => {
     });
 
     it('pins and verifies the package-capable gh-aw compiler', () => {
-      expect(content).toContain('gh extension install --force --pin v0.89.21 github/gh-aw');
+      expect(content).toContain('gh extension install --force --pin v0.89.22 github/gh-aw');
       expect(content).toContain('gh aw --version');
       expect(content).toContain('PowerShell');
     });

test/gh-aw-quality.test.ts

@@ -3829,7 +3829,7 @@ describe('gh-aw: canonical package integrity contract', () => {
       package: PACKAGE_NAME,
       source: `${PACKAGE_NAME}@${revision}`,
       resolvedCommit: revision,
-      installer: 'gh-aw v0.89.21 test',
+      installer: 'gh-aw v0.89.22 test',
       files: owned,
     }, null, 2)}\n`);
     return root;
@@ -3961,8 +3961,8 @@ describe('gh-aw: canonical package integrity contract', () => {
       expect(mutable).not.toContain(actionReference);
       expect(createHash('sha256').update(normalizeCompiledLock(mutable, revisionA)).digest('hex'))
         .toBe(sourceBinding === 'workflow'
-          ? '8456d8129241269c107cdf4b16ae079e89a98ef944152df36f53ec0decf3f30d'
-          : 'bac4d8b90269d827fc9e626dd02c1b536bccde7105e9037971740054cda4c19b');
+          ? '0914fadb4a0f37867840b9394c60f3cd40fb3072dd003518a17efb23718dd632'
+          : 'cac9dea1082405512f66b8efcdb14b554c71e5adc75da158ecc12a0458c7fe52');
       expect(() => validateCompilerActionPins(mutable)).toThrow(/invalid immutable action pin/);
       writeFileSync(lockPath, mutable);
       expect(verifyInstall(root).failures.join('\n'))
@@ -4016,7 +4016,7 @@ describe('gh-aw: canonical package integrity contract', () => {
     compile();
     const unpinned = readText(lockPath);
     expect(createHash('sha256').update(normalizeCompiledLock(unpinned, revisionA)).digest('hex'))
-      .toBe('bac4d8b90269d827fc9e626dd02c1b536bccde7105e9037971740054cda4c19b');
+      .toBe('cac9dea1082405512f66b8efcdb14b554c71e5adc75da158ecc12a0458c7fe52');
     expect(verifyInstall(root).failures.join('\n')).toContain('Installed digest mismatch');
 
     const seedPins = () => spawnSync(process.execPath, ['--input-type=module', '-e', seed!], {