# Try github/gh-aw: offline skill and dry-run workflow inspection — 16 October 2026

**Verification status:** Official GitHub release notes and CLI documentation were read on 16 October. None of the commands below were executed for this issue. GitHub Actions jobs and model inference were not run. Reported outputs are expectations, not observations.

## Purpose
Use the MIT-licensed [github/gh-aw](https://github.com/github/gh-aw) CLI extension to inspect a coding-agent workflow without running the agent. The October 15 v0.92.1 release added an offline skill command and reliability improvements, following v0.92.0's stricter model routing. Review the permissions of a generated workflow before granting an agent access to source code.

## Prerequisites and access costs
- A disposable personal Git repository or empty test directory with Git initialized, GitHub CLI (`gh`), and the free `shellcheck` binary available on PATH.
- The open-source CLI extension is MIT licensed. Installation requires internet once; its packaged skill can then be read offline. Compilation may resolve GitHub action pins and model inventory via the network.
- **No model API key, paid account, cloud upgrade or Actions execution is required** for this exercise. Do not activate GitHub Code Security AI Credits, enroll in paid cloud compute, dispatch a workflow, or use a company account. If a cost is requested, record a blocked step instead.

## 1. Check versions and read the offline skill
```sh
gh --version
git --version
shellcheck --version
gh extension install github/gh-aw
gh aw version
gh aw skill
```

**Expected:** a version number and a readable, bundled skill reference. The latest version observed at editorial check was [v0.92.1](https://github.com/github/gh-aw/releases/tag/v0.92.1), published 15 October UTC. If yours differs, use its own official release notes. No model is contacted by the skill command.

## 2. Author the smallest possible workflow
Inside an isolated personal scratch repository, create `.github/workflows/readme-check.md` with the following content. **Save this example as a file**; it is not an instruction to execute its Markdown body.
```yaml
---
on:
  workflow_dispatch:
permissions:
  contents: read
engine: copilot
---
# Read-only repository review
Read the README and describe five useful tests.
Do not change files or publish output.
```

Use GitHub Agentic Workflows' [frontmatter reference](https://github.github.com/gh-aw/reference/frontmatter/) if this schema changes. This agent description would require separate model authorization **to run**, but today's experiment only compiles it. Do not copy this into a repository with sensitive or work data.

## 3. Compile but do not dispatch
Run these commands **from the scratch repository** after saving the file:
```sh
gh aw compile readme-check --dry-run --allow-experimental
gh aw list
git status --short
```

**Expected, if required checks pass:** an inspectable `.github/workflows/readme-check.lock.yml`. The documented dry-run option invokes strict validation, shellcheck, model checks and staged outputs while disabling compiler-managed GitHub mutations. No GitHub Action or AI model is launched. Open the generated file and find its dry-run metadata, model choice and permissions; inspect the full file rather than relying on a filename. A failed check may still leave an **unapproved** file. Never upload or run that file as part of this experiment.

**Limit:** compilation dry-run is NOT an execution sandbox; custom scripts, MCP servers and credentials can still have effects if a workflow is later executed. An execution test would need separate consent and a plan for any model usage costs.

## 4. What changed in the tool?
Read [v0.92.0](https://github.com/github/gh-aw/releases/tag/v0.92.0), which reports rejecting silent configured-model substitution and binding generated patches to validated bytes. Compare [v0.92.1](https://github.com/github/gh-aw/releases/tag/v0.92.1), which reports offline skill access and work-queue diagnostics. These are publisher claims, not separately proven by a static workflow compile.

## Troubleshooting
- `gh` missing: install the official [GitHub CLI](https://cli.github.com/) and retry.
- `gh aw` missing: reinstall `github/gh-aw` using the `gh extension install` command and check `gh extension list`.
- `shellcheck` missing: add the free binary with your OS package manager; do not disable its validation in order to report a pass.
- Workflow cannot be found: ensure the file is named `readme-check.md` inside `.github/workflows/` and compile the matching name.
- Repository/authentication error: stay in a disposable personal repository. Never authenticate a work account or publish to production just to complete the lab.
- Model inventory or GitHub pin lookup fails: note the error. Dry-run validation can require fresh metadata; do not add paid model access to overcome the issue.
- A lock file exists even when command fails: it is not validated until the command returns success with mandatory checks.

## Scoring (0–5)
Score one point for each: (1) extension installs and version recorded; (2) offline skill output is legible; (3) example Markdown contains read-only permissions; (4) `gh aw compile ... --dry-run` finishes without skipped mandatory checks; (5) emitted workflow permissions and dry-run metadata were reviewed. Record actual output or failure for each criterion. Even five points do not establish runtime agent accuracy or safety.

## Sources and tested-status ledger
[CLI documentation](https://github.github.com/gh-aw/setup/cli/), [dry-run compilation behavior and limitations](https://github.github.com/gh-aw/reference/compilation-process/), [project LICENSE](https://github.com/github/gh-aw/blob/main/LICENSE), [v0.92.1 release](https://github.com/github/gh-aw/releases/tag/v0.92.1).

**Verified sources:** yes. **Installed extension:** no. **Read offline output locally:** no. **Compiled:** no. **Ran GitHub Actions or model:** no. **Activated billed services:** no.