Add release update workflow

README.md

@@ -31,6 +31,7 @@ jobs:
 | Small Problem Fixer | Weekday schedule | Fix a small, related issue set and open a focused PR |
 | Code Simplifier | Weekday schedule | Simplify overcomplicated code with high-confidence refactors |
 | Test Improvement | Weekly schedule | Add targeted tests and clean up redundant coverage |
+| Release Update Check | Weekly schedule | Open a PR updating pinned ai-github-actions workflow SHAs and suggest workflow changes |
 | Bug Hunter | Weekday schedule | Find a reproducible, user-impacting bug and file an issue |
 | Docs Drift | Weekday schedule | Detect code changes needing doc updates |
 | Docs New Contributor Review | Weekly schedule | Review docs from a new contributor perspective |

gh-agent-workflows/README.md

@@ -14,6 +14,7 @@
 | [Small Problem Fixer](small-problem-fixer/) | Weekday schedule | Fix small, related issues and open a focused PR |
 | [Code Simplifier](code-simplifier/) | Weekday schedule | Simplify overcomplicated code with high-confidence refactors |
 | [Test Improvement](test-improvement/) | Weekly schedule | Add targeted tests and clean up redundant coverage |
+| [Release Update Check](release-update/) | Weekly schedule | Open a PR updating pinned ai-github-actions workflow SHAs and suggest workflow changes |
 | [Bug Hunter](bug-hunter/) | Weekday schedule | Find reproducible bugs and file reports |
 | [Docs Drift](docs-drift/) | Weekday schedule | Detect code changes needing doc updates |
 | [Docs New Contributor Review](docs-new-contributor-review/) | Weekly schedule | Review docs from a new contributor perspective |

gh-agent-workflows/release-update/README.md

@@ -0,0 +1,31 @@
+# Release Update Check
+
+Check for new ai-github-actions releases and open a PR updating pinned workflow SHAs, with suggestions based on release notes.
+
+## Quick Install
+
+````bash
+mkdir -p .github/workflows && curl -sL \
+  https://raw.githubusercontent.com/elastic/ai-github-actions/v0/gh-agent-workflows/release-update/example.yml \
+  -o .github/workflows/release-update.yml
+````
+
+See [example.yml](example.yml) for the full workflow file.
+
+## Trigger
+
+| Event | Schedule |
+| --- | --- |
+| `schedule` | Weekly |
+| `workflow_dispatch` | Manual |
+
+## Inputs
+
+| Input | Description | Required | Default |
+| --- | --- | --- | --- |
+| `additional-instructions` | Repo-specific instructions appended to the agent prompt | No | `""` |
+| `setup-commands` | Shell commands run before the agent starts | No | `""` |
+
+## Safe Outputs
+
+- `create-pull-request` — open a PR with workflow reference updates

gh-agent-workflows/release-update/example.yml

@@ -0,0 +1,16 @@
+name: Release Update Check
+on:
+  schedule:
+    - cron: "0 11 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-release-update.lock.yml@v0
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

github/workflows/gh-aw-release-update.md

@@ -0,0 +1,112 @@
+---
+description: "Check for new ai-github-actions releases and open PRs to update pinned workflow SHAs"
+imports:
+  - gh-aw-fragments/elastic-tools.md
+  - gh-aw-fragments/runtime-setup.md
+  - gh-aw-fragments/formatting.md
+  - gh-aw-fragments/rigor.md
+  - gh-aw-fragments/mcp-pagination.md
+  - gh-aw-fragments/messages-footer.md
+  - gh-aw-fragments/safe-output-create-pr.md
+engine:
+  id: copilot
+  model: gpt-5.2-codex
+on:
+  workflow_call:
+    inputs:
+      additional-instructions:
+        description: "Repo-specific instructions appended to the agent prompt"
+        type: string
+        required: false
+        default: ""
+      setup-commands:
+        description: "Shell commands to run before the agent starts (dependency install, build, etc.)"
+        type: string
+        required: false
+        default: ""
+      messages-footer:
+        description: "Footer appended to all agent comments and reviews"
+        type: string
+        required: false
+        default: ""
+    secrets:
+      COPILOT_GITHUB_TOKEN:
+        required: true
+concurrency:
+  group: release-update
+  cancel-in-progress: true
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+tools:
+  github:
+    toolsets: [repos, issues, pull_requests, search]
+  bash: true
+  web-fetch:
+network:
+  allowed:
+    - defaults
+    - github
+  strict: false
+roles: [admin, maintainer, write]
+safe-outputs:
+  noop:
+timeout-minutes: 30
+steps:
+  - name: Repo-specific setup
+    if: ${{ inputs.setup-commands != '' }}
+    env:
+      SETUP_COMMANDS: ${{ inputs.setup-commands }}
+    run: eval "$SETUP_COMMANDS"
+---
+
+# Release Update Check
+
+Check for new releases of `elastic/ai-github-actions` and open a PR that updates pinned workflow SHAs in this repository.
+
+## Context
+
+- **Repository**: ${{ github.repository }}
+
+## Constraints
+
+- **CAN**: Read files, search code, modify files locally, run tests and commands, create a pull request.
+- **CANNOT**: Push directly to the repository — use `create_pull_request`.
+- **Only one PR per run.**
+- Only update workflow references to `elastic/ai-github-actions/.github/workflows/gh-aw-*.lock.yml@...`.
+- If no updates are needed, call `noop` with a brief reason.
+
+## Step 1: Gather context
+
+1. Call `generate_agents_md` to get repository conventions (if it fails, continue).
+2. Use `github-get_latest_release` for `elastic/ai-github-actions` to obtain the latest tag and release notes. If no release exists, call `noop` and stop.
+3. Resolve the tag to a commit SHA using `github-get_tag`.
+4. Find pinned workflow references in this repository:
+
+````text
+rg -n "elastic/ai-github-actions/.github/workflows/gh-aw-.*\\.lock\\.yml@\\S+" .
+````
+
+5. Extract the current refs and identify which ones are full commit SHAs. If no references are found, call `noop`.
+6. Check for an existing open PR that already targets the latest tag (use `github-search_pull_requests`). If one exists, call `noop`.
+
+## Step 2: Update workflow references
+
+- For each outdated reference, update the ref to the latest release commit SHA.
+- Preserve any trailing comments; if a comment exists for the old tag, update it to the latest tag. If no comment exists, add `# <latest tag>` after the ref.
+- Do not touch references that already use the latest release SHA or tag.
+
+## Step 3: Suggest workflow improvements
+
+- Review the latest release notes and identify any changes that affect workflow usage or configuration.
+- Add a short "Suggested workflow updates" section in the PR body. If there are no relevant suggestions, state that explicitly.
+
+## Step 4: Create the PR
+
+1. Commit the changes locally.
+2. Call `create_pull_request` with:
+   - **Title**: `Update ai-github-actions workflows to <latest tag>`
+   - **Body**: Summary of updated refs (old → new), release note highlights that matter, suggested workflow updates, and tests run (if none, say "Not run (workflow reference updates only)").
+
+${{ inputs.additional-instructions }}