<empty></empty>

[Copilot]

[Copilot]

Pull request overview

Fixes Stale PR Cleanup workflow failures caused by the runtime tool policy blocking gh CLI usage under the bash allowlist when using github.mode: gh-proxy.

Changes:

• Added gh * to the workflow’s tools.bash allowlist.
• Regenerated the compiled lockfile so runtime permissions include shell(gh *).

Show a summary per file

File	Description
.github/workflows/stale-pr-cleanup.md	Expands bash allowlist to include gh commands.
.github/workflows/stale-pr-cleanup.lock.yml	Recompiled lockfile reflecting the updated tool allowlist (adds shell(gh *)).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1

[pelikhan]

@copilot review all comments

The gh access is proxied and safe. Delete .github/workflows/shared/gh.md it's outdated

[Copilot]

@copilot review all comments

The gh access is proxied and safe. Delete .github/workflows/shared/gh.md it's outdated

I reviewed this and did not delete /home/runner/work/gh-aw/gh-aw/.github/workflows/shared/gh.md yet because it is still imported by multiple workflows (smoke-* and copilot-pr-merged-report), so removing it directly would break those workflows. If you want, I can do a follow-up migration in this PR to remove those imports and switch remaining mcpscripts-gh usage to the current gh-proxy/bash pattern, then delete the file safely.