chore(deps): bump github/gh-aw from 0.47.1 to 0.49.4 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: github/gh-aw.

Updates github/gh-aw from 0.47.1 to 0.49.4

Release notes

Sourced from github/gh-aw's releases.

v0.49.4

🔧 Release Highlights

This maintenance release delivers targeted bug fixes for Playwright integration and internal test reliability improvements.

🐛 Bug Fixes & Improvements

• Playwright --no-sandbox argument fix — Corrected the --no-sandbox flag handling so Playwright workflows launch reliably in sandboxed GitHub Actions runners. (#17861)
• Shell quoting for awf --allow-domains/--block-domains — Fixed SC1003 shell quoting issue: domain arguments are now correctly double-quoted, preventing unexpected word-splitting in firewall rules. (#17861)
• Test isolation for workflow ID env vars — GITHUB_RUN_ID and GH_AW_WORKFLOW_ID are now cleared between test cases in messages.test.cjs, eliminating intermittent test failures caused by leaked state. (#17857)

---

For complete details, see CHANGELOG.

Generated by Release

---

What's Changed

• fix(tests): clear GITHUB_RUN_ID/GH_AW_WORKFLOW_ID in messages.test.cjs beforeEach by @​Copilot in github/gh-aw#17857
• [specs] Update layout specification - 2026-02-23 by @​github-actions[bot] in github/gh-aw#17860
• [docs] Update glossary - weekly full scan by @​github-actions[bot] in github/gh-aw#17877
• Fix SC1003: use double quotes for awf --allow-domains/--block-domains arguments; fix playwright --no-sandbox arg by @​Copilot in github/gh-aw#17861

Full Changelog: github/gh-aw@v0.49.3...v0.49.4

v0.49.3

🌟 Release Highlights

This release brings a new workflow control option to quiet bot comments, improved engine icons, and reliability fixes for download scripts — plus two community-requested improvements.

✨ What's New

• Silence activation comments — The new activation-comments: false frontmatter flag lets you disable the bot comments gh-aw posts when activating or falling back on a workflow. Useful for keeping issue/PR comment threads clean. (#17834)
• Engine icons for Claude, Codex & Gemini — Local icon assets are now bundled for Claude, Codex, and Gemini alongside a Gemini author entry, giving workflow UIs a consistent visual identity across all supported engines. (#17837)
• Community contributor celebration in release highlights — The release highlight generator now cross-references community-labeled issues with merged PRs and explicitly calls out the issue authors. (#17842)

🐛 Bug Fixes & Improvements

• web-fetch MCP fix — The web-fetch MCP server was incorrectly generating a container format instead of the expected command/args structure, preventing it from initializing. (#17822)
• Duplicate code detector — The detector now correctly emits a noop safe output when no duplication is found, avoiding spurious failures. (#17836)
• Retry on transient download failures — Install scripts now pass --retry 3 --retry-delay 5 to curl when downloading the Copilot CLI and AWF binary, automatically recovering from the occasional 502 on public runners. (#17841)

📚 Documentation

• Clarified that CLAUDE_CODE_OAUTH_TOKEN is not a supported authentication method. (#17835)
• Updated reference documentation with the latest features. (#17830)

... (truncated)

Commits

• bf34f99 Fix SC1003: use double quotes for awf --allow-domains/--block-domains argumen...
• 069d9f5 docs: update glossary with Lockdown Mode, AWF, and Sandbox terms (#17877)
• 2fd8b78 docs: update layout specification for 2026-02-23 (#17860)
• d06df78 fix(tests): clear GITHUB_RUN_ID/GH_AW_WORKFLOW_ID in messages.test.cjs before...
• cb678b4 Add --retry 3 with delay to curl downloads to handle transient 502s (#17841)
• 2f34639 feat: add activation-comments to disable activation/fallback bot comments (...
• 4094506 feat(release): celebrate community issue authors in release highlights (#17842)
• bc1b728 fix(duplicate-code-detector): require noop when no duplication found (#17836)
• 42b6879 Add Gemini author and local icons for Claude, Codex, and Gemini (#17837)
• 6125b4b docs: clarify CLAUDE_CODE_OAUTH_TOKEN is not supported (#17835)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.