Bump AWF to v0.27.27 and MCPG to v0.4.0#44173
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This pull request updates gh-aw’s pinned versions and generated artifacts to align with the latest gh-aw-firewall (AWF) release v0.27.27 and gh-aw-mcpg release v0.4.0, including schema synchronization and regenerated lock/golden fixtures.
Changes:
- Bump default AWF and MCP Gateway versions, and refresh expected firewall/build-tools digests in regression tests.
- Sync the embedded AWF config JSON schema with upstream additions/updates (e.g., new
vertextarget override,container.mounts, expanded Docker field descriptions). - Regenerate workflow lockfiles and wasm golden fixtures to reflect the new pinned images and default version metadata.
Show a summary per file
| File | Description |
|---|---|
| pkg/constants/version_constants.go | Bumps DefaultFirewallVersion to v0.27.27 and DefaultMCPGatewayVersion to v0.4.0. |
| pkg/workflow/schemas/awf-config.schema.json | Syncs embedded AWF config schema with new fields and updated descriptions. |
| pkg/workflow/docker_firewall_pin_compile_test.go | Updates expected pinned digests for AWF images and build-tools for ARC/DinD. |
| .github/aw/actions-lock.json | Adds new pinned image entries for AWF 0.27.27 and MCPG v0.4.0. |
| pkg/actionpins/data/action_pins.json | Syncs embedded action pin data with new container digests. |
| pkg/workflow/data/action_pins.json | Syncs workflow-side embedded action pin data with new container digests. |
| .github/workflows/test-workflow.lock.yml | Regenerates lockfile manifest/pins and emitted AWF/MCPG references for the bumped versions. |
| .github/workflows/ace-editor.lock.yml | Regenerates lockfile manifest/pins and emitted AWF/MCPG references for the bumped versions. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden | Updates wasm golden output metadata and image references to AWF v0.27.27 / MCPG v0.4.0. |
| .changeset/patch-bump-awf-v0-27-27-mcpg-v0-4-0.md | Adds a patch changeset describing the version/schema/pin refresh. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 31/274 changed files
- Comments generated: 1
- Review effort level: Low
| @@ -726,7 +738,7 @@ | |||
| "topology": { | |||
| "type": "string", | |||
| "enum": ["standard", "arc-dind"], | |||
| "description": "Runner deployment topology. 'standard' (default) = GitHub-hosted VM or self-hosted runner with local Docker. 'arc-dind' = ARC (Actions Runner Controller) with Docker-in-Docker sidecar, where the runner and Docker daemon have separate filesystems. When set to 'arc-dind', AWF applies overridable defaults: network.isolation=true, dind.preStageDirs=true, sysroot image activation, and tool cache validation." | |||
| "description": "Runner deployment topology. 'standard' (default) = GitHub-hosted VM or self-hosted runner with local Docker. 'arc-dind' = ARC (Actions Runner Controller) with Docker-in-Docker sidecar, where the runner and Docker daemon have separate filesystems. When set to 'arc-dind', AWF enables sysroot staging (a sysroot-stage init container copies the build-tools image into a named volume mounted at /host:rw on the agent) and emits a warning when RUNNER_TOOL_CACHE points under /opt (which is typically invisible to the DinD daemon). Other ARC/DinD settings such as container.dockerHostPathPrefix, dind.preStageDirs, and network.isolation are configured explicitly through their own fields. See docs/arc-dind.md for a complete guide." | |||
There was a problem hiding this comment.
Removed the See docs/arc-dind.md for a complete guide. sentence from the description — the file doesn't exist in this repo. Fixed in commit $(cd /home/runner/work/gh-aw/gh-aw && git rev-parse --short HEAD).
|
@copilot run pr-finisher skill |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
…opology description Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
@copilot merge main and recompile |
…v040-firewall-to-v02727 # Conflicts: # .github/workflows/daily-byok-ollama-test.lock.yml # .github/workflows/smoke-codex.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done. Merged main (resolved conflicts in two generated lockfiles) and ran |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Smoke test
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "proxy.golang.org"See Network Configuration for more information.
|
Smoke Test Results
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke test: FAIL\nMerged PRs: #44183 [log] Add debug logging to parser and workflow files\nMerged PRs: #44171 [community] Update community contributions in README\nGitHub PR read ✅ | Serena ✅ | Playwright ✅ | Web fetch ❌ | Build ✅ Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
💥 Smoke Test: Claude — Run 28918718841Core #1-12: ✅ all passed Overall: PARTIAL (all non-skipped tests passed) Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
💥 [THE END] — Illustrated by Smoke Claude · 71.3 AIC · ⌖ 31.4 AIC · ⊞ 8.4K
Comment /smoke-claude to run again
| --- | ||
| "gh-aw": patch | ||
| --- | ||
|
|
There was a problem hiding this comment.
Nit: consider linking the AWF/MCPG release notes here for reviewers to cross-check versions. (smoke test)
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Bump the default gh-aw-firewall version to v0.27.27, update gh-aw-mcpg to v0.4.0, sync the embedded AWF config schema, and regenerate pinned workflow artifacts. |
There was a problem hiding this comment.
Optional: mention regenerated artifacts count so reviewers know the blast radius. (smoke test)
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Cave smoke review done. Bumps and pins look lined up.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 106.9 AIC · ⌖ 5.98 AIC · ⊞ 19.1K
Comment /smoke-copilot to run again
Add label smoke to run again
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Smoke test review submitted.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot - AOAI (apikey) · 60.1 AIC · ⌖ 3.87 AIC · ⊞ 17.9K
Comment /smoke-copilot-aoai-apikey to run again
Add label smoke to run again
|
🎉 This pull request is included in a new release. Release: |
This updates gh-aw to the latest
gh-aw-firewallandgh-aw-mcpgreleases, and refreshes the generated artifacts that depend on those image versions and digests.Version bumps
DefaultFirewallVersiontov0.27.27DefaultMCPGatewayVersiontov0.4.0AWF schema sync
v0.27.27firewall releaseContainer pin refresh
.github/aw/actions-lock.jsonbuild-toolsfor ARC/DinDGenerated fixture updates
Release note
Example of the version pin update:
✨ PR Review Safe Output Test - Run 28918718841
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.comSee Network Configuration for more information.