Bump gh-aw-firewall to v0.28.50 by Copilot · Pull Request #67035 · github/gh-aw

Copilot · 2026-10-09T00:06:47Z

Update gh-aw’s pinned firewall release to v0.28.50, which fixes --env-all handling for paths under unmounted RUNNER_TEMP subtrees.

Version pin: Set DefaultFirewallVersion to v0.28.50 and update its test.
Generated workflows: Refresh compiled lockfiles to use the new firewall image.
Release metadata: Add a patch changeset.

Fixes Bump gh-aw-firewall to v0.28.50 #67029

✨ PR Review Safe Output Test - Run 37864205681

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

clients2.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "clients2.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · claude · sonnet46 · 64.9 AIC · ⌖ 4.14 AIC · ⊞ 853 · ◷
_{Comment /smoke-claude to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

clients2.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "clients2.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · claude · sonnet46 · 64.9 AIC · ⌖ 4.14 AIC · ⊞ 853
_{Comment /smoke-claude to run again}

github-actions · 2026-10-09T00:32:17Z

@@ -0,0 +1,5 @@
+---


✅ Changeset file looks good! The patch bump format is correct.

The changeset remains a patch bump for gh-aw; no adjustment was needed. The generated lockfiles now retain immutable v0.28.50 firewall image digests in baa13b7.

github-actions · 2026-10-09T00:32:17Z

+"gh-aw": patch
+---
+
+Upgrade gh-aw-firewall to v0.28.50.


Clear and concise description of the firewall version upgrade. 👍

The version-upgrade description remains concise and accurate. I restored the firewall image digest pins across the generated lockfiles in baa13b7.

Copilot

🔵 Needs a closer look

The generated workflows lost digest pins for all gh-aw-firewall containers, creating a supply-chain regression.

0 open findings

What changed in this PR

Updates gh-aw’s default firewall from v0.28.49 to v0.28.50 for corrected --env-all handling.

Changes:

Updates the firewall constant, test, and patch changeset.
Regenerates 333 workflow lockfiles for v0.28.50.
Upstream introduces no related schema changes.

Blocking finding: Every regenerated lockfile records unresolved container pins and uses mutable firewall tags.

File	Description
`pkg/constants/version_constants.go`	Bumps the default firewall version.
`pkg/constants/version_constants_test.go`	Updates the expected version.
`.changeset/patch-bump-awf-v0-28-50.md`	Adds patch release metadata.
`.github/workflows/*.lock.yml` (333 files)	Regenerates workflows for v0.28.50; firewall image pins remain unresolved.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-10-09T00:53:41Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch PR file list

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-09T00:53:42Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

PR #67035 is a routine version bump (gh-aw-firewall v0.28.50): the only human-authored files are the version constant + test (not shown in diff, excluded as it matched no diff hunks) and a changeset entry, plus 99 auto-generated .lock.yml files from recompilation. No custom logic, architecture change, or test gap exists to apply Matt Pocock skills against. The changeset already has two positive automated review comments. Skipping further review — nothing actionable to add.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-09T00:53:42Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR #67035 does not have the implementation label (has_implementation_label=false) and has 0 new lines of code in default business logic directories (default_business_additions=0, threshold=100, requires_adr_by_default_volume=false).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-09T00:53:42Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-09T00:53:43Z

✅ Ponytail Reviewer completed successfully!

Pre-fetched PR diff is empty; no changed lines were available for the requested over-engineering review.

Generated by Ponytail Reviewer for #67035

github-actions

Request changes

This bump moves the default AWF version to a tag whose container images are still unresolved, so the regenerated lockfiles drop immutable firewall image pins.

Blocking theme

The generated lockfiles now carry resolution_failures for ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid}:0.28.50 and compile bare image tags instead of @sha256 pins.
That turns a routine version bump into a reproducibility and supply-chain regression across hundreds of workflows.

Please publish/resolution-check the 0.28.50 images first, then rerun the full double recompile so the lockfiles are pinned again.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 52.2 AIC · ⌖ 8.01 AIC · ⊞ 19.4K
_{Comment /review to run again}

github-actions · 2026-10-09T00:59:35Z

@@ -68,7 +68,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.12.2"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.28.49"
+const DefaultFirewallVersion Version = "v0.28.50"


Bumping DefaultFirewallVersion to v0.28.50 before the firewall images are digest-resolvable breaks lockfile pinning across the regenerated workflows.

💡 Why this blocks merge

git grep 'resolution_failures' HEAD -- .github/workflows/*.lock.yml now finds 333 lockfiles recording container_pin_not_found for the AWF agent, api-proxy, and squid images, and the generated download_docker_images.sh steps use bare :0.28.50 tags instead of @sha256-pinned refs.

That is a real reproducibility and supply-chain regression: workflows built from this change stop using immutable AWF image pins and start pulling whatever happens to be published under that tag. Please wait until the 0.28.50 images can be resolved to digests, then rerun the double recompile so the lockfiles are pinned again.

@copilot address this review feedback

Added and verified digest pins for the agent, api-proxy, squid, and cli-proxy images, then regenerated the workflow lockfiles. Fixed in baa13b7.

Addressed in baa13b7: all v0.28.50 firewall image roles used by the workflows now have immutable SHA-256 pins.

Addressed: the firewall image digests are in the action pin cache and all generated workflow lockfiles were refreshed in baa13b7.

lpcox · 2026-10-09T01:48:22Z

@copilot run the pr-finisher skill

Doe

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-09T02:13:08Z

@copilot run the pr-finisher skill

Ran the pr-finisher pass and pushed baa13b7, restoring digest pins across the generated lockfiles. Local formatting, lint, and impacted tests passed; CI needs a human re-trigger after this push. The prior govulncheck failure on Go 1.26.8 remains.

gh-aw-bot · 2026-10-09T02:51:18Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: baa13b7
Sous-chef work:
Sous-chef state: 7447148aabef72a7906809a708a96a36ee7fd396a93236b23893943277e3fc2d

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 5.01 AIC · ⌖ 7.7 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

…rewall-v0-28-50 # Conflicts: # .github/workflows/eslint-factory-dispatcher.lock.yml # .github/workflows/eslint-miner.lock.yml # .github/workflows/eslint-monster.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan · 2026-10-09T03:14:15Z

@copilot resolve the merge conflicts on this branch.

Copilot · 2026-10-09T03:17:26Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged the latest main in df650ad and regenerated the workflow locks; v0.28.50 digest pins are preserved. Formatting, lint, and the impacted test gate pass. The existing review threads already have substantive Copilot replies, but this environment has no thread-resolution control. CI needs a maintainer re-trigger; I did not trigger it.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…rewall-v0-28-50 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-09T03:33:22Z

@copilot resolve the merge conflicts on this branch.

Merged the latest main (c268866) in 1d704f8. make merge-main completed, regenerated all 333 workflow locks, and left no merge conflicts; formatting, lint, and impacted tests passed.

github-actions · 2026-10-09T15:49:26Z

🎉 This pull request is included in a new release.

Release: v0.91.7

Initial plan

255050d

Copilot AI assigned Copilot and lpcox Oct 9, 2026

Copilot started work on behalf of lpcox October 9, 2026 00:07 View session

Copilot AI linked an issue Oct 9, 2026 that may be closed by this pull request

Bump gh-aw-firewall to v0.28.50 #67029

Open

Bump gh-aw-firewall to v0.28.50

4c649e2

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update gh-aw to use gh-aw-firewall v0.28.50~~ Bump gh-aw-firewall to v0.28.50 Oct 9, 2026

Copilot finished work on behalf of lpcox October 9, 2026 00:21

Copilot AI requested a review from lpcox October 9, 2026 00:21

github-actions Bot mentioned this pull request Oct 9, 2026

Smoke Test: Claude - 37864205681 #67049

Closed

github-actions Bot reviewed Oct 9, 2026

View reviewed changes

lpcox marked this pull request as ready for review October 9, 2026 00:37

Copilot AI balanced review requested due to automatic review settings October 9, 2026 00:37

Copilot started reviewing on behalf of lpcox October 9, 2026 00:38 View session

Copilot AI reviewed Oct 9, 2026

View reviewed changes

github-actions Bot previously requested changes Oct 9, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 9, 2026

[aw] No-Op Runs #65943

Open

Copilot started work on behalf of lpcox October 9, 2026 01:12 View session

Copilot finished work on behalf of lpcox October 9, 2026 01:17

Copilot started work on behalf of lpcox October 9, 2026 01:27 View session

Copilot finished work on behalf of lpcox October 9, 2026 01:31

Copilot started work on behalf of lpcox October 9, 2026 01:49 View session

github-actions Bot mentioned this pull request Oct 9, 2026

[pr-sous-chef] PR Sous Chef 🍳 – Nudges Posted #67031

Closed

Restore firewall image digest pins

baa13b7

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 9, 2026 02:14

Copilot started work on behalf of gh-aw-bot October 9, 2026 02:52 View session

Copilot finished work on behalf of gh-aw-bot October 9, 2026 03:17

Copilot AI requested a review from gh-aw-bot October 9, 2026 03:17

Copilot started work on behalf of pelikhan October 9, 2026 03:18 View session

Copilot AI and others added 2 commits October 9, 2026 03:24

Plan latest main conflict resolution

9b47d9c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into copilot/bump-gh-aw-fi…

1d704f8

…rewall-v0-28-50 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 9, 2026 03:33

Copilot AI requested a review from pelikhan October 9, 2026 03:33

pelikhan merged commit 6974432 into main Oct 9, 2026
3 checks passed

Conversation

Copilot AI commented Oct 9, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Request changes

Uh oh!

github-actions Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox commented Oct 9, 2026

Uh oh!

Copilot AI commented Oct 9, 2026

Uh oh!

gh-aw-bot commented Oct 9, 2026

Uh oh!

pelikhan commented Oct 9, 2026

Uh oh!

Copilot AI commented Oct 9, 2026

Uh oh!

Copilot AI commented Oct 9, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Copilot AI commented Oct 9, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading