threat-detection: bump external detector pin to threat-detect v0.4.* (Wait for v0.4.* to pass local smokes)

[davidslater]

Created by GitHub Ace · View Session

Context

github/gh-aw-threat-detection shipped v0.4.0. gh-aw still pins the external detector binary to v0.3.0:

// pkg/constants/version_constants.go:179
const DefaultThreatDetectVersion Version = "v0.3.0"

Every other item in this workstream depends on behavior that only exists in v0.4.0, so this lands first.

What v0.4.0 adds that gh-aw needs

Upstream PR	Capability
#750	ERR_VALIDATION warnings for degraded/missing inputs — makes silent degradation loud
#752	conclude distinguishes engine failures from real findings; emits <!-- gh-aw-threat-engine-error --> and a "Threat Detection Engine Failure" block, mirroring gh-aw #49527 / #49497
#751	Detector honors GH_AW_DETECTION_CONTINUE_ON_ERROR for missing artifacts (mirrors gh-aw #49415)
#760	Stops flagging gh-aw safe-outputs scaffolding as prompt injection — false-positive fix
#741	Publishes threat-detect-darwin-x64 / threat-detect-darwin-arm64 assets

Also in v0.4.0 (from earlier PRs referenced by the parity tracker): --detection-log, --log-file, --step-summary, --workflow-name, --workflow-description, --custom-prompt, --custom-prompt-file, and full conclude diagnostics.

The darwin assets matter directly: actions/setup/sh/install_threat_detect_binary.sh already has an install_darwin_binary() branch (lines 153-179) that mapped to assets that did not exist before v0.4.0. Any workflow combining threat-detection.runs-on: macos-* with features: gh-aw-detection: true got an opaque 404 at install time. Bumping the pin fixes that with no installer change.

Scope

• Set DefaultThreatDetectVersion to v0.4.0 in pkg/constants/version_constants.go.
• make recompile and review the .lock.yml diff (install step version + checksum flow only).
• Confirm existing threat-detection compiler tests still pass (pkg/workflow/threat_detection_*_test.go).

Risk

Low, but non-zero: v0.4.0 changes conclude output rendering for tooling failures. Because actions/setup/sh/conclude_threat_detection.sh currently short-circuits both the skip and missing-result branches (see the delegation issue in this workstream), the new rendering is only reachable on the happy path today, which limits blast radius. Note v0.4.0 is currently marked prerelease upstream — confirm it is promoted before merging the pin, since the smokes and installer resolve a promoted release.

References

• Upstream meta: gh-aw upstream follow-up items from PRs (meta-issue) gh-aw-threat-detection#745
• Parity tracker: Tracking: parity with gh-aw's inline threat detection before migrating workflows to the external detector gh-aw-threat-detection#705