Bump default AWF firewall to v0.25.26, merge main, and recompile lock outputs#27478
Merged
Bump default AWF firewall to v0.25.26, merge main, and recompile lock outputs#27478
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/1250cb4e-b214-4692-ba29-1b9541c7e7b4 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Bump AWF firewall version to v0.25.26
Bump default AWF firewall to v0.25.26 and recompile lock outputs
Apr 21, 2026
Collaborator
|
@copilot merge main and recompile |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the default gh-aw firewall (AWF) version to v0.25.26 and refreshes generated workflow lock artifacts / WASM compile golden fixtures so pinned runtime steps and container image tags consistently reference the new version.
Changes:
- Bumped
DefaultFirewallVersionfromv0.25.25tov0.25.26. - Recompiled workflow lockfiles to pin
ghcr.io/github/gh-aw-firewall/*images and AWF install steps to0.25.26/v0.25.26. - Updated WASM compile golden fixtures to assert the new AWF version in emitted workflow content.
Show a summary per file
| File | Description |
|---|---|
| pkg/constants/version_constants.go | Bumps the default AWF version constant to v0.25.26. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates golden output to expect AWF v0.25.26 and image-tag 0.25.26. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates golden output to expect AWF v0.25.26 and image-tag 0.25.26. |
| .github/workflows/video-analyzer.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/test-workflow.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/smoke-opencode.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/smoke-crush.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/smoke-ci.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/security-compliance.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/refiner.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/plan.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/metrics-collector.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/gpclean.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/firewall.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/example-permissions-warning.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/dev.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/copilot-token-optimizer.lock.yml | Re-pins AWF install + firewall images (including cli-proxy where used) to 0.25.26 / v0.25.26. |
| .github/workflows/contribution-check.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/code-simplifier.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/changeset.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/bot-detection.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/ai-moderator.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
| .github/workflows/ace-editor.lock.yml | Re-pins AWF install + firewall images to 0.25.26 / v0.25.26. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 75/201 changed files
- Comments generated: 0
Collaborator
|
@copilot merge main and recompile |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Merged Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
Bump default AWF firewall to v0.25.26 and recompile lock outputs
Bump default AWF firewall to v0.25.26, merge main, and recompile lock outputs
Apr 21, 2026
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
Author
Merged latest Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
Contributor
|
🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥 |
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
|
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
|
|
Contributor
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Contributor
Smoke Test Results — Run §24704312319\n\n| Test | Status |\n|------|--------|\n| GitHub MCP | ✅ |\n| MCP Scripts GH CLI | ✅ |\n| Serena CLI | ✅ |\n| Playwright | ✅ |\n| Web Fetch | ✅ |\n| File Writing | ✅ |\n| Bash Tool | ✅ |\n| Discussion Interaction | ✅ |\n| Build gh-aw | ✅ |\n| Upload artifact | ✅ |\n| Discussion Creation | ✅ |\n| Workflow Dispatch | ✅ |\n| PR Review | ✅ |\n\nOverall: ✅ PASS\n\nPR by
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
This PR correctly bumps DefaultFirewallVersion from v0.25.25 to v0.25.26 and propagates the change through compiled lock files and golden test fixtures. The change is minimal and well-scoped. No logic changes — purely a version constant update with appropriate artifact regeneration.
📰 BREAKING: Report filed by Smoke Copilot · ● 900.9K
| @@ -57,7 +57,7 @@ const DefaultOpenCodeVersion Version = "1.2.14" | |||
| const DefaultGitHubMCPServerVersion Version = "v1.0.0" | |||
|
|
|||
| // DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary | |||
| const DefaultFirewallVersion Version = "v0.25.25" | |||
| const DefaultFirewallVersion Version = "v0.25.26" | |||
Contributor
There was a problem hiding this comment.
Version bump from v0.25.25 → v0.25.26 looks correct. Consider adding a brief inline comment here referencing the changelog or release notes for v0.25.26 so future readers can quickly understand the motivation for the bump.
| @@ -60,7 +60,7 @@ jobs: | |||
| GH_AW_INFO_STAGED: "false" | |||
| GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]' | |||
| GH_AW_INFO_FIREWALL_ENABLED: "true" | |||
| GH_AW_INFO_AWF_VERSION: "v0.25.25" | |||
| GH_AW_INFO_AWF_VERSION: "v0.25.26" | |||
Contributor
There was a problem hiding this comment.
The golden fixture files are correctly updated to reference v0.25.26. This is a good practice — keeping test fixtures in sync with version bumps ensures CI catches regressions if the version constant ever drifts from the compiled output.
Contributor
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
Contributor
|
Smoke Test Results — Run 24704312312 (Claude engine)
Overall: PARTIAL — 16 passed, 1 failed (#10 MCP status error), 2 skipped (#16, #19)
|
Contributor
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude · ● 230K
| @@ -1,5 +1,5 @@ | |||
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"8955ee270578c68e1b90ccda262a02f9b608013552d51884c06a20f9fdbd98ed","agent_id":"copilot"} | |||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.25"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.25"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.25"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.26"},{"image":"ghcr.io/github/github-mcp-server:v1.0.0"}]} | |||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.26"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.26"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.26"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.26"},{"image":"ghcr.io/github/github-mcp-server:v1.0.0"}]} | |||
Contributor
There was a problem hiding this comment.
🔍 Firewall version bump detected: Updated from ghcr.io/github/gh-aw-firewall/*:0.25.25 → :0.25.26. Looks like a clean version bump to the AWF container images. The manifest hash and all action SHAs remain pinned — good hygiene.
| @@ -1,5 +1,5 @@ | |||
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"1ad587d53dff82cfa4406c830ee84c5c19491da9c61a882d314851f161fd4118","strict":true,"agent_id":"copilot"} | |||
| # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/setup-go","sha":"4a3601121dd01d1626a1e23e37211e3254c1c06c","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"docker/build-push-action","sha":"bcafcacb16a39f128d818304e6c9c0c18556b85f","version":"v7.1.0"},{"repo":"docker/setup-buildx-action","sha":"4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd","version":"v4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.25"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.25"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.25"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.26"},{"image":"ghcr.io/github/github-mcp-server:v1.0.0"},{"image":"node:lts-alpine","digest":"sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b","pinned_image":"node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b"}]} | |||
| # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/setup-go","sha":"4a3601121dd01d1626a1e23e37211e3254c1c06c","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"docker/build-push-action","sha":"bcafcacb16a39f128d818304e6c9c0c18556b85f","version":"v7.1.0"},{"repo":"docker/setup-buildx-action","sha":"4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd","version":"v4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.26"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.26"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.26"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.26"},{"image":"ghcr.io/github/github-mcp-server:v1.0.0"},{"image":"node:lts-alpine","digest":"sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b","pinned_image":"node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b"}]} | |||
Contributor
There was a problem hiding this comment.
✅ Consistent version bump: Same 0.25.25 → 0.25.26 update applied here for the agent, api-proxy, and squid firewall container images. The awf binary install script and --image-tag flag are also updated consistently throughout the file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This updates the default AWF firewall version from
v0.25.25tov0.25.26and propagates the new tag through compiled workflow artifacts that pin firewall containers.Default version update
DefaultFirewallVersionin:pkg/constants/version_constants.goCompiled workflow lockfile refresh
0.25.26for:ghcr.io/github/gh-aw-firewall/agentghcr.io/github/gh-aw-firewall/api-proxyghcr.io/github/gh-aw-firewall/squidGolden fixture alignment
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.goldenpkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.goldenFollow-up from review feedback
maininto this branch.design-decision-gate.lock.ymlupdates from merged workflow changes).✨ PR Review Safe Output Test - Run 24704312312