[github-actions]

Summary

Updates the default CLI pins to the newest stable releases eligible under the global 72-hour cooldown at the 2026-11-09T05:31:17Z check time (cutoff 2026-11-06T05:31:17Z). An open PR search found no active PR covering these pin updates.

Evidence and impact

• Claude Code: 2.1.317 → 2.1.319, published 2026-11-06T00:58:56Z. npm metadata identifies 2.1.319 as the newest stable release before the cutoff. This is a low-risk CLI patch update; no public upstream repository or release notes were available, so analysis used npm metadata and CLI help.
• Codex: 0.166.0 → 0.167.0, published 2026-11-06T01:40:00Z. Release notes: https://github.com/openai/codex/releases/tag/rust-v0.167.0. The release adds agent command-center/session-picker features, backend switching, image attachment previews, provider sign-in options, and fixes for resume, approval, transcript, and context-compaction behavior. No breaking change affecting gh-aw installation or invocation was identified. Risk: medium because this is a feature release.
• Codex routing compatibility was re-reviewed for 0.167.0; the seven existing AWF routing-contract reasoning efforts remain unchanged, and the pin-review guard was updated accordingly.

Deferred candidates: Copilot 1.0.106 lacks an independently reviewed checksum; Zizmor 1.32.0 had no usable registry digest lookup; MCP Gateway, Syft, and Grype releases were still inside the cooldown. No unrelated pins were changed.

Changes

• Updated DefaultClaudeCodeVersion and DefaultCodexVersion.
• Updated version expectations and Codex routing review guards.
• Compiled all workflows with make recompile; generated lock changes were intentionally restored and are excluded from delivery per workflow policy.

Validation

• Passed: go test ./pkg/constants ./pkg/workflow -run TestDefaultCLIMCPVersions|Test.*ModelRouting|Test.*Version|TestClaude|TestCodex
• Passed: make recompile in the foreground (365 workflows compiled; existing generated lock changes restored afterward).
• Passed: git diff --check.
• Passed: disposable installs of Claude Code 2.1.319 and Codex 0.167.0; both --version and --help succeeded.
• make fmt formatted Go successfully, but its JavaScript phase could not run because actions/setup/js/node_modules/.bin/prettier is missing.
• The focused JavaScript routing test was not run because repository JS dependencies/vitest are unavailable in this checkout; this is reported rather than claimed as passing.

Generated by 🔢 CLI Version Checker · pi · gpt50 · ~7 AIC · ⌖ ~2 AIC · ⊞ 20K · ◷

• expires on Nov 10, 2026, 9:43 PM UTC-08:00