Merge remote-tracking branch 'origin/main' into sergio-sisternes-epam-apmignore-file-exclusion

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Sergio Sisternes

.apm/agents/agentic-workflows.agent.md

@@ -141,12 +141,18 @@ When a user interacts with you:
 ## Quick Reference
 
 ```bash
+# Install the repository's exact compiler version
+gh extension install github/gh-aw --pin v0.87.8 --force
+
 # Initialize repository for agentic workflows
 gh aw init
 
 # Generate the lock file for a workflow
 gh aw compile [workflow-name]
 
+# Approve reviewed action or secret changes during a version upgrade
+gh aw compile [workflow-name] --approve
+
 # Debug workflow runs
 gh aw logs [workflow-name]
 gh aw audit <run-id>
@@ -156,6 +162,16 @@ gh aw fix --write
 gh aw compile --validate
 ```
 
+The repository compiler pin is gh-aw `v0.87.8` at tag commit
+`e973b8cc974ce0b3628a8f9759b40733b4bf146b`. Regenerate committed
+`.lock.yml` files with that exact version. Use `--approve` only after
+reviewing action, container, permission, and secret changes.
+
+`.github/workflows/agentics-maintenance.yml` is compiler-generated but
+committed with its `github/gh-aw-actions/setup-cli` tag refs rewritten to SHA
+`1aa033c7bf25ac9428fe521065b90c30a7070c4e`. Re-apply that rewrite after
+regeneration; `tests/unit/test_shared_apm_workflow_contract.py` fails otherwise.
+
 ## Key Features of gh-aw
 
 - **Natural Language Workflows**: Write workflows in markdown with YAML frontmatter
@@ -174,4 +190,5 @@ gh aw compile --validate
 - Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
 - **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
 - Follow security best practices: minimal permissions, explicit network access, no template injection
+- gh-aw v0.87.8 exposes `GH_AW_DEFAULT_OTLP_HEADERS` to the agent and MCP telemetry runtime when that enterprise secret is configured. Leave it unset unless agent-visible telemetry credentials are an accepted boundary.
 - **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.

.apm/architecture/owners/contracts-tooling.json

@@ -3,14 +3,21 @@
   "owners": [
     {
       "id": "dependency-identity-materialization",
-      "decision": "Dependency comparison identity vs display-cased materialization path; embedded git URL subpath validation",
+      "decision": "Dependency comparison identity and policy casing vs display-cased materialization path; embedded git URL subpath validation",
       "owner": "models/dependency/identity.py + materialization.py + DependencyReference (_check_no_embedded_subpath consumes core/host_providers.py)",
       "selectors": [
         "src/apm_cli/models/dependency/identity.py",
         "src/apm_cli/models/dependency/materialization.py",
         "src/apm_cli/models/dependency/reference.py"
       ],
-      "guards": ["contracts-tooling-dependency-identity"]
+      "guards": ["contracts-tooling-dependency-identity", "contracts-tooling-policy-identity"]
+    },
+    {
+      "id": "generated-python-artifact-membership",
+      "decision": "Generated Python bytecode membership across copy, inventory, and cleanup",
+      "owner": "security/gate.py (is_generated_python_artifact, is_python_bytecode_cache_path)",
+      "selectors": ["src/apm_cli/security/gate.py"],
+      "guards": ["contracts-tooling-python-artifact-membership"]
     },
     {
       "id": "cached-policy-shape",

.gitattributes

@@ -1 +1 @@
-.github/workflows/*.lock.yml linguist-generated=true merge=ours
+.github/workflows/*.lock.yml linguist-generated=true

.github/agents/agentic-workflows.agent.md

@@ -141,12 +141,18 @@ When a user interacts with you:
 ## Quick Reference
 
 ```bash
+# Install the repository's exact compiler version
+gh extension install github/gh-aw --pin v0.87.8 --force
+
 # Initialize repository for agentic workflows
 gh aw init
 
 # Generate the lock file for a workflow
 gh aw compile [workflow-name]
 
+# Approve reviewed action or secret changes during a version upgrade
+gh aw compile [workflow-name] --approve
+
 # Debug workflow runs
 gh aw logs [workflow-name]
 gh aw audit <run-id>
@@ -156,6 +162,16 @@ gh aw fix --write
 gh aw compile --validate
 ```
 
+The repository compiler pin is gh-aw `v0.87.8` at tag commit
+`e973b8cc974ce0b3628a8f9759b40733b4bf146b`. Regenerate committed
+`.lock.yml` files with that exact version. Use `--approve` only after
+reviewing action, container, permission, and secret changes.
+
+`.github/workflows/agentics-maintenance.yml` is compiler-generated but
+committed with its `github/gh-aw-actions/setup-cli` tag refs rewritten to SHA
+`1aa033c7bf25ac9428fe521065b90c30a7070c4e`. Re-apply that rewrite after
+regeneration; `tests/unit/test_shared_apm_workflow_contract.py` fails otherwise.
+
 ## Key Features of gh-aw
 
 - **Natural Language Workflows**: Write workflows in markdown with YAML frontmatter
@@ -174,4 +190,5 @@ gh aw compile --validate
 - Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
 - **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
 - Follow security best practices: minimal permissions, explicit network access, no template injection
+- gh-aw v0.87.8 exposes `GH_AW_DEFAULT_OTLP_HEADERS` to the agent and MCP telemetry runtime when that enterprise secret is configured. Leave it unset unless agent-visible telemetry credentials are an accepted boundary.
 - **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.

.github/aw/actions-lock.json

@@ -1,10 +1,5 @@
 {
   "entries": {
-    "actions/create-github-app-token@v3.1.1": {
-      "repo": "actions/create-github-app-token",
-      "version": "v3.1.1",
-      "sha": "1b10c78c7865c340bc4f6099eb2f838309f1e8c3"
-    },
     "actions/create-github-app-token@v3.2.0": {
       "repo": "actions/create-github-app-token",
       "version": "v3.2.0",
@@ -23,7 +18,7 @@
     "actions/github-script@v9": {
       "repo": "actions/github-script",
       "version": "v9",
-      "sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
     "actions/github-script@v9.0.0": {
       "repo": "actions/github-script",
@@ -35,6 +30,11 @@
       "version": "v7",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
+    "github/gh-aw-actions/setup-cli@v0.87.8": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.87.8",
+      "sha": "1aa033c7bf25ac9428fe521065b90c30a7070c4e"
+    },
     "github/gh-aw-actions/setup@v0.87.8": {
       "repo": "github/gh-aw-actions/setup",
       "version": "v0.87.8",