Chore/bump firewall v0.25.20 by lpcox · Pull Request #26063 · github/gh-aw

lpcox · 2026-04-13T15:51:31Z

No description provided.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add container image digest entries to actions-lock.json for the three v0.25.20 firewall images (agent, api-proxy, squid). This ensures lock files include immutable digest-pinned references instead of tag-only references. Resolves review feedback about missing digest pins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

lpcox · 2026-04-13T15:51:50Z

@copilot resolve the merge conflicts in this pull request

Copilot

Pull request overview

Bumps the gh-aw-firewall (AWF) version to v0.25.20 and updates the pinned container image digests used by generated workflow lock files.

Changes:

Update the default AWF binary version constant to v0.25.20.
Add pins for AWF agent, api-proxy, and squid images at 0.25.20 (with digests).
Regenerate multiple GitHub Actions workflow lock files to reference AWF 0.25.20 images and tags.

Show a summary per file

File	Description
pkg/workflow/data/action_pins.json	Adds new pinned AWF container image entries for `0.25.20`.
pkg/constants/version_constants.go	Bumps `DefaultFirewallVersion` to `v0.25.20`.
.github/workflows/workflow-generator.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/test-workflow.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/schema-feature-coverage.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/pr-triage-agent.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/plan.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/metrics-collector.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/gpclean.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/firewall.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/example-permissions-warning.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/dev.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/daily-malicious-code-scan.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/contribution-check.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/code-simplifier.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/changeset.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/bot-detection.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/ai-moderator.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/workflows/ace-editor.lock.yml	Updates AWF images/tags/digests to `0.25.20`.
.github/aw/actions-lock.json	Adds pinned AWF container image entries for `0.25.20` (with digests).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 61/190 changed files
Comments generated: 2

Copilot · 2026-04-13T15:55:25Z

+    },
+    "ghcr.io/github/gh-aw-firewall/agent:0.25.20": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.20",
+      "digest": "sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.20@sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682"
+    },
+    "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20": {
+      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20",
+      "digest": "sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20@sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519"
+    },
+    "ghcr.io/github/gh-aw-firewall/squid:0.25.20": {
+      "image": "ghcr.io/github/gh-aw-firewall/squid:0.25.20",
+      "digest": "sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.25.20@sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236"


The new AWF container entries for 0.25.20 were appended at the end of the "containers" map (after semgrep), which breaks the otherwise alphabetical/stable ordering of keys in this file. To keep diffs deterministic and the file easy to scan, place the 0.25.20 gh-aw-firewall entries next to the existing 0.25.18 gh-aw-firewall entries (around lines ~193-207).

Copilot · 2026-04-13T15:55:26Z

 // DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary
-const DefaultFirewallVersion Version = "v0.25.18"
+const DefaultFirewallVersion Version = "v0.25.20"



This PR bumps DefaultFirewallVersion to v0.25.20, but there are still AWF pin references to v0.25.18 in the repo (e.g., pkg/cli/workflows/example-blocked-domains.lock.yml). If the intent is to bump the firewall version consistently, update those remaining lock/example workflow pins as well to avoid diverging default vs. example behavior.

…0.25.20 # Conflicts: # .github/workflows/contribution-check.lock.yml Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-04-13T16:01:23Z

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflict in .github/workflows/contribution-check.lock.yml by recompiling the workflow — the merged result correctly combines the updated frontmatter hash (from main's pre-agent step addition) with the firewall v0.25.20 container images from this PR. Committed in 137c5b3.

lpcox · 2026-04-13T16:45:56Z

@copilot resolve the merge conflicts in this pull request

Update TestWasmGolden_CompileFixtures golden files and docker_cli_proxy_test.go to use v0.25.20 image tags, matching the DefaultFirewallVersion bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…0.25.20 # Conflicts: # .github/workflows/daily-doc-updater.lock.yml # .github/workflows/hourly-ci-cleaner.lock.yml Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

…to chore/bump-firewall-v0.25.20 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-04-13T16:53:08Z

@copilot resolve the merge conflicts in this pull request

Resolved the new merge conflicts in daily-doc-updater.lock.yml and hourly-ci-cleaner.lock.yml (introduced by the dcae8cc rescheduling commit on main) by recompiling both workflows from their .md sources. Also merged the concurrent c132725 commit (golden file + test updates) from the remote branch. All resolved in 8b58037.

lpcox and others added 2 commits April 12, 2026 19:59

chore: bump Agent Workflow Firewall from v0.25.18 to v0.25.20

eebe8c5

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 13, 2026 15:51

Copilot started reviewing on behalf of lpcox April 13, 2026 15:52 View session

Copilot started work on behalf of lpcox April 13, 2026 15:52 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into chore/bump-firewall-v…

137c5b3

…0.25.20 # Conflicts: # .github/workflows/contribution-check.lock.yml Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox April 13, 2026 16:02

Copilot started work on behalf of lpcox April 13, 2026 16:46 View session

lpcox and others added 3 commits April 13, 2026 09:50

fix: update golden files and test for v0.25.20 firewall version

c132725

Update TestWasmGolden_CompileFixtures golden files and docker_cli_proxy_test.go to use v0.25.20 image tags, matching the DefaultFirewallVersion bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into chore/bump-firewall-v…

2e3e6aa

…0.25.20 # Conflicts: # .github/workflows/daily-doc-updater.lock.yml # .github/workflows/hourly-ci-cleaner.lock.yml Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Merge remote-tracking branch 'origin/chore/bump-firewall-v0.25.20' in…

8b58037

…to chore/bump-firewall-v0.25.20 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

lpcox merged commit 5181d75 into main Apr 13, 2026

lpcox deleted the chore/bump-firewall-v0.25.20 branch April 13, 2026 16:53

Copilot stopped work on behalf of lpcox due to an error April 13, 2026 16:53
The session was cancelled by the user.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Chore/bump firewall v0.25.20#26063

Chore/bump firewall v0.25.20#26063
lpcox merged 6 commits intomainfrom
chore/bump-firewall-v0.25.20

lpcox commented Apr 13, 2026

Uh oh!

lpcox commented Apr 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Copilot AI commented Apr 13, 2026

Uh oh!

lpcox commented Apr 13, 2026

Uh oh!

Copilot AI commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

lpcox commented Apr 13, 2026

Uh oh!

lpcox commented Apr 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 13, 2026

Uh oh!

lpcox commented Apr 13, 2026

Uh oh!

Copilot AI commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants