Pin gh-aw-actions in Dependabot to prevent recurring lock/action drift (#10203)

[Evangelink]

Problem

The threat-detection job of the grade-tests-on-pr agentic workflow has repeatedly failed with awf: command not found (exit 127) — no THREAT_DETECTION_RESULT is emitted, so the parser reports parse_error (the symptom tracked by #10203). The recurring cause is gh-aw lock/action drift: Dependabot bumps only the github/gh-aw-actions/* uses: SHAs, drifting them away from the gh-aw CLI version that generated the .lock.yml files.

What this PR does

Adds a Dependabot ignore rule for github/gh-aw-actions/* under the github-actions ecosystem in .github/dependabot.yml. These actions are pinned by gh aw compile and must move in lockstep with the CLI version that generated the lock files (their uses: SHAs, the embedded gh-aw-manifest comment, and .github/aw/actions-lock.json all have to agree). They are updated via gh aw upgrade / the Agentic Maintenance workflow, which regenerates everything together — not by isolated Dependabot SHA bumps. This is the durable prevention for the recurring drift.

Correction from the first revision

An earlier revision of this PR also downgraded the rendered setup uses: lines across the .lock.yml files from v0.83.1 to v0.82.8. That has been reverted. On inspection, the lock files were generated by gh-aw v0.83.1 — their compiler_version, gh-aw-manifest comments, and .github/aw/actions-lock.json all already resolve setup/setup-cli to v0.83.1 and were internally consistent. Editing only the uses: lines introduced reverse drift rather than removing it (thanks to the Copilot reviewer for catching this). The pins are left at the consistent v0.83.1 state the generator produced.

Any residual fix for the awf: command not found behavior belongs in a proper gh aw upgrade / regenerate pass (which keeps the uses: lines, manifests, and central action lock in sync), not in hand-edited generated lines.

References #10203 (auto-managed tracking issue; not closed by this PR).

[Copilot]

Pull request overview

This PR attempts to fix gh-aw threat-detection failures by downgrading action pins and preventing isolated Dependabot updates. However, the generated metadata, manifests, and action lock remain at v0.83.1, recreating the same drift.

Changes:

• Downgrades gh-aw action references to v0.82.8.
• Adds a Dependabot ignore rule.
• Leaves generated v0.83.1 metadata inconsistent with runtime pins.

Show a summary per file

File	Description
.github/dependabot.yml	Ignores gh-aw action updates.
.github/workflows/address-review.agent.lock.yml	Changes generated action pins.
.github/workflows/add-tests.lock.yml	Changes generated action pins.
.github/workflows/adhoc-qa.lock.yml	Changes generated action pins.
.github/workflows/agentic_commands.yml	Downgrades setup action.
.github/workflows/agentics-maintenance.yml	Downgrades setup and setup-cli actions.
.github/workflows/autofix.agent.lock.yml	Changes generated action pins.
.github/workflows/build-failure-analysis-command.lock.yml	Changes generated action pins.
.github/workflows/build-failure-analysis.lock.yml	Changes generated action pins.
.github/workflows/code-simplifier.lock.yml	Changes generated action pins.
.github/workflows/daily-file-diet.lock.yml	Changes generated action pins.
.github/workflows/dependabot-issue-bundler.lock.yml	Changes generated action pins.
.github/workflows/dependabot-pr-bundler.lock.yml	Changes generated action pins.
.github/workflows/duplicate-code-detector.lock.yml	Changes generated action pins.
.github/workflows/efficiency-improver.lock.yml	Changes generated action pins.
.github/workflows/glossary-maintainer.lock.yml	Changes generated action pins.
.github/workflows/grade-tests-on-pr.agent.lock.yml	Changes affected workflow action pins.
.github/workflows/grade-tests.agent.lock.yml	Changes generated action pins.
.github/workflows/link-checker.lock.yml	Changes generated action pins.
.github/workflows/malicious-code-scan.lock.yml	Changes generated action pins.
.github/workflows/markdown-linter.lock.yml	Changes generated action pins.
.github/workflows/msbuild-quality-review.lock.yml	Changes generated action pins.
.github/workflows/perf-improver.lock.yml	Changes generated action pins.
.github/workflows/pr-fix.lock.yml	Changes generated action pins.
.github/workflows/q.lock.yml	Downgrades setup and setup-cli pins.
.github/workflows/repository-quality-improver.lock.yml	Changes generated action pins.
.github/workflows/review-after-autofix.agent.lock.yml	Changes generated action pins.
.github/workflows/review-on-open.agent.lock.yml	Changes generated action pins.
.github/workflows/review.agent.lock.yml	Changes generated action pins.
.github/workflows/sub-issue-closer.lock.yml	Changes generated action pins.
.github/workflows/test-improver.lock.yml	Changes generated action pins.
.github/workflows/unskip-closed-tests.lock.yml	Changes generated action pins.
.github/workflows/weekly-issue-activity.lock.yml	Changes generated action pins.

Review details

• Files reviewed: 33/33 changed files
• Comments generated: 32
• Review effort level: Medium

[github-actions]

Note

🤖 Automated review by GitHub Copilot. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

✅ 22/22 dimensions clean — no findings.

This PR is a pure CI/infrastructure change: it reverts github/gh-aw-actions/setup from v0.83.1 back to v0.82.8 across all 32 workflow lock files and adds a Dependabot ignore rule for github/gh-aw-actions/*. No C# source, tests, or public API surface is affected.

Verified: all 232 removed SHA references (8bdba80...) have a corresponding added reference (99d9d88...) — the swap is symmetric and complete across every lock file.

[Copilot]

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Medium