Bump gh-aw-firewall to v0.27.12 and gh-aw-mcpg to v0.3.31#41945
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ Smoke test completed with partial failures (GitHub MCP and Build tests). Results reported via issue and PR comment. |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories. |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ PR Code Quality Reviewer completed the code quality review. |
|
✅ Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR. PR #41945 is a dependency bump (gh-aw-firewall v0.27.12, gh-aw-mcpg v0.3.31) that regenerated workflow lock files only. Test Quality Sentinel skipped. |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
There was a problem hiding this comment.
Pull request overview
This pull request updates gh-aw’s default pinned versions for the gh-aw firewall (AWF) and MCP gateway (MCPG), and refreshes the generated/embedded artifacts (schema, container pins, compiled lockfiles, and wasm goldens) that reflect those defaults across workflows and tests.
Changes:
- Bump default pins to gh-aw-firewall v0.27.12 and gh-aw-mcpg v0.3.31.
- Sync embedded AWF config JSON schema copy to the upstream v0.27.12 content.
- Refresh container/action pin data and regenerate compiled workflow / wasm golden fixtures to match the new versions and digests.
Show a summary per file
| File | Description |
|---|---|
pkg/constants/version_constants.go |
Updates DefaultFirewallVersion and DefaultMCPGatewayVersion constants to the new releases. |
pkg/workflow/schemas/awf-config.schema.json |
Syncs schema descriptions to match upstream AWF v0.27.12. |
pkg/workflow/data/action_pins.json |
Adds new digest pins for AWF 0.27.12 images and MCPG v0.3.31. |
pkg/actionpins/data/action_pins.json |
Mirrors the updated container pin set for runtime/compiler usage. |
.github/aw/actions-lock.json |
Updates the embedded pin registry used for compiled workflows/assets. |
.github/workflows/test-workflow.lock.yml |
Regenerates compiled workflow to reference AWF 0.27.12 + MCPG v0.3.31 and updated digests. |
.github/workflows/example-permissions-warning.lock.yml |
Regenerates compiled workflow to reference updated AWF/MCPG versions and digests. |
.github/workflows/codex-github-remote-mcp-test.lock.yml |
Regenerates compiled workflow to reference updated AWF/MCPG versions and digests. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden |
Updates wasm golden fixture outputs for AWF/MCPG version bump. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden |
Updates wasm golden fixture outputs for AWF/MCPG version bump. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden |
Updates wasm golden fixture outputs for AWF/MCPG version bump. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden |
Updates wasm golden fixture outputs for AWF/MCPG version bump. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden |
Updates all-engines golden fixture to AWF 0.27.12 and MCPG v0.3.31. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden |
Updates all-engines golden fixture to AWF 0.27.12 and MCPG v0.3.31. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden |
Updates all-engines golden fixture to AWF 0.27.12 and MCPG v0.3.31. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden |
Updates all-engines golden fixture to AWF 0.27.12 and MCPG v0.3.31. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden |
Updates all-engines golden fixture to AWF 0.27.12 and MCPG v0.3.31. |
.changeset/patch-bump-awf-v0-27-12-mcpg-v0-3-31.md |
Adds a changeset entry documenting the default pin bump and regenerated artifacts. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 34/268 changed files
- Comments generated: 0
- Review effort level: Low
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Smoke walk left one diff note.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 506.2 AIC · ⌖ 16.4 AIC · ⊞ 19.8K
There was a problem hiding this comment.
Review: Version bump — gh-aw-firewall v0.27.12 · gh-aw-mcpg v0.3.31
No blocking issues. Changes are mechanical, consistent, and complete.
What was reviewed
Source code changes (pkg/constants/version_constants.go)
Two version string constants updated; no logic altered.
Pin files (.github/aw/actions-lock.json, pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json)
All three are byte-for-byte identical — new entries for all five image variants carry correct sha256 digests. Notably, cli-proxy at 0.27.11 previously had no pinned digest in the manifest; 0.27.12 now has one, which closes a pre-existing supply-chain gap.
Schema (pkg/workflow/schemas/awf-config.schema.json)
Description-only sync from upstream. The existing allOf constraint (topologyAttach → isolation: true) is preserved. The new description language noting that isolation is not yet supported alongside dnsOverHttps or enableHostAccess is informational; schema-level enforcement would be a separate concern.
Generated artifacts
All 268 lock files regenerated — grep confirms zero residual references to 0.27.11 or v0.3.30. Wasm golden fixtures updated consistently.
🔎 Code quality review by PR Code Quality Reviewer · 171 AIC · ⌖ 7.08 AIC · ⊞ 5.2K
|
Smoke Test 28303380257: Tests: 1✅ 2❌ 3❌ 4❌ 5❌ 6✅ 7❌ 8✅ 9❌ 10✅ 11✅ 12❌ 13✅ 14✅ 15✅ Overall: FAIL Author:
|
|
@copilot please run the
|
🤖 PR Triage — Run §28307424127
Summary: Dependency version bump for
|
|
@copilot please run the
|
…-and-mcpg-versions # Conflicts: # .github/workflows/daily-code-metrics.lock.yml # .github/workflows/smoke-copilot-aoai-entra.lock.yml # .github/workflows/test-quality-sentinel.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
PR Triage — Run §28315307719
Large generated-asset bump for gh-aw-firewall v0.27.12 and gh-aw-mcpg v0.3.31 (+5307/-5227, 272 files). CI gate pending after latest push. Review together with other infrastructure updates. 10h old.
|
|
🎉 This pull request is included in a new release. Release: |
This updates gh-aw to the latest
gh-aw-firewallandgh-aw-mcpgreleases, and refreshes the generated assets that carry those defaults through compiled workflows. It also syncs the embedded AWF config schema copy with the upstream release.Version pins
DefaultFirewallVersiontov0.27.12DefaultMCPGatewayVersiontov0.3.31AWF schema sync
awf-config.schema.jsoncopy to match the upstreamv0.27.12release content where it driftedContainer pin refresh
actions-lock.jsonGenerated artifact updates
✨ PR Review Safe Output Test - Run 28303361477
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.comSee Network Configuration for more information.
pr-sous-chef run 28311797805