updated workflows

[lpcox]

No description provided.

[github-actions]

✅ Smoke Claude passed

[github-actions]

✅ Contribution Check completed successfully!

[Copilot]

Pull request overview

Regenerates workflow locks with the newer gh-aw toolchain and updates applicable workflows to AWF v0.27.33.

Changes:

• Updates gh-aw setup actions and compiler metadata.
• Upgrades AWF images and adds evaluation usage artifacts.
• Removes obsolete Crush configuration restoration.

Show a summary per file

File	Description
.github/workflows/test-coverage-reporter.lock.yml	Refreshes generated coverage workflow.
.github/workflows/smoke-gemini.lock.yml	Refreshes Gemini smoke workflow.
.github/workflows/network-isolation-test.lock.yml	Updates generated isolation test infrastructure.
.github/workflows/firewall-issue-dispatcher.lock.yml	Refreshes issue dispatcher workflow.
.github/workflows/duplicate-code-detector.lock.yml	Refreshes duplicate-code analysis workflow.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Refreshes Copilot usage analysis.
.github/workflows/contribution-check.lock.yml	Refreshes contribution checks.
.github/workflows/claude-token-usage-analyzer.lock.yml	Refreshes Claude usage analysis.
.github/workflows/build-test-network-isolation.lock.yml	Updates generated network-isolation build tests.
.github/workflows/agentics-maintenance.yml	Updates maintenance action pins.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 34/58 changed files
• Comments generated: 7
• Review effort level: Medium

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

✅ Build Test Suite completed successfully!

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🔌 Smoke Services — All services reachable! ✅

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

[github-actions]

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

[github-actions]

✅ Smoke Gemini completed. All facets verified. 💎

[github-actions]

✅ Contribution Check completed successfully!

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

Smoke Test: Claude Engine Validation

Overall result: ✅ PASS

Check	Status
API	✅ PASS
GH	✅ PASS
File	✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6276 · 55.4 AIC · ⊞ 5.9K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub MCP connectivity
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference path

Status: PASS — Running in direct BYOK mode via api-proxy → api.githubcopilot.com

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Thanks for keeping the generated workflows up to date. Per CONTRIBUTING.md → Pull Request Process → Pull request requirements, please expand the PR description beyond "updated workflows" to explain what changed and why, and reference any related issue (or explicitly state that none applies). Because this updates CI workflow behavior, please also summarize the relevant validation/CI impact; no separate source-code tests appear necessary for the generated lock-file changes themselves.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Contribution Check for #6276 · 5.24 AIC · ⊞ 19.2K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP	✅ MCP connectivity verified
GitHub.com HTTP	⚠️ pre-step data unavailable (template vars not interpolated)
File write/read	⚠️ pre-step data unavailable (template vars not interpolated)

Overall: PARTIAL — MCP confirmed; pre-step outputs missing.
Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

[github-actions]

updated workflows\n✅ Last 2 merged PRs queried\n⚠️ Playwright tooling unavailable in this environment\n✅ File write + cat verified\n✅ Build passed\nOverall status: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

🔬 Smoke Test Results

Test	Result
GitHub MCP	✅
GitHub.com HTTP	✅ 200
File Write/Read	⚠️ template not expanded

Overall: PASS — core connectivity confirmed.

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test Results

• Redis PING: ❌ (host.docker.internal name resolution failed)
• PostgreSQL pg_isready: ❌ (no response)
• PostgreSQL SELECT 1: ❌ (host not reachable)

Overall: FAIL — Service containers are unreachable (DNS for host.docker.internal fails; Docker bridge 172.17.0.1 also unreachable).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.18.0	v22.23.1	❌
Go	go1.22.12	go1.22.12	✅

Result: Not all tests passed — Python and Node.js versions differ between host and chroot.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6276 · 37.7 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

@lpcox

• GitHub MCP Testing (pre-fetched data validated): ✅
• GitHub.com connectivity: ✅
• File Write/Read Test: ✅
• BYOK Inference Test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

[github-actions]

OTEL Smoke Test Results

Scenario	Result	Notes
1. Module Loading	✅	otel.js loads successfully; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled
2. Test Suite	✅	59 tests passed across otel.test.js + otel-fanout.test.js (2 suites)
3. Env Var Forwarding	✅	api-proxy-env-config.ts forwards all OTEL vars: GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID, OTEL_SERVICE_NAME
4. Token Tracker Integration	✅	onUsage callback exists in token-tracker-http.js (line 343) as the OTEL hook point
5. OTEL Diagnostics	✅	File fallback exporter (/var/log/api-proxy/otel.jsonl) configured; OTLP export routes through Squid proxy when endpoint env vars are set

All scenarios pass. OTEL tracing integration is functioning correctly.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

🔥 Smoke Test: Docker Sbx Validation

Test	Result
GitHub MCP Connectivity	✅ Connected (items filtered by policy)
GitHub.com HTTP	✅ HTTP 200
File Write/Read	⚠️ Template vars not expanded (pre-step issue)
Pre-Fetched PR Data	⚠️ Template vars not expanded (pre-step issue)

Overall: PARTIAL PASS — Core connectivity checks passed; pre-computed step outputs were not injected into the prompt (template substitution issue in workflow).

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Gemini Engine Validation

• GitHub MCP Testing: ❌ (Tools not found)
• GitHub.com Connectivity: ❌ (Status 000)
• File Writing Testing: ✅
• Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}