[blog] Weekly blog post – 2026-06-15

docs/src/content/docs/blog/2026-06-15-weekly-update.md

@@ -0,0 +1,71 @@
+---
+title: "Weekly Update – June 15, 2026"
+description: "This week brings Go timer-leak fixes, two new linters, a 4 MB patch-size bump, cross-repo safe-output allowlists, and much more."
+authors:
+  - copilot
+date: 2026-06-15
+metadata:
+  seoDescription: "gh-aw weekly update: Go timer-leak fixes, errorfwrapv & timeafterleak linters, 4 MB patch size, cross-repo allowlists, and more."
+---
+
+No releases this week — but the merge queue more than made up for it. Over 50 pull requests landed in [github/gh-aw](https://github.com/github/gh-aw) between June 9 and June 15, touching everything from Go reliability to docs, linters, and cost optimization. Here's the highlights.
+
+## 🐛 Reliability: Eliminating `time.After` Timer Leaks
+
+[PR #39188](https://github.com/github/gh-aw/pull/39188) landed one of the most satisfying fixes of the week: every looped `time.After` call in the CLI was replaced with a properly cancelled timer, and a new **`timeafterleak`** Go linter was wired into CI to keep it that way. In tight loops, `time.After` creates a new timer on every iteration without ever cleaning up the old ones — a slow drip of leaked goroutines. Now that drip is plugged, and the linter makes sure it stays that way.
+
+## ✨ New Linters: `errorfwrapv` and `timeafterleak`
+
+Two new Go analysis linters shipped this week:
+
+- **[`timeafterleak`](https://github.com/github/gh-aw/pull/39133)** — flags `time.After` inside `for`+`select` loops where the timer would never be cancelled.
+- **[`errorfwrapv`](https://github.com/github/gh-aw/pull/39263)** — flags `fmt.Errorf` calls that use `%v` to wrap errors instead of `%w`, ensuring errors stay unwrappable through the call stack.
+
+Both linters were auto-generated by the `linter-miner` workflow and are now enforced in CI.
+
+## 📦 Max Patch Size Increased to 4 MB
+
+[PR #39118](https://github.com/github/gh-aw/pull/39118) raises the default `max-patch-size` from 1 MB to 4 MB and improves the error message when a patch exceeds the limit. If your workflows were running into patch-size rejections on larger changesets, you'll want to pull in the latest CLI — this headroom matters for repos with big generated files.
+
+## 🔐 Cross-Repo `safe-outputs` Dispatch Allowlists
+
+[PR #39080](https://github.com/github/gh-aw/pull/39080) adds support for cross-repo `dispatch-workflow` allowlists in safe-outputs. You can now configure which repositories are allowed to trigger a `dispatch-workflow` safe output, giving teams fine-grained control over cross-repo automation boundaries.
+
+## 💡 Better Failure Diagnostics
+
+Two PRs improve what you see when workflows fail:
+
+- **[#39122](https://github.com/github/gh-aw/pull/39122)**: Failure issues now include the last 5 tool calls when a tool denial triggers — so instead of "tool was denied," you get the full context of what the agent was trying to do.
+- **[#39069](https://github.com/github/gh-aw/pull/39069)**: When the AI credits guardrail fires, failure issues now include an "Optimize token consumption" section with concrete suggestions for reducing costs.
+
+## 📄 Docs: Anthropic WIF and Experiments
+
+- **[#39241](https://github.com/github/gh-aw/pull/39241)**: Anthropic Workload Identity Federation (WIF) is now documented as a first-class Claude authentication option — no more hunting through PRs to figure out how to set it up.
+- **[#39226](https://github.com/github/gh-aw/pull/39226)**: The experiments docs were expanded with concrete examples covering custom models, sub-agents, and sub-skills.
+
+## ⚡ Token / Cost Optimizations
+
+Several PRs this week focused on reducing unnecessary token consumption:
+
+- **[#39280](https://github.com/github/gh-aw/pull/39280)**: Reduced first-request token overhead in `smoke-copilot` and `test-quality-sentinel` by trimming ambient context.
+- **[#39157](https://github.com/github/gh-aw/pull/39157)**: Reduced ambient-context payload across daily and PR workflows by sharing prompt imports more efficiently.
+
+---
+
+## 🤖 Agent of the Week: aw-failure-investigator
+
+Your tireless overnight watchman — scans every workflow run in the repository, diagnoses root causes, and files structured GitHub issues before you've had your morning coffee.
+
+`aw-failure-investigator` ran **three times** in the past week (it's on a 6-hour schedule — it never really sleeps), consuming over 4.7 million tokens and 60 turns across those runs. In its most recent run on June 15 at 1:38 AM, it filed two P1/P2 issues: one alerting that the Daily Model Inventory Checker had been 100% broken for six consecutive days due to a `session.idle` 60-second timeout exhausting all retry attempts, and another flagging that both Azure OpenAI smoke variants were false-failing in lockstep due to Azure 429 throttling. Earlier in the week it also identified that Code Simplifier was silently hitting the api-proxy invocation cap (50/50 LLM calls), causing 100% failure rate with no existing tracking issue.
+
+It ran its June 14 morning investigation in 16.6 minutes, used 1.8M tokens, and still filed 3 detailed issues — including one that caught a failure the team hadn't noticed yet. Impressive dedication for an agent that technically has no idea what time it is.
+
+💡 **Usage tip**: Deploy `aw-failure-investigator` in any repo with multiple scheduled workflows — catching silent regressions at 2 AM beats discovering them at the next sprint review.
+
+→ [View the workflow on GitHub](https://github.com/github/gh-aw/blob/main/.github/workflows/aw-failure-investigator.md)
+
+---
+
+## Try It Out
+
+All of this week's improvements ship with the latest CLI build. Pull the newest version and explore the expanded patch-size headroom, the new linters, and the improved failure diagnostics. As always, contributions are welcome at [github/gh-aw](https://github.com/github/gh-aw).