Commit 5dd111d

title: "Weekly Update – June 15, 2026"

description: "This week brings Go timer-leak fixes, two new linters, a 4 MB patch-size bump, cross-repo safe-output allowlists, and much more."

authors:

- copilot

date: 2026-06-15

metadata:

seoDescription: "gh-aw weekly update: Go timer-leak fixes, errorfwrapv & timeafterleak linters, 4 MB patch size, cross-repo allowlists, and more."

No releases this week — but the merge queue more than made up for it. Over 50 pull requests landed in [github/gh-aw](https://github.com/github/gh-aw) between June 9 and June 15, touching everything from Go reliability to docs, linters, and cost optimization. Here's the highlights.

[PR #39188](https://github.com/github/gh-aw/pull/39188) landed one of the most satisfying fixes of the week: every looped `time.After` call in the CLI was replaced with a properly cancelled timer, and a new **`timeafterleak`** Go linter was wired into CI to keep it that way. In tight loops, `time.After` creates a new timer on every iteration without ever cleaning up the old ones — a slow drip of leaked goroutines. Now that drip is plugged, and the linter makes sure it stays that way.

Two new Go analysis linters shipped this week:

- **[`timeafterleak`](https://github.com/github/gh-aw/pull/39133)** — flags `time.After` inside `for`+`select` loops where the timer would never be cancelled.

- **[`errorfwrapv`](https://github.com/github/gh-aw/pull/39263)** — flags `fmt.Errorf` calls that use `%v` to wrap errors instead of `%w`, ensuring errors stay unwrappable through the call stack.

Both linters were auto-generated by the `linter-miner` workflow and are now enforced in CI.

[PR #39118](https://github.com/github/gh-aw/pull/39118) raises the default `max-patch-size` from 1 MB to 4 MB and improves the error message when a patch exceeds the limit. If your workflows were running into patch-size rejections on larger changesets, you'll want to pull in the latest CLI — this headroom matters for repos with big generated files.

[PR #39080](https://github.com/github/gh-aw/pull/39080) adds support for cross-repo `dispatch-workflow` allowlists in safe-outputs. You can now configure which repositories are allowed to trigger a `dispatch-workflow` safe output, giving teams fine-grained control over cross-repo automation boundaries.

Two PRs improve what you see when workflows fail:

- **[#39122](https://github.com/github/gh-aw/pull/39122)**: Failure issues now include the last 5 tool calls when a tool denial triggers — so instead of "tool was denied," you get the full context of what the agent was trying to do.

- **[#39069](https://github.com/github/gh-aw/pull/39069)**: When the AI credits guardrail fires, failure issues now include an "Optimize token consumption" section with concrete suggestions for reducing costs.

- **[#39241](https://github.com/github/gh-aw/pull/39241)**: Anthropic Workload Identity Federation (WIF) is now documented as a first-class Claude authentication option — no more hunting through PRs to figure out how to set it up.

- **[#39226](https://github.com/github/gh-aw/pull/39226)**: The experiments docs were expanded with concrete examples covering custom models, sub-agents, and sub-skills.

Several PRs this week focused on reducing unnecessary token consumption:

- **[#39280](https://github.com/github/gh-aw/pull/39280)**: Reduced first-request token overhead in `smoke-copilot` and `test-quality-sentinel` by trimming ambient context.

- **[#39157](https://github.com/github/gh-aw/pull/39157)**: Reduced ambient-context payload across daily and PR workflows by sharing prompt imports more efficiently.

Your tireless overnight watchman — scans every workflow run in the repository, diagnoses root causes, and files structured GitHub issues before you've had your morning coffee.

`aw-failure-investigator` ran **three times** in the past week (it's on a 6-hour schedule — it never really sleeps), consuming over 4.7 million tokens and 60 turns across those runs. In its most recent run on June 15 at 1:38 AM, it filed two P1/P2 issues: one alerting that the Daily Model Inventory Checker had been 100% broken for six consecutive days due to a `session.idle` 60-second timeout exhausting all retry attempts, and another flagging that both Azure OpenAI smoke variants were false-failing in lockstep due to Azure 429 throttling. Earlier in the week it also identified that Code Simplifier was silently hitting the api-proxy invocation cap (50/50 LLM calls), causing 100% failure rate with no existing tracking issue.

It ran its June 14 morning investigation in 16.6 minutes, used 1.8M tokens, and still filed 3 detailed issues — including one that caught a failure the team hadn't noticed yet. Impressive dedication for an agent that technically has no idea what time it is.

💡 **Usage tip**: Deploy `aw-failure-investigator` in any repo with multiple scheduled workflows — catching silent regressions at 2 AM beats discovering them at the next sprint review.

→ [View the workflow on GitHub](https://github.com/github/gh-aw/blob/main/.github/workflows/aw-failure-investigator.md)

All of this week's improvements ship with the latest CLI build. Pull the newest version and explore the expanded patch-size headroom, the new linters, and the improved failure diagnostics. As always, contributions are welcome at [github/gh-aw](https://github.com/github/gh-aw).