chore: upgrade gh-aw-firewall to v0.25.35 by Copilot · Pull Request #29819 · github/gh-aw

Copilot · 2026-05-02T19:21:13Z

Upgrades the default gh-aw-firewall (AWF) version from v0.25.29 to v0.25.35.

Changes

Updated DefaultFirewallVersion constant in pkg/constants/version_constants.go to v0.25.35
Rebuilt the binary and recompiled all 208 workflow lock files with the new version
Resolved new container image SHA digest pins via ./gh-aw update:
- ghcr.io/github/gh-aw-firewall/agent:0.25.35@sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3
- ghcr.io/github/gh-aw-firewall/api-proxy:0.25.35@sha256:38b62ba1fb6c02c18d8cb620543c5c58dac6c38dfbb6366a3316cba5d545cf95
- ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.35@sha256:4c7ca49eb050306f5a9aabc3d04e75b925c495f1882187c76af50155ba50811d
- ghcr.io/github/gh-aw-firewall/squid:0.25.35@sha256:92a7d2b592d4d693818980c1fa084bf4007b14df07e60d0b394c9b93dd009e9e
Updated golden test fixtures for the new version
All unit tests pass

Reference

https://github.com/github/gh-aw-firewall/releases/tag/v0.25.35

Changeset

Type: patch
Description: Bump the default gh-aw-firewall version to v0.25.35.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "chatgpt.com"

See Network Configuration for more information.

Generated by Changeset Generator for issue #29819 · ◷

✨ PR Review Safe Output Test - Run 25260196748

💥 [THE END] — Illustrated by Smoke Claude · ● 262.3K · ◷

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/23b1488d-ab32-46f5-9f9f-b5cd64b8d9e6 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-05-02T19:41:05Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-05-02T19:41:07Z

⚠️ Smoke Crush failed. Crush encountered unexpected challenges...

github-actions · 2026-05-02T19:41:08Z

⚠️ Smoke Gemini failed. Gemini encountered unexpected challenges...

github-actions · 2026-05-02T19:41:10Z

🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥

github-actions · 2026-05-02T19:41:15Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-05-02T19:41:21Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-05-02T19:44:15Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	4.52.5
curl	✅	8.5.0
gh	✅	2.89.0
node	✅	22.22.2
python3	✅	3.10.16 (PyPy 7.3.19)
go	✅	1.24.13
java	✅	10.0.201
dotnet	❌	NOT FOUND

Result: 11/12 tools available ⚠️
Overall Status: FAIL — dotnet (.NET runtime) is not available in this container.

🔧 Tool validation by Agent Container Smoke Test · ● 130.4K · ◷

github-actions · 2026-05-02T19:48:35Z

Smoke Test Codex 25260196716: FAIL
PRs: #29802 Investigating sub-agent usage and token consumption; #29818 [docs] docs: remove redundant bullets in cost-management episode cost section
✅ GitHub MCP ✅ Serena ✅ Playwright ❌ Web Fetch
✅ File ✅ Bash ✅ Build ✅ Comment Memory ✅ Cache Memory

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "chatgpt.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex · ◷

github-actions · 2026-05-02T19:48:35Z

Comment Memory

Soft dawn threads the logs
Build lights settle into green
Quiet branches breathe

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "chatgpt.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex · ◷

github-actions · 2026-05-02T19:48:50Z

Commit pushed: cc11338

Generated by Changeset Generator

github-actions · 2026-05-02T19:50:13Z

💥 Smoke Test 25260196748 — PARTIAL PASS

Status: PARTIAL (2 skipped, 0 failed)

💥 [THE END] — Illustrated by Smoke Claude · ● 262.3K · ◷

github-actions

💥 Automated smoke test review - all systems nominal! Run 25260196748

💥 [THE END] — Illustrated by Smoke Claude · ● 262.3K

github-actions · 2026-05-02T19:50:15Z

      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.29@sha256:e68f37e36962dcb3f3d1de680a49bc2302cefd001b941a7dc377155ec7ce42f4"
    },
+    "ghcr.io/github/gh-aw-firewall/agent:0.25.35": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35",


✅ Smoke test review comment #1 — New firewall agent digest pinned correctly for v0.25.35. SHA-256 looks good.

github-actions · 2026-05-02T19:50:15Z

      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.29@sha256:d1219e4110684402aabbeb5a43858f26790c9d0be210581cf3f7a521bd2c87b6"
    },
+    "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.35": {
+      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.35",


✅ Smoke test review comment #2 — api-proxy image digest for v0.25.35 properly recorded. Automated smoke test — Run 25260196748.

github-actions · 2026-05-02T19:53:17Z

UGH! Cave-agent was here! Me smoke test agent. Me find all tools work good. Fire hot. Binary build. Copilot strong! ��🔥✅

📰 BREAKING: Report filed by Smoke Copilot · ● 2.5M · ◷

github-actions · 2026-05-02T19:53:26Z

Comment Memory

# Smoke Test Memory

Tests run, code pass,
Binary flies through the cloud—
Agent was here. ✅

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

📰 BREAKING: Report filed by Smoke Copilot · ● 2.5M · ◷

github-actions

Cave-agent review done. Lock files updated. Firewall version bump look clean. UGH APPROVE!

📰 BREAKING: Report filed by Smoke Copilot · ● 2.5M

github-actions · 2026-05-02T19:54:02Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

pelikhan · 2026-05-02T20:13:40Z

@copilot merge main and recompile

Copilot

Pull request overview

Bumps the repository’s default gh-aw-firewall (AWF) version from v0.25.29 to v0.25.35, updates generated workflow/golden outputs to match, and refreshes container digest pin data used during locking/compilation.

Changes:

Updated the default AWF version constant to v0.25.35.
Regenerated workflow golden fixtures and multiple locked workflows to reference the new AWF version/digests.
Refreshed embedded container pin data, including new 0.25.35 firewall image entries and a pinned gh-aw-mcpg:v0.3.3.

Show a summary per file

File	Description
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden`	Updates compiled golden workflow output to the new AWF version/tag.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden`	Updates smoke Copilot golden output for AWF `v0.25.35`.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden`	Updates basic Copilot golden output for the bumped firewall version.
`pkg/workflow/data/action_pins.json`	Adds new container pin records used by workflow compilation/locking.
`pkg/constants/version_constants.go`	Changes the default AWF version constant.
`pkg/actionpins/data/action_pins.json`	Adds new action/container pin records for the new firewall version.
`.github/workflows/test-workflow.lock.yml`	Regenerated locked workflow metadata and AWF config for the new version.
`.github/workflows/smoke-crush.lock.yml`	Regenerated Crush smoke workflow locks and AWF config.
`.github/workflows/smoke-ci.lock.yml`	Regenerated CI smoke workflow locks and AWF config.
`.github/workflows/release.lock.yml`	Regenerated release workflow locks and AWF config.
`.github/workflows/metrics-collector.lock.yml`	Regenerated metrics collector workflow locks and AWF config.
`.github/workflows/hippo-embed.lock.yml`	Regenerated Hippo embed workflow locks and AWF config.
`.github/workflows/firewall.lock.yml`	Regenerated firewall workflow locks and AWF config.
`.github/workflows/example-permissions-warning.lock.yml`	Regenerated example workflow locks and AWF config.
`.github/workflows/daily-malicious-code-scan.lock.yml`	Regenerated daily scan workflow locks and AWF config.
`.github/workflows/copilot-token-optimizer.lock.yml`	Regenerated token optimizer workflow locks and AWF config.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Regenerated Codex MCP smoke workflow locks and AWF config.
`.github/workflows/changeset.lock.yml`	Regenerated changeset workflow locks and AWF config.
`.github/workflows/bot-detection.lock.yml`	Regenerated bot detection workflow locks and AWF config.
`.github/workflows/ai-moderator.lock.yml`	Regenerated AI moderator workflow locks and AWF config.
`.github/workflows/ace-editor.lock.yml`	Regenerated Ace editor workflow locks and AWF config.
`.github/aw/actions-lock.json`	Updates the repository’s checked-in lock data for container images/actions.
`.changeset/patch-bump-awf-v0-25-35.md`	Adds the release note/changeset for the version bump.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 53/216 changed files
Comments generated: 3

+    "ghcr.io/github/gh-aw-firewall/agent:0.25.35": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35",
+      "digest": "sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35@sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3"
+    },


+    "ghcr.io/github/gh-aw-firewall/agent:0.25.35": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35",
+      "digest": "sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35@sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3"
+    },


+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35",
+      "digest": "sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.35@sha256:e7d7629973c6137167541e1021da4b1aa3f5c1aa72ffbee55d3364d5a89b27d3"
+    },


Copilot AI and others added 2 commits May 2, 2026 19:11

chore: start gh-aw-firewall upgrade to v0.25.35

e136e04

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/23b1488d-ab32-46f5-9f9f-b5cd64b8d9e6 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

chore: upgrade gh-aw-firewall to v0.25.35

34f871f

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/23b1488d-ab32-46f5-9f9f-b5cd64b8d9e6 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan May 2, 2026

Copilot created this pull request from a session on behalf of pelikhan May 2, 2026 19:22 View session

Copilot finished work on behalf of pelikhan May 2, 2026 19:22

Copilot AI requested a review from pelikhan May 2, 2026 19:22

pelikhan added the smoke label May 2, 2026

github-actions Bot removed the smoke label May 2, 2026

Add changeset

cc11338

github-actions Bot mentioned this pull request May 2, 2026

Smoke Test: Claude - 25260196748 #29822

Closed

github-actions Bot added the smoke-claude label May 2, 2026

github-actions Bot reviewed May 2, 2026

View reviewed changes

github-actions Bot added the smoke-copilot label May 2, 2026

github-actions Bot reviewed May 2, 2026

View reviewed changes

pelikhan marked this pull request as ready for review May 2, 2026 20:13

Copilot AI review requested due to automatic review settings May 2, 2026 20:13

Copilot started work on behalf of pelikhan May 2, 2026 20:13 View session

Copilot started reviewing on behalf of pelikhan May 2, 2026 20:14 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

pelikhan closed this May 2, 2026

Copilot stopped work on behalf of pelikhan due to an error May 2, 2026 20:20
The session was cancelled by the user.

Conversation

Copilot AI commented May 2, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Reference

Changeset

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

github-actions Bot commented May 2, 2026

Agent Container Tool Check

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

github-actions Bot commented May 2, 2026

Comment Memory

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot May 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot May 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

github-actions Bot commented May 2, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 2, 2026

Uh oh!

pelikhan commented May 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 2, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented May 2, 2026 •

edited

Loading

github-actions Bot commented May 2, 2026 •

edited

Loading

github-actions Bot commented May 2, 2026 •

edited

Loading

github-actions Bot commented May 2, 2026 •

edited

Loading

github-actions Bot commented May 2, 2026 •

edited

Loading