Skip to content

chore: bump DefaultFirewallVersion to v0.24.5#21873

Merged
Mossaka merged 5 commits intomainfrom
copilot/bump-default-firewall-version
Mar 20, 2026
Merged

chore: bump DefaultFirewallVersion to v0.24.5#21873
Mossaka merged 5 commits intomainfrom
copilot/bump-default-firewall-version

Conversation

Copy link
Contributor

Copilot AI commented Mar 19, 2026

v0.24.5 eliminates a 10s container shutdown delay per AWF invocation, saving ~20s per workflow run (main agent + threat detection combined).

Changes

  • pkg/constants/constants.go: DefaultFirewallVersion v0.24.3v0.24.5
  • 177 .lock.yml files: Recompiled to pick up the new version

What's in v0.24.4–v0.24.5 since v0.24.3

  • v0.24.4: Update vulnerable dependencies (flatted, markdownlint-cli2)
  • v0.24.5: Eliminate 10s shutdown delay — switches api-proxy Dockerfile from shell-form to exec-form CMD, adds shutdown_lifetime 0 to squid config, sets stop_grace_period: 2s on both containers

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw w/sessions/6df5eb90-8ea8-498f-ad66-4793b4e2ac30 (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build2551712299/b295/embedcfg -pack (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.



✨ PR Review Safe Output Test - Run 23323063974

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

💥 [THE END] — Illustrated by Smoke Claude ·

Copilot AI linked an issue Mar 19, 2026 that may be closed by this pull request
Copilot AI changed the title [WIP] Chore: bump DefaultFirewallVersion to v0.24.5 chore: bump DefaultFirewallVersion to v0.24.5 Mar 20, 2026
Copilot AI requested a review from Mossaka March 20, 2026 00:04
@Mossaka Mossaka marked this pull request as ready for review March 20, 2026 00:10
Copilot AI review requested due to automatic review settings March 20, 2026 00:10
@Mossaka Mossaka added the smoke label Mar 20, 2026
@github-actions
Copy link
Contributor

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions github-actions bot removed the smoke label Mar 20, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 20, 2026

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions
Copy link
Contributor

github-actions bot commented Mar 20, 2026

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 20, 2026

🎬 THE ENDSmoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR bumps the default Agentic Workflow Firewall (AWF) version to v0.24.5 to reduce workflow runtime by eliminating container shutdown delays, and updates compiled workflow lock files to reference the new AWF version.

Changes:

  • Bump DefaultFirewallVersion from v0.24.3 to v0.24.5.
  • Update compiled GitHub Actions .lock.yml workflows to use v0.24.5 (and 0.24.5 container image tags).

Reviewed changes

Copilot reviewed 130 out of 178 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
pkg/constants/constants.go Bumps the default AWF version constant to v0.24.5.
.github/workflows/workflow-health-manager.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/workflow-generator.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/weekly-blog-post-writer.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/test-workflow.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/test-project-url-default.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/test-dispatcher.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-gemini.lock.yml Updates AWF install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-call-workflow.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-agent-scoped-approved.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-agent-public-none.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-agent-public-approved.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-agent-all-none.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/smoke-agent-all-merged.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/security-compliance.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/schema-feature-coverage.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/repo-tree-map.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/refiner.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/pr-triage-agent.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/poem-bot.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/plan.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/notion-issue-summary.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/metrics-collector.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/issue-triage-agent.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/issue-monster.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/issue-arborist.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/grumpy-reviewer.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/gpclean.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/github-remote-mcp-auth-test.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/firewall.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/example-permissions-warning.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/duplicate-code-detector.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/dictation-prompt.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/dev.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/daily-team-status.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/daily-secrets-analysis.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/daily-observability-report.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/daily-malicious-code-scan.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/daily-issues-report.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/daily-fact.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/craft.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/contribution-check.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/codex-github-remote-mcp-test.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/code-simplifier.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/changeset.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/brave.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/bot-detection.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/ai-moderator.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.
.github/workflows/ace-editor.lock.yml Updates AWF version, install step, image tags, and --image-tag usage to 0.24.5.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@@ -349,7 +349,7 @@ const DefaultGitHubMCPServerVersion Version = "v0.32.0"
const DefaultGitHubLockdown = false

// DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary
const DefaultFirewallVersion Version = "v0.24.3"
const DefaultFirewallVersion Version = "v0.24.5"
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says all .lock.yml files were recompiled to pick up v0.24.5, but there is still at least one workflow lock file pinned to v0.24.3 (e.g. pkg/cli/workflows/example-blocked-domains.lock.yml contains GH_AW_INFO_AWF_VERSION v0.24.3 and uses 0.24.3 image tags). This leaves parts of the repo on the old firewall version and undermines the intended runtime savings. Please recompile/update the remaining lock file(s) so there are no v0.24.3/0.24.3 references left.

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Contributor

Agent Container Tool Check

Tool Status Version
bash 5.2.21
sh available
git 2.53.0
jq 1.7
yq 4.52.4
curl 8.5.0
gh 2.87.3
node 20.20.1
python3 3.12.3
go 1.24.13
java 21.0.10
dotnet 10.0.102

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test ·

@github-actions
Copy link
Contributor

Smoke Test Results§23323063927

✅ GitHub MCP | ✅ GH CLI | ❌ Serena MCP (not configured) | ✅ Playwright | ✅ Web Fetch | ✅ File Write | ✅ Bash | ✅ Discussion | ✅ Build | ✅ Discussion Create | ✅ Workflow Dispatch | ✅ PR Review

Overall: ⚠️ PARTIAL PASS (11/12)

PR author: @Mossaka · Assignees: @Mossaka, @Copilot

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

📰 BREAKING: Report filed by Smoke Copilot ·

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Straightforward version bump of DefaultFirewallVersion from v0.24.3v0.24.5 across all compiled lock files. Changes are mechanical and consistent — all four reference points (env var, install script, docker image tags, awf --image-tag) are updated in lockstep. LGTM.

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

  • pr:#21873 (pull_request_read: Resource 'pr:#21873' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)

📰 BREAKING: Report filed by Smoke Copilot

GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
GH_AW_INFO_FIREWALL_ENABLED: "true"
GH_AW_INFO_AWF_VERSION: "v0.24.3"
GH_AW_INFO_AWF_VERSION: "v0.24.5"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version bump looks consistent — GH_AW_INFO_AWF_VERSION updated from v0.24.3v0.24.5. 🚀

GH_HOST: github.com
- name: Install AWF binary
run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.24.3
run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.24.5
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Install script arg bumped to v0.24.5 — matches the GH_AW_INFO_AWF_VERSION env var above. Consistency ✅

@github-actions
Copy link
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions
Copy link
Contributor

Smoke Test (Codex)

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex ·

@github-actions
Copy link
Contributor

Commit pushed: c966c6a

Generated by Changeset Generator

@Mossaka
Copy link
Collaborator

Mossaka commented Mar 20, 2026

@github-actions
Copy link
Contributor

Smoke Test Results — Run §23323063974PARTIAL

Core tests #1–11: ✅✅⚠️✅✅✅✅✅✅✅✅
PR review tests #12–18: ✅✅✅⚠️✅✅⚠️

Key Result
GitHub MCP
GH CLI
Serena MCP ⚠️ (2 symbols found, EOF on retries)
Make Build
Playwright
Tavily Search
File Write + Bash
Discussion Comment
Agentic WF MCP
Slack
Update PR / Review Comments / Submit Review / Add Reviewer / Push Branch
Resolve Thread (#15) ⚠️ skipped
Close PR (#18) ⚠️ skipped

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

💥 [THE END] — Illustrated by Smoke Claude ·

Copy link
Contributor Author

Copilot AI commented Mar 20, 2026

@copilot why is this CI failed? https://github.com/github/gh-aw/actions/runs/23322783177/job/67838284543?pr=21873

The CI failure was caused by two missed files that still referenced v0.24.3:

  1. TestWasmGolden_CompileFixtures — three golden test files (basic-copilot, smoke-copilot, with-imports) under pkg/workflow/testdata/wasm_golden/ weren't updated. Fixed by re-running with -update flag.
  2. pkg/cli/workflows/example-blocked-domains.lock.yml — this directory is commented out from make recompile, so it wasn't picked up automatically. Fixed by running ./gh-aw compile pkg/cli/workflows/example-blocked-domains.md directly.

Both are addressed in commit c7b433c.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@Mossaka Mossaka merged commit 66fc036 into main Mar 20, 2026
53 checks passed
@Mossaka Mossaka deleted the copilot/bump-default-firewall-version branch March 20, 2026 00:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore: bump DefaultFirewallVersion to v0.24.5

3 participants