Cost-routed Go Logger Enhancement agent workflow via gh-aw balanced model routing

What they did

The author took an existing gh-aw (GitHub Agentic Workflows) workflow, `Go Logger Enhancement`, which was running on Claude Code's default model `claude-sonnet-5` at roughly 118 AIC per run, and moved it onto `balanced` cost routing. The issue estimated this would save 370–550 AIC per week, and three sibling workflows (Sergo, Static Analysis Report, Instructions Janitor) already used the same setup. In `.github/workflows/go-logger.md` they added `copilot-requests: write` to permissions and changed the engine block to `id: claude`, `model-provider: github`, with `model-routing: { goal: cost, mode: balanced }`. The prompt, steps and safe outputs were left untouched, and they deliberately added no model pin and no allowed/blocked model lists. They then recompiled only that workflow, so only `go-logger.lock.yml` changed. The lock file now enables routing (`GH_AW_INFO_MODEL_CONFIG.routing.enabled: true` with `github-copilot/claude-*` candidates, plus `experimental.modelRouting: true` in the agent's AWF config), drops the `claude-sonnet-5` default, adds a "Prepare model-routing conversation" step, `model_effort` and `model_routing_status` job outputs, a "Restore runtime model metadata" step, and uploads `awf-routing-outcome.json` as an artifact. The router image `ghcr.io/github/gh-aw-firewall/router:0.29.6` is pinned by digest. Inference now goes through Copilot using `COPILOT_GITHUB_TOKEN: ${{ github.token }}` via `api-proxy:10002`, so `ANTHROPIC_API_KEY` and its validation step were removed. Threat detection now runs on the Copilot CLI with its default model (`detection`, falling back to `auto`), and the Claude Code CLI install step was removed.

How it went

The change is scoped and mechanical: one workflow file edited, one lock file recompiled, no other lock files touched, and the prompt/steps/safe outputs preserved. The author explicitly deferred validation to a follow-up: auditing the first routed runs with `gh aw audit <run>` against the 118 AIC/run baseline, confirming the PRs the workflow opens build and pass tests, and comparing merge rate with recent ones. Rollback is a plain revert. They also noted several failing checks (golint, two integration tests, seven JS tests, a USE-001 finding) that live in files outside this change and were not re-run on `main` to confirm pre-existing failure.

Worth knowing

Savings are an estimate from the issue, not measured in this PR — no post-merge AIC numbers are included. The audit step, build/test verification of opened PRs, and merge-rate comparison are all still pending. The author did not confirm whether the listed failing checks also fail on `main`. Routing behavior depends on the pinned router image digest and on Copilot inference via `api-proxy:10002`, so token permissions (`copilot-requests: write`) must be granted to every job that calls Copilot. Threat detection now inherits the Copilot CLI default model rather than an explicit pin, which is a behavior change worth watching.

Wiring

Order: (1) edit `.github/workflows/go-logger.md` — add `copilot-requests: write` to `permissions`; set `engine.id: claude`, `engine.model-provider: github`, `engine.model-routing.goal: cost`, `engine.model-routing.mode: balanced`. (2) Recompile just that workflow with the gh-aw compiler so only `go-logger.lock.yml` regenerates. (3) Verify the lock file: `GH_AW_INFO_MODEL_CONFIG.routing.enabled: true` with `github-copilot/claude-*` candidates, `experimental.modelRouting: true` in the AWF agent config, new "Prepare model-routing conversation" and "Restore runtime model metadata" steps, `model_effort` and `model_routing_status` job outputs, `awf-routing-outcome.json` uploaded as an artifact, and router image `ghcr.io/github/gh-aw-firewall/router:0.29.6` pinned by digest. (4) Credentials: inference flows through Copilot using `COPILOT_GITHUB_TOKEN: ${{ github.token }}` via `api-proxy:10002`; remove `ANTHROPIC_API_KEY` and its validation step; ensure every Copilot-calling job has `copilot-requests: write`. (5) Threat detection runs on the Copilot CLI with default model (`detection`, fallback `auto`); the Claude Code CLI install step is removed. (6) Post-merge: `gh aw audit <run>` against the 118 AIC/run baseline; revert the PR to roll back.

Try it yourself

In this repo, find the gh-aw workflow `.github/workflows/go-logger.md` and switch it from the default Claude model to balanced cost routing. Add `copilot-requests: write` under `permissions`, and set the engine block to `id: claude`, `model-provider: github`, `model-routing: { goal: cost, mode: balanced }`. Do not add a model pin or allowed/blocked model lists, and do not change the prompt, steps, or safe outputs. Recompile only this workflow so only `go-logger.lock.yml` changes, then show me the diff: confirm routing is enabled, the `claude-sonnet-5` default is gone, the router image is pinned by digest, `ANTHROPIC_API_KEY` and its validation step are removed, and inference goes through Copilot via `COPILOT_GITHUB_TOKEN: ${{ github.token }}` on `api-proxy:10002`. Finally, list the commands I should run to audit the first routed runs with `gh aw audit <run>` against the 118 AIC/run baseline.