Upgrade agentic workflows to gh-aw v0.36.0 (#8122)

* Initial plan

* Upgrade agentic workflows to gh-aw v0.36.0

- Applied automatic codemods (timeout_minutes → timeout-minutes, command → slash_command)
- Fixed pr-fix.md: push-to-pr-branch → push-to-pull-request-branch
- Updated include paths from agentics/shared/ to shared/
- Migrated @include syntax to {{#import}} syntax
- Moved shared workflow files to standard .github/workflows/shared/ location
- Ran gh aw init to refresh agent files and instructions
- All 8 workflows compile successfully

Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>

.github/workflows/agentics-maintenance.yml

@@ -0,0 +1,143 @@
+#
+#    ___                   _   _      
+#   / _ \                 | | (_)     
+#  | |_| | __ _  ___ _ __ | |_ _  ___ 
+#  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
+#  | | | | (_| |  __/ | | | |_| | (__ 
+#  \_| |_/\__, |\___|_| |_|\__|_|\___|
+#          __/ |
+#  _    _ |___/ 
+# | |  | |                / _| |
+# | |  | | ___ _ __ _  __| |_| | _____      ____
+# | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
+# \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
+#  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
+#
+# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.36.0). DO NOT EDIT.
+#
+# To regenerate this workflow, run:
+#   gh aw compile
+# For more information: https://github.com/githubnext/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
+#
+# Alternative regeneration methods:
+# make recompile
+# 
+# Or use the gh-aw CLI directly:
+# ./gh-aw compile --validate --verbose
+# 
+# The workflow is generated when any workflow uses the 'expires' field
+# in create-discussions or create-issues safe-outputs configuration.
+# Schedule frequency is automatically determined by the shortest expiration time.
+#
+name: Agentics Maintenance
+
+on:
+  schedule:
+    - cron: "37 0 * * *"  # Daily (based on minimum expires: 7 days)
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  close-expired-discussions:
+    runs-on: ubuntu-latest
+    permissions:
+      discussions: write
+    steps:
+      - name: Setup Scripts
+        uses: githubnext/gh-aw/actions/setup@v0.36.0
+        with:
+          destination: /opt/gh-aw/actions
+
+      - name: Close expired discussions
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io);
+            const { main } = require('/opt/gh-aw/actions/close_expired_discussions.cjs');
+            await main();
+
+  close-expired-issues:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Setup Scripts
+        uses: githubnext/gh-aw/actions/setup@v0.36.0
+        with:
+          destination: /opt/gh-aw/actions
+
+      - name: Close expired issues
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io);
+            const { main } = require('/opt/gh-aw/actions/close_expired_issues.cjs');
+            await main();
+
+  compile-workflows:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: |
+            .github
+          persist-credentials: false
+
+
+      - name: Setup Go
+        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build gh-aw
+        run: make build
+
+      - name: Compile workflows
+        run: |
+          ./gh-aw compile --validate --verbose
+          echo "✓ All workflows compiled successfully"
+
+      - name: Setup Scripts
+        uses: githubnext/gh-aw/actions/setup@v0.36.0
+        with:
+          destination: /tmp/gh-aw/actions
+
+      - name: Check for out-of-sync workflows and create issue if needed
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io);
+            const { main } = require('/tmp/gh-aw/actions/check_workflow_recompile_needed.cjs');
+            await main();
+
+  zizmor-scan:
+    runs-on: ubuntu-latest
+    needs: compile-workflows
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Go
+        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build gh-aw
+        run: make build
+
+      - name: Run zizmor security scanner
+        run: |
+          ./gh-aw compile --zizmor --verbose
+          echo "✓ Zizmor security scan completed"

.github/workflows/ask.md

@@ -1,6 +1,6 @@
 ---
 on:
-  command:
+  slash_command:
     name: ask
   reaction: "eyes"
   stop-after: +48h
@@ -26,7 +26,7 @@ tools:
   # By default this workflow allows all bash commands within the confine of Github Actions VM 
   bash: [ ":*" ]
 
-timeout_minutes: 20
+timeout-minutes: 20
 
 ---
 
@@ -40,19 +40,18 @@ Take heed of these instructions: "${{ needs.task.outputs.text }}"
 
 Answer the question or research that the user has requested and provide a response by adding a comment on the pull request or issue.
 
-@include agentics/shared/no-push-to-main.md
+{{#import shared/no-push-to-main.md}}
 
-@include agentics/shared/tool-refused.md
+{{#import shared/tool-refused.md}}
 
-@include agentics/shared/include-link.md
+{{#import shared/include-link.md}}
 
-@include agentics/shared/xpia.md
+{{#import shared/xpia.md}}
 
-@include agentics/shared/gh-extra-pr-tools.md
+{{#import shared/gh-extra-pr-tools.md}}
 
 <!-- You can whitelist tools in .github/workflows/build-tools.md file -->
-@include? agentics/build-tools.md
+{{#import?  agentics/build-tools.md}}
 
 <!-- You can customize prompting and tools in .github/workflows/agentics/ask.config.md -->
-@include? agentics/ask.config.md
+{{#import?  agentics/ask.config.md}}
-

.github/workflows/ci-doctor.md

@@ -34,7 +34,7 @@ cache:
     - investigation-memory-${{ github.repository }}
     - investigation-memory-
 
-timeout_minutes: 10
+timeout-minutes: 10
 
 ---
 
@@ -192,8 +192,8 @@ When creating an investigation issue, use this structure:
 - Build cumulative knowledge about failure patterns and solutions using structured JSON files
 - Use file-based indexing for fast pattern matching and similarity detection
 
-@include agentics/shared/tool-refused.md
+{{#import shared/tool-refused.md}}
 
-@include agentics/shared/include-link.md
+{{#import shared/include-link.md}}
 
-@include agentics/shared/xpia.md
+{{#import shared/xpia.md}}

.github/workflows/daily-backlog-burner.md

@@ -6,7 +6,7 @@ on:
         - cron: "0 2 * * 1-5"
     stop-after: +48h # workflow will no longer trigger after 48 hours
 
-timeout_minutes: 30
+timeout-minutes: 30
 
 network: defaults
 
@@ -96,18 +96,18 @@ Your name is ${{ github.workflow }}. Your job is to act as an agentic coder for
 6. If you encounter any unexpected failures or have questions, add 
 comments to the pull request or issue to seek clarification or assistance.
 
-@include agentics/shared/no-push-to-main.md
+{{#import shared/no-push-to-main.md}}
 
-@include agentics/shared/tool-refused.md
+{{#import shared/tool-refused.md}}
 
-@include agentics/shared/include-link.md
+{{#import shared/include-link.md}}
 
-@include agentics/shared/xpia.md
+{{#import shared/xpia.md}}
 
-@include agentics/shared/gh-extra-pr-tools.md
+{{#import shared/gh-extra-pr-tools.md}}
 
 <!-- You can whitelist tools in .github/workflows/build-tools.md file -->
-@include? agentics/build-tools.md
+{{#import?  agentics/build-tools.md}}
 
 <!-- You can customize prompting and tools in .github/workflows/agentics/daily-progress.config -->
-@include? agentics/daily-progress.config.md
+{{#import?  agentics/daily-progress.config.md}}

.github/workflows/daily-perf-improver.md

@@ -6,7 +6,7 @@ on:
         - cron: "0 2 * * 1-5"
     stop-after: +48h # workflow will no longer trigger after 48 hours
 
-timeout_minutes: 30
+timeout-minutes: 30
 
 permissions: read-all
 
@@ -173,18 +173,18 @@ Your name is ${{ github.workflow }}. Your job is to act as an agentic coder for
 
 6. At the end of your work, add a very, very brief comment (at most two-sentences) to the issue from step 1a, saying you have worked on the particular goal, linking to any pull request you created, and indicating whether you made any progress or not.
 
-@include agentics/shared/no-push-to-main.md
+{{#import shared/no-push-to-main.md}}
 
-@include agentics/shared/tool-refused.md
+{{#import shared/tool-refused.md}}
 
-@include agentics/shared/include-link.md
+{{#import shared/include-link.md}}
 
-@include agentics/shared/xpia.md
+{{#import shared/xpia.md}}
 
-@include agentics/shared/gh-extra-pr-tools.md
+{{#import shared/gh-extra-pr-tools.md}}
 
 <!-- You can whitelist tools in .github/workflows/build-tools.md file -->
-@include? agentics/build-tools.md
+{{#import?  agentics/build-tools.md}}
 
 <!-- You can customize prompting and tools in .github/workflows/agentics/daily-perf-improver.config -->
-@include? agentics/daily-perf-improver.config.md
+{{#import?  agentics/daily-perf-improver.config.md}}

.github/workflows/daily-test-improver.md

@@ -6,7 +6,7 @@ on:
         - cron: "0 2 * * 1-5"
     stop-after: +48h # workflow will no longer trigger after 48 hours
 
-timeout_minutes: 30
+timeout-minutes: 30
 
 permissions: read-all
 
@@ -151,19 +151,18 @@ Your name is ${{ github.workflow }}. Your job is to act as an agentic coder for
 
 6. At the end of your work, add a very, very brief comment (at most two-sentences) to the issue from step 1a, saying you have worked on the particular goal, linking to any pull request you created, and indicating whether you made any progress or not.
 
-@include agentics/shared/no-push-to-main.md
+{{#import shared/no-push-to-main.md}}
 
-@include agentics/shared/tool-refused.md
+{{#import shared/tool-refused.md}}
 
-@include agentics/shared/include-link.md
+{{#import shared/include-link.md}}
 
-@include agentics/shared/xpia.md
+{{#import shared/xpia.md}}
 
-@include agentics/shared/gh-extra-pr-tools.md
+{{#import shared/gh-extra-pr-tools.md}}
 
 <!-- You can whitelist tools in .github/workflows/build-tools.md file -->
-@include? agentics/build-tools.md
+{{#import?  agentics/build-tools.md}}
 
 <!-- You can customize prompting and tools in .github/workflows/agentics/daily-test-improver.config.md -->
-@include? agentics/daily-test-improver.config.md
+{{#import?  agentics/daily-test-improver.config.md}}
-

.github/workflows/pr-fix.md

@@ -1,6 +1,6 @@
 ---
 on:
-  command:
+  slash_command:
     name: pr-fix
   reaction: "eyes"
   stop-after: +48h
@@ -11,7 +11,7 @@ roles: [admin, maintainer, write]
 network: defaults
 
 safe-outputs:
-  push-to-pr-branch:
+  push-to-pull-request-branch:
   create-issue:
     title-prefix: "${{ github.workflow }}"
   add-comment:
@@ -30,7 +30,7 @@ tools:
   # By default this workflow allows all bash commands within the confine of Github Actions VM 
   bash: [ ":*" ]
 
-timeout_minutes: 20
+timeout-minutes: 20
 
 ---
 
@@ -56,19 +56,18 @@ You are an AI assistant specialized in fixing pull requests with failing CI chec
 
 8. Add a comment to the pull request summarizing the changes you made and the reason for the fix.
 
-@include agentics/shared/no-push-to-main.md
+{{#import shared/no-push-to-main.md}}
 
-@include agentics/shared/tool-refused.md
+{{#import shared/tool-refused.md}}
 
-@include agentics/shared/include-link.md
+{{#import shared/include-link.md}}
 
-@include agentics/shared/xpia.md
+{{#import shared/xpia.md}}
 
-@include agentics/shared/gh-extra-pr-tools.md
+{{#import shared/gh-extra-pr-tools.md}}
 
 <!-- You can whitelist tools in .github/workflows/build-tools.md file -->
-@include? agentics/build-tools.md
+{{#import?  agentics/build-tools.md}}
 
 <!-- You can customize prompting and tools in .github/workflows/agentics/pr-fix.config.md -->
-@include? agentics/pr-fix.config.md
+{{#import?  agentics/pr-fix.config.md}}
-