chore: upgrade all workflows to gh-aw v0.75.4 by lpcox · Pull Request #3792 · github/gh-aw-firewall

lpcox · 2026-05-25T18:07:15Z

Summary

Upgrades all 35 agentic workflows from compiler v0.74.4/v0.74.8 to v0.75.4.

Changes

Codemod fixes (gh aw fix --write):

doc-maintainer.md: Move 2 step-run ${{ }} expressions into env: bindings
security-guard.md: Move 1 step-run expression into env: binding
smoke-claude.md: Move step-run expressions into env: bindings

These changes prevent template injection by ensuring GitHub Actions expressions are never interpolated directly in shell code.

Recompiled lock files (35 workflows):

All lock files upgraded to compiler v0.75.4
Updated gh-aw-actions/setup pinned SHA to v0.75.4
Net reduction of ~1000 lines (compiler optimizations)

Agent routing updates (.github/agents/agentic-workflows.agent.md):

Version references updated from v0.72.1 → v0.75.4
Added routing for: asciicharts, token-optimization, patterns guides

Test update:

scripts/ci/smoke-claude-workflow.test.ts: Updated SHA assertion to match v0.75.4

- Run gh aw fix --write: moves step-run ${{ }} expressions into env bindings (template injection prevention) for 3 workflows - Recompile all 35 workflows with compiler v0.75.4 - Update agent.md to reference v0.75.4 URLs and new routing capabilities (asciicharts, token-optimization, patterns guides) - Update smoke-claude test to match new gh-aw-actions/setup SHA Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-25T18:08:39Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.54%	96.58%	📈 +0.04%
Statements	96.38%	96.42%	📈 +0.04%
Functions	97.99%	97.99%	➡️ +0.00%
Branches	90.78%	90.82%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/config-writer.ts`	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Upgrades the repository’s agentic GitHub Actions workflows to gh-aw compiler v0.75.4, including regenerated .lock.yml outputs and targeted codemod changes that move ${{ }} expressions out of shell scripts to reduce template-injection risk.

Changes:

Recompiled multiple workflow .lock.yml files with compiler v0.75.4 (updated pinned action SHAs / metadata).
Codemod updates to .md workflow sources to bind expressions via env: instead of interpolating them directly in run: scripts.
Updated CI assertion(s) and action pin metadata to match the new gh-aw-actions/setup SHA/version.

Show a summary per file

File	Description
scripts/ci/smoke-claude-workflow.test.ts	Updates expected gh-aw-actions/setup pinned SHA/version assertions for v0.75.4.
.github/workflows/smoke-otel-tracing.lock.yml	Regenerated lock workflow with v0.75.4 metadata and updated setup/action pins and runtime env.
.github/workflows/smoke-gemini.lock.yml	Regenerated lock workflow with updated setup/action pins and regenerated sections.
.github/workflows/smoke-copilot.lock.yml	Regenerated lock workflow with updated setup/action pins and updated agent execution wiring.
.github/workflows/smoke-claude.md	Moves `${{ }}` usage from shell into `env:` bindings to avoid expression interpolation in `run:`.
.github/workflows/security-guard.md	Moves `${{ }}` usage from shell into `env:` bindings for output setting.
.github/workflows/refactoring-scanner.lock.yml	Regenerated lock workflow with updated setup/action pins and regenerated sections.
.github/workflows/duplicate-code-detector.lock.yml	Regenerated lock workflow with updated setup/action pins and regenerated sections.
.github/workflows/doc-maintainer.md	Moves `${{ }}` usage from shell conditionals into `env:` bindings.
.github/workflows/dependency-security-monitor.lock.yml	Regenerated lock workflow with updated setup/action pins and regenerated sections.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Regenerated lock workflow with updated setup/action pins and updated compiler version references.
.github/workflows/agentics-maintenance.yml	Updates setup/setup-cli pins and header generator version to v0.75.4.
.github/aw/actions-lock.json	Updates pinned gh-aw-actions entries for v0.75.4 and adds gh-aw/actions/setup-cli v0.75.4.
.github/agents/agentic-workflows.agent.md	Updates routing/docs links to v0.75.4 and adds new routing entries (asciicharts/token-optimization/patterns).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 30/42 changed files
Comments generated: 2

+          sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro"  --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
+            -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log


+    env:
+      EXPR_GITHUB_EVENT_NAME: ${{ github.event_name }}
+      EXPR_GITHUB_RUN_ID: ${{ github.run_id }}
+      EXPR_b14517fc: ${{ github.event.pull_request.number || '' }}
    run: |


Remove sandbox.agent.version pins (v0.25.29/v0.25.41/v0.25.51) from all 35 workflow .md files. The compiler now resolves to the latest available version (v0.25.53) instead of a hardcoded version that may not exist in the registry. This fixes the CI 404 error when install_awf_binary.sh tries to download a version that hasn't been published to the release artifacts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Apply postprocess-smoke-workflows.ts to replace 'Install AWF binary' download steps with local npm ci + npm run build steps. This ensures CI tests the repo's own code instead of a released binary, avoiding 404 errors when pinned versions don't exist in releases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The Tavily MCP server bearer token has expired, causing the MCP Gateway to report unhealthy status and Codex to crash on startup with exit code 1 after 4 retry attempts. Remove the tavily import and associated test requirement until the token is rotated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-25T18:54:36Z

Smoke Test (Claude): ✅ PASS

✅ GitHub API: 2 recent PRs fetched (Standardize JSONL log envelopes across AWF runtime logs #3790, Update ghs_ token detection/redaction for stateless JWT format #3786)
✅ GitHub check (playwright): PASS
✅ File verify: smoke-test-claude-26415291487.txt present

All checks passed.

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-25T18:54:39Z

Smoke Test: Copilot BYOK — @lpcox

✅ GitHub MCP: PR fetched successfully
✅ GitHub.com connectivity: HTTP 200/301
✅ File write/read: smoke-test-copilot-byok-26415291523.txt confirmed
✅ BYOK inference: responding via api-proxy → api.githubcopilot.com

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-25T18:54:51Z

🔬 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅	`otel.js` loads cleanly; exports: `startRequestSpan`, `setTokenAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`
2. Test Suite	✅	33/33 tests passed in `otel.test.js`
3. Env Var Forwarding	✅	`api-proxy-service.ts` forwards `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`
4. Token Tracker Integration	✅	`onUsage` callback exists in `token-tracker-http.js` (line 237) as the OTEL hook point
5. OTEL Diagnostics	✅	Graceful degradation confirmed: falls back to `/var/log/api-proxy/otel.jsonl` when `OTEL_EXPORTER_OTLP_ENDPOINT` is unset; no errors

All scenarios pass. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-05-25T18:55:16Z

🔍 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ (fetched PR #3790: "Standardize JSONL log envelopes across AWF runtime logs")
GitHub.com HTTP connectivity	❌ (template vars not substituted — pre-step data unavailable)
File write/read	❌ (template vars not substituted — pre-step data unavailable)

Overall: FAIL — pre-computed smoke data was not passed to this step.

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-25T18:55:39Z

Smoke test results: ❌ GitHub connectivity, ❌ PR list, ✅ File write, ✅ Bash tool. FAIL.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-05-25T18:56:30Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.15.0	v22.22.3	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all versions match — Python and Node.js differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-05-25T18:57:06Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3792 · sonnet46 1.1M · ◷

github-actions · 2026-05-25T18:57:23Z

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ connection timed out
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ connection timed out

Overall: FAIL — host.docker.internal (172.17.0.1) is not reachable from this environment. Service containers may not be running or the host route is blocked.

🔌 Service connectivity validated by Smoke Services

Copilot AI review requested due to automatic review settings May 25, 2026 18:07

Copilot started reviewing on behalf of lpcox May 25, 2026 18:07 View session

This was referenced May 25, 2026

[aw] Smoke Gemini failed #3794

Closed

[aw] Smoke Claude failed #3795

Closed

[aw] Smoke Copilot BYOK failed #3796

Closed

[aw] Build Test Suite failed #3797

Closed

[aw] Smoke Codex failed #3798

Closed

[aw] Smoke Copilot failed #3799

Closed

github-actions Bot mentioned this pull request May 25, 2026

[aw] Smoke Services failed #3800

Closed

Copilot AI reviewed May 25, 2026

View reviewed changes

github-actions Bot added the smoke-claude label May 25, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot-byok label May 25, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 25, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot label May 25, 2026

This comment has been minimized.

Sign in to view

lpcox merged commit e91874b into main May 25, 2026
67 of 69 checks passed

lpcox deleted the chore/upgrade-workflows-v0.75.4 branch May 25, 2026 18:59

lpcox mentioned this pull request May 25, 2026

api-proxy: stream_options.include_usage injected into OpenAI Responses API requests #3804

Closed

Copilot AI mentioned this pull request May 25, 2026

fix(api-proxy): prevent stream_options injection into OpenAI Responses API requests #3805

Merged

github-actions Bot mentioned this pull request May 25, 2026

[aw] No-Op Runs #2911

Open

		sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
		-- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null \| tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" \|\| true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] \|\| [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null \|\| true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 \| tee -a /tmp/gh-aw/agent-stdio.log

Conversation

lpcox commented May 25, 2026

Summary

Changes

Uh oh!

github-actions Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented May 25, 2026

Smoke Test (Claude): ✅ PASS

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

🔬 Smoke Test: API Proxy OpenTelemetry Tracing

Uh oh!

github-actions Bot commented May 25, 2026

🔍 Smoke Test Results

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Chroot Smoke Test Results

Uh oh!

github-actions Bot commented May 25, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 25, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented May 25, 2026 •

edited

Loading