Refresh CLI defaults and scanner image pins by Copilot · Pull Request #61432 · github/gh-aw

Copilot · 2026-09-16T23:19:47Z

Updates repository-pinned CLI defaults and scanner images to current verified releases. Playwright CLI remains on 0.1.19 until its enforced npm release-age cooldown expires.

CLI defaults
- Claude Code: 2.1.273
- Copilot CLI: 1.0.85
- Codex: 0.154.0
- Synced Copilot compatibility and installer fallback metadata.

Scanner images

ZizmorImage = "ghcr.io/zizmorcore/zizmor:1.30.1@sha256:..."
SyftImage   = "anchore/syft:v1.51.1@sha256:..."
GrypeImage  = "anchore/grype:v0.118.0@sha256:..."

Pin coverage
- Updated CLI version expectations, including Copilot CLI.

Fixes [ca] CLI version checker: detected upstream updates for CLI defaults and scanner images #61283

pr-sous-chef branch refresh requested from https://github.com/github/gh-aw/actions/runs/35170906176

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 38.2 AIC · ⊞ 9.1K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/35174719104

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 54.4 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

🟡 Changes recommended

The release changeset and scanner inventory documentation need updating.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Refreshes pinned CLI defaults and scanner images while keeping Copilot compatibility metadata synchronized.

Changes:

Updates Claude Code, Copilot CLI, and Codex defaults.
Refreshes Zizmor, Syft, and Grype image pins.
Aligns Copilot installer and compatibility fallbacks.

File summaries

File	Description
`pkg/constants/version_constants.go`	Updates CLI defaults.
`pkg/constants/version_constants_test.go`	Updates version expectations.
`pkg/cli/docker_images.go`	Refreshes scanner image pins.
`actions/setup/sh/install_copilot_cli.sh`	Updates installer fallback.
`.github/aw/compat.json`	Expands Copilot compatibility.

Review details

Files reviewed: 5/5 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-09-17T02:59:23Z

+	SyftImage        = "anchore/syft:v1.51.1@sha256:95fe0835e5bebc6f8b1f8acef68d47d63d594ef4c0f25c097ff853b23cbac74c"
+	GrypeImage       = "anchore/grype:v0.118.0@sha256:8a93fc48da96bd6ec5981279d099b69de11541dc68fdf222fb9161f8ff284af7"


Addressed in 2792f4b by updating pkg/cli/README.md so the scanner inventory documents Grype v0.118.0 and Syft v1.51.1.

Copilot · 2026-09-17T02:59:24Z


 // DefaultClaudeCodeVersion is the default version of the Claude Code CLI.
-const DefaultClaudeCodeVersion Version = "2.1.266"
+const DefaultClaudeCodeVersion Version = "2.1.273"


Addressed in 2792f4b by adding .changeset/patch-refresh-cli-defaults-scanner-pins.md covering the CLI default and scanner pin refresh.

gh-aw-bot · 2026-09-17T01:42:41Z

pr-sous-chef
@copilot this PR still needs forward progress before a maintainer can investigate quickly. Please update the release changeset and scanner inventory documentation called out in review, refresh the branch if needed, and then run the pr-finisher skill.

Latest blocking review points:

update the release changeset to reflect the CLI default and scanner pin refresh
refresh the scanner inventory documentation so it stays in sync with the new pins and defaults

Run URL: https://github.com/github/gh-aw/actions/runs/35170906176

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 38.2 AIC · ⊞ 9.1K · ◷
_{Comment /souschef to run again}

…efresh Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-17T01:52:44Z

pr-sous-chef
@copilot this PR still needs forward progress before a maintainer can investigate quickly. Please update the release changeset and scanner inventory documentation called out in review, ...

Added a changeset (.changeset/patch-refresh-cli-defaults-scanner-pins.md) covering the CLI/scanner refresh and updated the scanner inventory in pkg/cli/README.md (Grype v0.118.0, Syft v1.51.1). Lock files were recompiled to reflect the new Codex default version.

gh-aw-bot · 2026-09-17T02:40:04Z

@copilot this PR still needs forward progress before a maintainer can investigate quickly. The branch already has follow-up changes for the earlier review, so please request a fresh Copilot review, refresh the branch if needed, and then run the pr-finisher skill.

Previously raised review points that should be re-evaluated:

release changeset coverage for the CLI/scanner refresh
scanner inventory documentation sync with the new pins/defaults

Run URL: https://github.com/github/gh-aw/actions/runs/35174719104

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 54.4 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-17T02:59:23Z

@copilot this PR still needs forward progress before a maintainer can investigate quickly. The branch already has follow-up changes for the earlier review, so please request a fresh Copilot review, re...

Branch is refreshed through 454b356, and the prior review points are already addressed in 2792f4b: the changeset was added and the scanner inventory docs now match the updated pins. I ran the pr-finisher pass and local validation (make fmt, make lint, make test-unit, make test, make recompile); no further code changes were needed.

gh-aw-bot · 2026-09-17T03:02:37Z

pr-sous-chef
@copilot this PR looks close, but it still needs a fresh review pass before a maintainer can investigate quickly. The branch already includes follow-up replies for the changeset and scanner-doc comments, so please request a fresh Copilot review, refresh the branch if needed, and then run the pr-finisher skill.

Previously raised review points to re-check:

release changeset coverage for the CLI/scanner refresh
scanner inventory documentation sync with the updated pins/defaults

Run URL: https://github.com/github/gh-aw/actions/runs/35176271104

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 48.6 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-17T03:19:17Z

pr-sous-chef
@copilot this PR looks close, but it still needs a fresh review pass before a maintainer can investigate quickly. The branch already includes follow-up replies for the changeset and sca...

Branch is already refreshed to current main (290730b, included by 454b356), and the follow-up review replies are in place for both original threads. I reran the pr-finisher validation pass: make fmt, make lint, make test-unit, make test, and make recompile all passed; recompile only produced transient local pin fallback diffs, which I discarded to keep the branch unchanged. I also attempted the available fresh validation hook, but it skipped because there were no new local changes to review.

github-actions · 2026-09-19T03:47:45Z

🎉 This pull request is included in a new release.

Release: v0.89.17

Initial plan

ab95d4d

Copilot AI assigned Copilot and pelikhan Sep 16, 2026

Copilot AI linked an issue Sep 16, 2026 that may be closed by this pull request

[ca] CLI version checker: detected upstream updates for CLI defaults and scanner images #61283

Closed

Copilot started work on behalf of pelikhan September 16, 2026 23:40 View session

Copilot AI and others added 2 commits September 16, 2026 23:44

chore: update CLI and scanner pins

a18bf6b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

chore: update CLI and scanner pins

ab0caf1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update CLI version for defaults and scanner images~~ Refresh CLI defaults and scanner image pins Sep 16, 2026

Copilot finished work on behalf of pelikhan September 16, 2026 23:49

Copilot AI requested a review from pelikhan September 16, 2026 23:49

pelikhan marked this pull request as ready for review September 17, 2026 00:35

Copilot AI balanced review requested due to automatic review settings September 17, 2026 00:35

Copilot started reviewing on behalf of pelikhan September 17, 2026 00:36 View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 17, 2026

[pr-sous-chef] PR Sous Chef run report #61445

Closed

Copilot started work on behalf of gh-aw-bot September 17, 2026 01:43 View session

Add changeset and update scanner inventory docs for CLI/scanner pin r…

2792f4b

…efresh Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 17, 2026 01:52

Copilot AI requested a review from gh-aw-bot September 17, 2026 01:52

Merge branch 'main' into copilot/update-cli-version-checker

454b356

Copilot started work on behalf of gh-aw-bot September 17, 2026 02:44 View session

Copilot finished work on behalf of gh-aw-bot September 17, 2026 02:59

Copilot started work on behalf of gh-aw-bot September 17, 2026 03:02 View session

Copilot finished work on behalf of gh-aw-bot September 17, 2026 03:19

github-actions Bot mentioned this pull request Sep 17, 2026

[pr-review] Daily PR Code Quality Review — 35187015205 #61547

Closed

pelikhan added 2 commits September 16, 2026 23:00

Merge branch 'main' into copilot/update-cli-version-checker

c96f7c1

Merge branch 'main' into copilot/update-cli-version-checker

add2a04

pelikhan merged commit c054206 into main Sep 17, 2026
2 checks passed

pelikhan deleted the copilot/update-cli-version-checker branch September 17, 2026 06:46

github-actions Bot mentioned this pull request Sep 17, 2026

[instructions] Document threat-detection report-as-issue field #61563

Merged

Navigation Menu

Refresh CLI defaults and scanner image pins - #61432

Refresh CLI defaults and scanner image pins#61432
pelikhan merged 7 commits into
mainfrom
copilot/update-cli-version-checker

Copilot AI commented Sep 16, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 17, 2026

Uh oh!

Copilot AI Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		SyftImage = "anchore/syft:v1.51.1@sha256:95fe0835e5bebc6f8b1f8acef68d47d63d594ef4c0f25c097ff853b23cbac74c"
		GrypeImage = "anchore/grype:v0.118.0@sha256:8a93fc48da96bd6ec5981279d099b69de11541dc68fdf222fb9161f8ff284af7"

Conversation

Copilot AI commented Sep 16, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 16, 2026 •

edited by github-actions Bot

Loading