chore: upgrade all workflows to gh-aw v0.68.7#2050
Conversation
- Update gh-aw setup actions to v0.68.7 - Update actions/github-script to v9.0.0 - Update softprops/action-gh-release to v3.0.0 - Pin 17 container images with digest hashes - Run post-processing on all lock files Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Pull request overview
Upgrades the repository’s agentic GitHub Actions workflows to gh-aw v0.68.7, including updated setup actions, pinned container images, and regenerated .lock.yml outputs to match the new compiler/runtime behavior.
Changes:
- Bump gh-aw compiler/setup versions across workflow lock files and refresh pinned action SHAs/container digests.
- Update workflow runtime behavior (e.g., Copilot/Codex execution wiring, new error detection step, base-branch agent config save/restore).
- Regenerate lock manifests and
.github/aw/actions-lock.jsonfor the new action/container pins.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/update-release-notes.lock.yml | Recompiled lock workflow with updated gh-aw/setup pins, container digests, and runtime/script adjustments. |
| .github/workflows/smoke-codex.lock.yml | Recompiled Codex smoke workflow; updates pins and MCP gateway startup/config paths. |
| .github/workflows/security-review.lock.yml | Recompiled daily security review workflow; updates pins and runtime steps. |
| .github/workflows/plan.lock.yml | Recompiled /plan workflow; updates pins and runtime steps. |
| .github/workflows/firewall-issue-dispatcher.lock.yml | Recompiled dispatcher; updates pins and runtime steps (incl. CLI proxy image). |
| .github/workflows/copilot-token-usage-analyzer.lock.yml | Recompiled analyzer; updates pins and runtime steps. |
| .github/workflows/copilot-token-optimizer.lock.yml | Recompiled optimizer; updates pins and runtime steps. |
| .github/workflows/cli-flag-consistency-checker.lock.yml | Recompiled scheduled checker; updates pins and runtime steps. |
| .github/workflows/claude-token-usage-analyzer.lock.yml | Recompiled analyzer; updates pins and runtime steps. |
| .github/workflows/ci-cd-gaps-assessment.lock.yml | Recompiled assessment workflow; updates pins and adds pinned alpine digest. |
| .github/aw/actions-lock.json | Updates pinned action SHAs and adds a container digest map used by workflows. |
| .github/agents/agentic-workflows.agent.md | Updates gh-aw documentation links to v0.68.7. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 31/31 changed files
- Comments generated: 6
| export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --group-add '"${DOCKER_SOCK_GID}"' -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e TAVILY_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.2.22' | ||
|
|
||
| cat > /tmp/gh-aw/mcp-config/config.toml << GH_AW_MCP_CONFIG_60f188872c24321c_EOF | ||
| cat > "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_60f188872c24321c_EOF |
There was a problem hiding this comment.
The Codex MCP config is being written to ${RUNNER_TEMP}/gh-aw/mcp-config/config.toml, but later the job sets CODEX_HOME=/tmp/gh-aw/mcp-config and runs codex ... without explicitly pointing it at this config file. If Codex resolves its config relative to CODEX_HOME (common behavior), it won’t find the generated config and MCP integration may silently break. Write the config into $CODEX_HOME/config.toml (or align CODEX_HOME to the RUNNER_TEMP path / explicitly pass the config path to Codex).
| cat > "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_60f188872c24321c_EOF | |
| cat > "/tmp/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_60f188872c24321c_EOF |
| # roles: all # Roles processed as role check in pre-activation job | ||
| schedule: | ||
| - cron: "23 */12 * * *" | ||
| - cron: "34 */12 * * *" |
There was a problem hiding this comment.
This cron schedule changed (previously a different minute/hour). Since this PR is described as a version upgrade, please confirm the new run time is intentional; otherwise keep the prior cron expression to avoid shifting when the workflow executes.
| "on": | ||
| schedule: | ||
| - cron: "41 12 * * *" | ||
| - cron: "42 12 * * *" |
There was a problem hiding this comment.
This cron schedule changed (previously a different minute). Please confirm the new run time is intentional; otherwise keep the prior cron expression to avoid unexpected shifts in when this daily security workflow runs.
| "on": | ||
| schedule: | ||
| - cron: "39 22 * * *" | ||
| - cron: "9 10 * * *" |
There was a problem hiding this comment.
This cron schedule changed significantly (previously a different time of day). Please confirm the new run time is intentional; otherwise keep the prior cron expression so the analyzer continues to run at the expected time.
| "on": | ||
| schedule: | ||
| - cron: "49 22 * * *" | ||
| - cron: "29 12 * * *" |
There was a problem hiding this comment.
This cron schedule changed significantly (previously a different time of day). Since this PR is primarily a gh-aw version upgrade, please confirm the new run time is intentional; otherwise keep the prior cron to avoid unexpected shifts in reporting cadence.
| "on": | ||
| schedule: | ||
| - cron: "20 */6 * * *" | ||
| - cron: "11 */6 * * *" |
There was a problem hiding this comment.
This cron schedule changed (previously a different minute). Please confirm this is intentional; otherwise keep the prior cron expression to avoid shifting when the dispatcher runs.
The gh-aw compiler pins v1.0.21 but the latest release is v1.0.31. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Smoke Test Results ✅ PASS
|
🔥 Smoke Test: Copilot BYOK (Offline) — PASS ✅
Running in BYOK offline mode (
|
🔥 Smoke Test Results — Copilot EnginePR: chore: upgrade all workflows to gh-aw v0.68.7 (by @lpcox, no assignees)
Overall: PARTIAL PASS — GitHub.com and file I/O verified; MCP tool not available.
|
Smoke Test: GitHub Actions Services Connectivity ✅All checks passed:
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Smoke Test ReportPR titles: "Fix BYOK smoke workflow COPILOT_MODEL fallback override in postprocessing"; "fix: allow package.json/lock in dep security monitor PRs"
|
Summary
Upgrades all agentic workflows to gh-aw v0.68.7.
Changes
Post-processing applied
env.COPILOT_MODEL)