deps(actions): bump github/gh-aw/actions/setup from 0.87.3 to 0.87.10

[dependabot]

Bumps github/gh-aw/actions/setup from 0.87.3 to 0.87.10.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.87.10

🌟 Release Highlights

This release focuses on scheduling controls, trajectory-based agent evaluation, and hardened MCP Gateway/validation behavior.

✨ What's New

• on.cooldown workflow gating (#56998) lets workflows enforce a minimum interval between runs, reducing noisy or redundant triggers.
• Typed on.stop-after field (#56983) now supports GitHub Actions expressions, giving finer control over when scheduled/triggered workflows should stop running.
• Trajectory graders expanded with new implementations for policy-near-miss, exploitation-error, exploration-error, lempel-ziv-trajectory-complexity, skill-constraint-coverage, and tool-output-consumption-rate (#56996, #57152, #57087, #56972, #57055, #57252), plus OpenTelemetry span reporting for grader and eval results (#57015, #57166).
• MCP Gateway bumped to v0.4.14 (#57188) and its compiler output migrated to agentId (#56990), with mutually exclusive agentId/agentIds fields now validated in the gateway schema (#56939).
• Agentic Workflow Firewall bumped to v0.28.10 (#56914).

🐛 Bug Fixes & Improvements

• Fixed Codex harness handling of unsupported-model tool-schema failures with a clearer error message (#57256).
• Fixed trajectory grader duplicate detection (#57255) and prevented oversized MCP query payloads from exceeding argument limits (#57253).
• Fixed remote MCP authentication canary tool check (#57081) and Codex MCP environment fallback rendering (#56924).
• Fixed Playwright MCP TOML sandbox configuration (#56800) and added validation for Playwright mode expressions (#56933).
• Fixed require-getexecoutput-exitcode-check false positive on destructuring assignments (#57088) and improved manualpathconcat/prefer-actions-exec-over-child-process linter detection (#57056, #56985).
• Now requires positive max-runs values in workflow schema (#56911) and rejects top-level roles: per schema validation (#56981).
• Fixed missing Undici dependency in Copilot SDK workflows (#57057) and aligned the Copilot SDK tool catalog with compiled workflow tools (#56976).
• Normalized disabled failure-issue expiry in lockfiles (#56901) and stripped bot footer noise from prompt clustering inputs (#56910).

📚 Documentation

• Fixed invalid YAML example in Job Outputs docs (#56977), broken gallery links in multi-device docs testing (#57082), and stale Daily Firewall Report scope in the metrics glossary (#56979).
• Added documentation on intent-driven workflow design (#57005).

Learn more about on.cooldown and on.stop-after in the reference docs.

Generated by 🚀 Release · copilot · auto · 21.1 AIC · ⊞ 11.8K

---

What's Changed

• [test-parallel] test: add missing t.Parallel() in codemod_mcp_network_addallowed_test.go by @​github-actions[bot] in github/gh-aw#56714
• [WIP] Fix failing GitHub Actions job Integration: Workflow Infra by @​pelikhan with @​Copilot in github/gh-aw#56688
• Pi engine: route OpenAI/Codex backend through the Responses API by @​pelikhan with @​Copilot in github/gh-aw#56692
• Allow conclusion in on.workflow_run frontmatter schema by @​pelikhan with @​Copilot in github/gh-aw#56743
• [caveman] Optimize instruction verbosity — evals.md (2026-08-28) by @​github-actions[bot] in github/gh-aw#56727
• Avoid CodeQL false positive in manifest path validation by @​pelikhan with @​Copilot in github/gh-aw#56690
• [docs-diagram] Add Safe Outputs permission-isolation diagram by @​github-actions[bot] in github/gh-aw#56828
• Fix Playwright MCP TOML sandbox configuration by @​pelikhan with @​Copilot in github/gh-aw#56800
• [spec-enforcer] Enforce specifications for jsonutil, scanfindings by @​github-actions[bot] in github/gh-aw#56878
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @​github-actions[bot] in github/gh-aw#56871
• [test-parallel] test: add t.Parallel() to safe schedule calendar tests by @​github-actions[bot] in github/gh-aw#56813
• [WIP] Fix failing GitHub Actions job for misc part 2 by @​pelikhan with @​Copilot in github/gh-aw#56689
• [docs] docs: consolidation v9.24 - fix vague enhanced tone issues, link 3 uncovered spec files by @​github-actions[bot] in github/gh-aw#56898
• [actions] Update GitHub Actions versions - 2026-08-29 by @​github-actions[bot] in github/gh-aw#56859
• [code-simplifier] Simplify duplicated payload validation in add_reaction_and_edit_comment.cjs by @​github-actions[bot] in github/gh-aw#56819

... (truncated)

Commits

• ff62cdb Codex harness: detect unsupported-model tool-schema failures with a dedicated...
• 72ca10c Add tool output consumption rate trajectory grader (#57252)
• 71926ba Prevent large MCP query payloads from exceeding argument limits (#57253)
• b1b5c6b Fix trajectory grader duplicate detection (#57255)
• b7ecb3c [caveman] Trim redundant prose in lsp.md instruction file (#57242)
• 13bcc35 Bump default MCP Gateway to v0.4.14 (#57188)
• 699a6e2 [mcp-tools] Fix stale toolset list in syntax-tools-imports.md (#57171)
• 7098a9a Normalize report formatting across audit workflows (#57172)
• 0ce1b53 [trajectory-grader] Implement exploitation-error (#57152)
• bd6d3c6 Report eval results in OpenTelemetry spans (#57166)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, release-note-none. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.