Bump MCP Gateway to v0.4.25 by Copilot · Pull Request #61661 · github/gh-aw

Copilot · 2026-09-17T19:24:21Z

Upgrades the pinned MCP Gateway (gh-aw-mcpg) Docker image from v0.4.23 to v0.4.25.

Version constant

DefaultMCPGatewayVersion → v0.4.25 in pkg/constants/version_constants.go, with the matching expectation in version_constants_test.go.

Container pin

.github/aw/actions-lock.json container pin replaced with the immutable digest for the new tag, and synced to pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json:

ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086

Regenerated workflows

All 299 .lock.yml files recompiled so manifests, download_docker_images.sh arguments, and MCP_GATEWAY_DOCKER_COMMAND reference the new pinned image.

Changeset

.changeset/upgrade-gh-aw-mcpg-v0-4-25.md (patch).

Minimum-version gates (MCPGIntegrityReactionsMinVersion, MCPGEnclave*MinVersion, MCPGDynamicRepositoryDelegationMinVersion) are unchanged — no new capability gates in this release.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.26 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The update spans 299 regenerated workflow locks, warranting final human review.

Pull request overview

Bumps the MCP Gateway image from v0.4.23 to v0.4.25 with a refreshed immutable digest and regenerated workflow locks.

Changes:

Updated version constants and pin data.
Regenerated reviewed workflow lockfiles.
Added a patch changeset.

File summaries

File	Summary
`pkg/workflow/data/action_pins.json`	Updated workflow container pin.
`pkg/constants/version_constants.go`	Bumped default gateway version.
`pkg/constants/version_constants_test.go`	Updated version expectation.
`pkg/actionpins/data/action_pins.json`	Updated embedded container pin.
`.github/workflows/windows.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/smoke-copilot-small.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/schema-feature-coverage.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/github-remote-mcp-auth-test.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/firewall.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/draft-pr-cleanup.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-team-status.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-squid-image-scan.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-spec-coverage-kiro.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-schema-audit-cursor.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-regression-audit-kiro.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-pr-review-cursor.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-github-docs-seo-optimizer.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/daily-community-attribution.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/copilot-pr-merged-report.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Regenerated with the new gateway pin.
`.github/workflows/breaking-change-checker.lock.yml`	Regenerated with the new gateway pin.
`.github/aw/actions-lock.json`	Updated immutable container digest.
`.changeset/upgrade-gh-aw-mcpg-v0-4-25.md`	Added patch changeset.

Review details

Files reviewed: 69/305 changed files
Comments generated: 0
Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-17T19:34:19Z

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-09-17T19:34:26Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch PR file list

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-09-17T19:34:31Z

✅ Ponytail Reviewer completed successfully!

Cannot run ponytail review: /tmp/gh-aw/agent/pr-diff.patch is empty (0 bytes), so there is no diff to review.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #61661

github-actions · 2026-09-17T19:35:06Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-09-17T19:35:38Z

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

No ADR enforcement needed: PR does not have the 'implementation' label and has <=100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

gh-aw-bot · 2026-09-17T19:36:10Z

@copilot This PR looks blocked on maintainer follow-up rather than active checks. Please review the current feedback, refresh the branch if needed, and run the pr-finisher skill to move this over the line.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 10.3 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

github-actions

Skills-Based Review 🧠

This is a mechanical dependency bump (MCP Gateway v0.4.23 → v0.4.25): version constant, container digest pin (synced across both action_pins.json copies), changeset, and 299 regenerated .lock.yml files. No application logic, control flow, or test-relevant behavior changed, so /diagnosing-bugs, /tdd, and /codebase-design don't surface actionable findings here.

📋 Verification performed

DefaultMCPGatewayVersion in pkg/constants/version_constants.go and its test expectation both updated to v0.4.25.
Digest sha256:9be0a862... is identical across .github/aw/actions-lock.json, pkg/actionpins/data/action_pins.json, and pkg/workflow/data/action_pins.json.
No stale v0.4.23 references remain in any .lock.yml file (checked all 299).
Changeset present and correctly scoped as patch.

No blocking issues found.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 39 AIC · ⌖ 14.9 AIC · ⊞ 10.6K
_{Comment /matt to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-17T19:53:12Z

@copilot This PR looks blocked on maintainer follow-up rather than active checks. Please review the current feedback, refresh the branch if needed, and run the pr-finisher skill to move this over th...

Addressed in b3cdf9d: sorted the action lock containers entries in .github/aw/actions-lock.json and the embedded pin data, which fixes the reproduced TestActionsLockJSONFieldsAreSorted/root_actions_lock failure. Local validation passed (make fmt, make lint, make test-unit, make test, make recompile, and final make agent-report-progress).

gh-aw-bot · 2026-09-17T20:50:30Z

@copilot The latest push addressed the previous sous-chef nudge, but this PR still appears blocked on maintainer follow-up. Please review any remaining feedback, refresh the branch if needed, and run the pr-finisher skill to help move it to a maintainer-ready state.

Failed checks to review:

PR Code Quality Reviewer: https://github.com/github/gh-aw/actions/runs/35264766613
Design Decision Gate 🏗️: https://github.com/github/gh-aw/actions/runs/35264766547

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 10 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-17T21:03:50Z

@copilot The latest push addressed the previous sous-chef nudge, but this PR still appears blocked on maintainer follow-up. Please review any remaining feedback, refresh the branch if needed, and run ...

Ran the pr-finisher pass on the current head b3cdf9d. No review threads remain, the branch is up to date with origin/main, and the working tree is clean. Local validation passed: make fmt, make lint, make test-unit, make test, and make recompile.

The listed Design Decision Gate run is successful on attempt 2. The PR Code Quality Reviewer failure is from the earlier head 04a85d6 and appears stale after b3cdf9d fixed the reproduced sorted-lock failure; it needs a maintainer-triggered CI rerun to verify the current head.

github-actions · 2026-09-19T03:47:25Z

🎉 This pull request is included in a new release.

Release: v0.89.17

Bump MCP Gateway to v0.4.25 and recompile workflows

04a85d6

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI assigned Copilot and lpcox Sep 17, 2026

Copilot created this pull request from a session on behalf of lpcox September 17, 2026 19:24 View session

lpcox marked this pull request as ready for review September 17, 2026 19:25

Copilot AI balanced review requested due to automatic review settings September 17, 2026 19:25

Copilot started reviewing on behalf of lpcox September 17, 2026 19:25 View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 17, 2026

[pr-sous-chef] PR Sous Chef run report #61445

Closed

Copilot started work on behalf of gh-aw-bot September 17, 2026 19:36 View session

github-actions Bot added the needs-review label Sep 17, 2026

github-actions Bot approved these changes Sep 17, 2026

View reviewed changes

Sort action lock container pins

b3cdf9d

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 17, 2026 19:53

Copilot AI requested a review from gh-aw-bot September 17, 2026 19:53

Copilot started work on behalf of gh-aw-bot September 17, 2026 20:50 View session

github-actions Bot mentioned this pull request Sep 17, 2026

[Contribution Check Report] Contribution Check — 2026-09-17 #61488

Closed

Copilot finished work on behalf of gh-aw-bot September 17, 2026 21:04

pelikhan merged commit 6db2a82 into main Sep 17, 2026
34 checks passed

pelikhan deleted the copilot/bump-mcpg-version-0425 branch September 17, 2026 22:19

github-actions Bot mentioned this pull request Sep 21, 2026

[blog] Weekly blog post – 2026-09-21 #62294

Merged

Navigation Menu

Bump MCP Gateway to v0.4.25 - #61661

Bump MCP Gateway to v0.4.25#61661
pelikhan merged 2 commits into
mainfrom
copilot/bump-mcpg-version-0425

Copilot AI commented Sep 17, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Copilot AI commented Sep 17, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version constant

Container pin

Regenerated workflows

Changeset

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Sep 17, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading