Bump DefaultFirewallVersion to v0.25.35#29832
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/95103f17-f64c-4549-9bdf-1115e24bddc5 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
Hey A couple of things to address before this can move forward:
When you're ready to execute, you can assign this prompt to the agent:
|
|
@copilot merge main and recompile |
…-version-to-v0-25-35 # Conflicts: # .github/workflows/daily-cache-strategy-analyzer.lock.yml # .github/workflows/daily-fact.lock.yml # .github/workflows/daily-observability-report.lock.yml # .github/workflows/duplicate-code-detector.lock.yml # .github/workflows/grumpy-reviewer.lock.yml # .github/workflows/issue-arborist.lock.yml # .github/workflows/schema-feature-coverage.lock.yml # .github/workflows/smoke-call-workflow.lock.yml # .github/workflows/smoke-codex.lock.yml Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b19df854-5228-430a-b4f5-27fca8342f0d Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Done — merged main, resolved conflicts in the 9 conflicting lock files, rebuilt the binary, and recompiled all lock files. Commit: edbe6e6. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
|
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥 |
|
|
Agent Container Tool Check
Result: 12/12 tools available ✅ PASS
|
|
PRs: #29833 feat: add pi_steering_extension.cjs with automatic injection and cpi.yml integration tests; #29804 feat: surface missing_tool and missing_data as agent failures in failure issue comments Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
|
Smoke test caveman was here! Me test tools. Me bang rocks together. Tools work good! 🦴
|
There was a problem hiding this comment.
Me review! Firewall version bump from 0.25.29 to 0.25.35. All lock files updated. Look good to caveman!
📰 BREAKING: Report filed by Smoke Copilot · ● 1M
| @@ -1,5 +1,5 @@ | |||
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"b9bd777a3247cc774b84b587714d6884d6e3969d339c022ea50ed9b45498a7d5","strict":true,"agent_id":"copilot"} | |||
| # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.29","digest":"sha256:e68f37e36962dcb3f3d1de680a49bc2302cefd001b941a7dc377155ec7ce42f4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.29@sha256:e68f37e36962dcb3f3d1de680a49bc2302cefd001b941a7dc377155ec7ce42f4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.29","digest":"sha256:d1219e4110684402aabbeb5a43858f26790c9d0be210581cf3f7a521bd2c87b6","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.29@sha256:d1219e4110684402aabbeb5a43858f26790c9d0be210581cf3f7a521bd2c87b6"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.29","digest":"sha256:29917488eb90a01ff9544ffeeb5cc26434a8ea16d69ae8972f5f6be0e567e276","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.29@sha256:29917488eb90a01ff9544ffeeb5cc26434a8ea16d69ae8972f5f6be0e567e276"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.29","digest":"sha256:8a71ad9e40454051672312917e51567abfb8251d7c294d086c48f63d84e4cb53","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.29@sha256:8a71ad9e40454051672312917e51567abfb8251d7c294d086c48f63d84e4cb53"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.3"},{"image":"ghcr.io/github/github-mcp-server:v1.0.3","digest":"sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]} | |||
| # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.35"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.35"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.35"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.35"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.3"},{"image":"ghcr.io/github/github-mcp-server:v1.0.3","digest":"sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]} | |||
There was a problem hiding this comment.
Me see firewall version change. 0.25.29 gone, 0.25.35 here now. Good bump!
| @@ -114,7 +114,7 @@ jobs: | |||
| GH_AW_INFO_STAGED: "false" | |||
There was a problem hiding this comment.
AWF version env var now v0.25.35. Me approve!
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
🤖 Smoke Test Results — Run 25263690532
Overall: PARTIAL (2 skipped, rest passed)
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal! This PR correctly bumps DefaultFirewallVersion from v0.25.29 to v0.25.35 across 208 lock files. The change is mechanical and consistent throughout.
💥 [THE END] — Illustrated by Smoke Claude · ● 312.4K
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Bumps the default Agent Workflow Firewall (AWF) version from v0.25.29 to v0.25.35 and updates workflow lockfiles to reference the new version.
Changes:
- Update
DefaultFirewallVersionconstant tov0.25.35 - Recompile workflow lockfiles to reference
0.25.35container tags and AWF binary version - Update embedded AWF config JSON in lockfiles to use the new image tag
Show a summary per file
| File | Description |
|---|---|
| pkg/constants/version_constants.go | Bumps DefaultFirewallVersion constant to v0.25.35. |
| .github/workflows/test-workflow.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/smoke-opencode.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/smoke-crush.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/smoke-ci.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/release.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/metrics-collector.lock.yml | Updates manifest/container references (incl. cli-proxy) and runtime AWF version to 0.25.35. |
| .github/workflows/hippo-embed.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/gpclean.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/firewall.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/example-permissions-warning.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/dev.lock.yml | Updates manifest/container references (incl. cli-proxy) and runtime AWF version to 0.25.35. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/copilot-token-optimizer.lock.yml | Updates manifest/container references (incl. cli-proxy) and runtime AWF version to 0.25.35. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/code-simplifier.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/changeset.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/bot-detection.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/ai-moderator.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
| .github/workflows/ace-editor.lock.yml | Updates manifest/container references and runtime AWF version to 0.25.35. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 58/209 changed files
- Comments generated: 0
Bumps the default Agent Workflow Firewall (AWF) version from
v0.25.29tov0.25.35.Changes
pkg/constants/version_constants.go:DefaultFirewallVersionupdated tov0.25.35.github/workflows/*.lock.yml): recompiled to reference the new AWF versionWarning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv get --local repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } credential.helpegit(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ithub/workflows --local repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } credential.helpegit(http block)https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ns.json and pkg/workflow/data/action_pins.json..."(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv tions-lock.json pkg/actionpins/data/action_pins.json; \ cp .github/aw/actions-lock.json pkg/worgit(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ns.json and pkg/workflow/data/action_pins.json..."(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ithub/workflows --local(http block)https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv(http block)https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6/usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv(http block)https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4/usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv(http block)https://api.github.com/repos/github/gh-aw/usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows --local /home/REDACTED/.lo-f user.email(http block)If you need me to access, download, or install something from one of these locations, you can either:
✨ PR Review Safe Output Test - Run 25263690532