Skip to content

Bump firewall to v0.25.38 and mcpg to v0.3.6#30230

Merged
pelikhan merged 4 commits intomainfrom
copilot/bump-firewall-to-v0-25-38-and-mcpg-to-v0-3-6
May 5, 2026
Merged

Bump firewall to v0.25.38 and mcpg to v0.3.6#30230
pelikhan merged 4 commits intomainfrom
copilot/bump-firewall-to-v0-25-38-and-mcpg-to-v0-3-6

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 4, 2026

Bumps two default component versions: firewall (AWF) v0.25.35v0.25.38 and MCP Gateway v0.3.3v0.3.6.

Changes

  • pkg/constants/version_constants.go — Updated DefaultFirewallVersion and DefaultMCPGatewayVersion
  • Lock files — Recompiled all 218 workflow .lock.yml files to pick up the new versions
  • Golden test files — Updated TestWasmGolden_CompileFixtures golden snapshots to match the new version strings in compiled output

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw er (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw pXNpv7oqGeU5NWow/opt/hostedtoolcache/node/24.14.1/x64/bin/npm (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD t0_js_wasm.s x_amd64/vet (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x^remote\..*\.gh-resolved$ sv runs/20260504-22git -buildtags /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git /repos/actions/ggh --jq /bin/sh git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv add remote2 /usr/bin/git ortcfg .cfg 64/pkg/tool/linuxterm-color git ent.�� .md md bject.type] | @tsv ortcfg .cfg 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 /tmp/go-build1169127245/b066/vet.cfg 1/x64/bin/node -goversion b/gh-aw/pkg/semv-1 -c=4 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuremote.origin.url t-ha�� ithub/workflows/archie.md '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen2842922034/001' r: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE 64/bin/go 9127245/b438/importcfg (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 /bin/sh bject.type] | @tsv git-receive-packgit git-receive-packrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� ithub-script/git/ref/tags/v9 64/pkg/tool/linux_amd64/compile bject.type] | @tsv g_.a x_amd64/compile /tmp/go-build116--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv k/_tool git /usr/bin/infocmp --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git infocmp -1 xterm-color git /home/REDACTED/.local/bin/node --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/gh node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv get --local me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } committer.name (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ithub/workflows --local ache/node/24.14.1/x64/bin/bash committer.email (http block)
  • https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv on (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv xterm-color /opt/hostedtoolcache/node/24.14.1/x64/bin/node /usr/bin/git secrets.TOKEN x_amd64/vet /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /ref/tags/v9 resolved$ sv git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv pkg/actionpins/data/action_pins.json; \ cp .github/aw/actions-lock.json pkg/workflow/data/action_pins.json; \ echo "��� Action pins synced successfully"; \ else \ echo "��� (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv tions-lock.json pkg/actionpins/data/action_pins.json; \ cp .github/aw/actions-lock.json pkg/worgit (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE cNu6uh6Xsdg3 env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/gh -bool -buildtags /opt/hostedtoolcxterm-color gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git ithub/workflows '/tmp/TestParseDrev-parse ache/node/24.14.--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv add origin /usr/bin/git phen2842922034/0git phen2842922034/0rev-parse x_amd64/vet git comm�� /ref/tags/v9 epo}/actions/runs/5/artifacts sv e fG0BeREzZ x_amd64/compile infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel tutil.test /usr/bin/infocmp -bool (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 node bject.type] | @tsv :latest x_amd64/compile /opt/hostedtoolc--show-toplevel git rev-�� /ref/tags/v9 node sv /tmp/TestHashConinfocmp go /opt/hostedtoolcxterm-color git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ns.json and pkg/workflow/data/action_pins.json..." (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 --local sv committer.email (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv runs/20260504-224943-38849/test-1930530630 -buildtags ache/node/24.14.1/x64/bin/node l -ifaceassert -nilfunc git t-13�� k/gh-aw/gh-aw/.github/workflows/archie.md --initial-branch=my-default /usr/bin/git ub/workflows color.go x_amd64/compile git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/archie.md x_amd64/vet /usr/bin/git 1347294479/.githgit @v1.19.2/parser/rev-parse x_amd64/vet git -C /tmp/TestCompileErrorFormatting3888932962/001 rev-parse /usr/bin/unpigz g_.a GO111MODULE x_amd64/compile /usr/bin/unpigz (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git uts.enforce_all git -importcfg /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git s/test.md rev-parse /opt/hostedtoolcstatus git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test26038128gh config /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 git rev-�� /ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link sv /tmp/go-build116git -importcfg /usr/bin/infocmp--show-toplevel git (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git 'value' || secregit x_amd64/compile repository(owne--show-toplevel git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel x_amd64/vet /usr/bin/git gh (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 64/pkg/tool/linux_amd64/compile bject.type] | @tsv g_.a x_amd64/compile /tmp/go-build116--show-toplevel git rev-�� --show-toplevel /tmp/go-build1169127245/b463/types.test /usr/bin/infocmp 1MO50m3UX -test.v=true /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch celain --ignore--f --local ache/node/24.14.-f commit.gpgsign (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/xsh /usr/bin/git ExpressionCompilgit /tmp/go-build116rev-parse 9127245/b418/imp--show-toplevel git rev-�� --show-toplevel W0GXogzJW_IN_/TV6lOae4WsPt2nvzZ6yM/kanFXMcb9Ib9j--jq /usr/bin/git ry=1 /tmp/go-build116-1 9127245/b418/_pkxterm-color git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq /opt/hostedtoolcache/node/24.14.1/x64/bin/node 1169072/001 1169072/002/workrev-parse x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� Safe: ${{ github.actor }}, Unsafe: ${{ secrets.TOKEN }} x_amd64/vet /usr/bin/git g_.a Cy4PJHJpH 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq /opt/hostedtoolcache/node/24.14.1/x64/bin/node g_.a GO111MODULE x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� Value: ${{ github.actor }} x_amd64/vet /usr/bin/git ub/workflows 1y3cTijPK x_amd64/link git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-27 3254173/b007/ GOMODCACHE 64/pkg/tool/linux_amd64/vet itcu�� 3254173/b099/_pkg_.a .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 3254173/b007/symuser.email 64/pkg/tool/linutest@example.com (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-04 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet ortc�� or.md .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-03 rand GOMODCACHE 71/KDaUrle63TPPPorigin ortc�� itbranch_with_hyphen2842922034/001 itbranch_with_hyphen2842922034/002/work 64/pkg/tool/linux_amd64/vet GOINSECURE sysrand 3254173/b015/sym-m 64/pkg/tool/linuInitial commit (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name 28ie/dWadUuI3oiBsYAOo28ie 64/pkg/tool/linux_amd64/compile GOINSECURE b/gh-aw/pkg/fileconfig GOMODCACHE N_/MhA652aEkSuR8^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 3254173/b036/importcfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name gNV_/-ERQMY_tDmUJytyNgNV_ .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -V=f�� ithub/workflows ELPw/QEPjXdEopvS0kiaYELPw .cfg ."; \ BEFORE=$(git GOWORK 64/bin/go ache/go/1.25.8/xTest User (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 7Ps3/Xuna8G_bMUX3GMM57Ps3 64/pkg/tool/linux_amd64/vet GOINSECURE /semver GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD reflectlite/asm.-stringintconv x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name stmain.go x_amd64/vet GOINSECURE fips140/ecdsa GOMODCACHE x_amd64/vet -V=f�� 9127245/b399/agentdrain.test flge/CEDVAjFSK2LRG6vPflge .cfg GOSUMDB GOWORK 64/bin/go ache/go/1.25.8/xtest@example.com (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 r73k/ZR15bOYtzO_sNGC5r73k ache/go/1.25.8/x64/pkg/tool/linu-nolocalimports GOINSECURE b/gh-aw/pkg/giturun GOMODCACHE ache/go/1.25.8/x--json (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xTest User (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name verutil_test.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/catmsremote GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--json (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name c9ZF/KtTFKQuDD_Pbt7zDc9ZF 64/pkg/tool/linux_amd64/link GOINSECURE t/language GOMODCACHE 64/pkg/tool/linu--json (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE th2 GOMODCACHE ache/go/1.25.8/xtest@example.com (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name REzZ/UVSmm-gThuyfG0BeREzZ 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env rtTIPUpRX GO111MODULE x_amd64/vet GOINSECURE GOMOD abis x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 g/x/text/unicoderemote GOMODCACHE x_amd64/vet 3254�� log.showsignature=false TwGo/SQWnFYXBmVnJmzP4TwGo .cfg -n1 --format=format:rev-parse --end-of-options--show-toplevel ache/go/1.25.8/x64/pkg/tool/linuTest User (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build1169127245/b404/cli.test /tmp/go-build1169127245/b404/cli.test -test.testlogfile=/tmp/go-build1169127245/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel e/git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv edOutput1534553656/001 9127245/b040/vet.cfg .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env g_.a GO111MODULE x_amd64/vet GOINSECURE _wasm.o 64/src/runtime/s/tmp/go-build1169127245/b467/typeutil.test x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv g_.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env ub/workflows nLaxVxxol x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv g_.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env ub/workflows 1y3cTijPK x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv 1169072/001 1169072/002/work x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env g_.a Cy4PJHJpH 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv g_.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env g_.a GO111MODULE x_amd64/vet GOINSECURE GOMOD abis x_amd64/vet (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 39383989/001 -trimpath /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git runs/20260504-22git -dwarf=false /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 3254173/b082/importcfg ZTds/2vgHE4jOupBv7mHHZTds x_amd64/vet GOSUMDB GOWORK 64/bin/go x_amd64/vet -p ed_at, event: .event, headBranch: .head_branch, -trimpath 64/pkg/tool/linux_amd64/compile -I /tmp/go-build211rev-parse -I 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOSUMDB GOWORK 64/bin/go x_amd64/vet -o 3254173/b203/importcfg -trimpath tartedAt,updatedAt,event,headBranch,headSha,displayTitle -p log/slog/internarev-parse -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state 1/x64/bin/node -p archive/tar -lang=go1.25 ache/go/1.25.8/x-S -has�� orts3710797331/01 /tmp/go-build1161 1/x64/bin/node -goversion go1.25.8 -c=4 e/git (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD emmove_wasm.s x_amd64/vet (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch -unreachable=false /tmp/go-build1169127245/b059/vet.cfg 9127245/b348/vet.cfg go1.25.8 -c=4 -nolocalimports /opt/hostedtoolcache/go/1.25.8/xorigin -uns�� '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branchremote.origin.url '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch3035263010/001' 1/x64/bin/node -json GO111MODULE 64/bin/go 1/x64/bin/node (http block)

If you need me to access, download, or install something from one of these locations, you can either:


Changeset

  • Type: patch
  • Description: Updated the default firewall to v0.25.38 and MCP Gateway to v0.3.6.

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • chatgpt.com
  • invalid.example.invalid

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "chatgpt.com"
    - "invalid.example.invalid"

See Network Configuration for more information.

Generated by Changeset Generator for issue #30230 ·

Copilot AI linked an issue May 4, 2026 that may be closed by this pull request
6 tasks
Copilot AI and others added 2 commits May 4, 2026 22:46
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/928cc585-8b76-4b40-a0ba-3f07926fc953

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Copilot AI changed the title [WIP] Bump firewall to v0.25.38 and mcpg to v0.3.6 Bump firewall to v0.25.38 and mcpg to v0.3.6 May 4, 2026
Copilot finished work on behalf of lpcox May 4, 2026 22:53
Copilot AI requested a review from lpcox May 4, 2026 22:53
@pelikhan pelikhan added the smoke label May 5, 2026
@pelikhan pelikhan marked this pull request as ready for review May 5, 2026 00:38
Copilot AI review requested due to automatic review settings May 5, 2026 00:38
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the repository’s default sandbox component versions (AWF firewall and MCP Gateway) and refreshes generated artifacts so compiled workflow output and golden snapshots reflect the new defaults.

Changes:

  • Bumped default AWF (gh-aw-firewall) version to v0.25.38 and default MCP Gateway (gh-aw-mcpg) version to v0.3.6.
  • Recompiled workflow lock files to update pinned container image tags and embedded version strings.
  • Updated TestWasmGolden_CompileFixtures golden snapshots to match the new compiled outputs.
Show a summary per file
File Description
pkg/constants/version_constants.go Updates default AWF and MCP Gateway version constants.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden Refreshes golden output to reflect updated AWF/MCPG versions and image tags.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden Refreshes golden output to reflect updated AWF/MCPG versions and image tags.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden Refreshes golden output to reflect updated AWF/MCPG versions and image tags.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden Refreshes golden output to reflect updated AWF/MCPG versions and image tags.
.github/workflows/test-workflow.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/smoke-crush.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/smoke-ci.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/release.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/hippo-embed.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/firewall.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/example-permissions-warning.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/daily-malicious-code-scan.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/copilot-token-optimizer.lock.yml Updates locked workflow manifest/container tags (including cli-proxy) to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/codex-github-remote-mcp-test.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/code-simplifier.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/changeset.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/bot-detection.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/ai-moderator.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.
.github/workflows/ace-editor.lock.yml Updates locked workflow manifest/container tags to AWF 0.25.38 and MCPG v0.3.6.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 53/218 changed files
  • Comments generated: 0

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

⚠️ Smoke Gemini failed. Gemini encountered unexpected challenges...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions github-actions Bot removed the smoke label May 5, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

Agent Container Tool Check

Tool Status Version
bash 5.2.21
sh available
git 2.53.0
jq 1.7
yq v4.52.5
curl 8.5.0
gh 2.89.0
node v22.22.2
python3 3.10.16 (PyPy 7.3.19)
go 1.24.13
java openjdk 21.0.10
dotnet 10.0.201

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · ● 220.5K ·

@github-actions github-actions Bot mentioned this pull request May 5, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

#30216 fix: remove empty parent block after last child is removed by codemod
#30215 fix(otlp): add standard resource attributes to logSpan tool spans
✅ GitHub/Serena/File/Bash/Build/Cache; ❌ Playwright/Web Fetch/Comment Memory
Overall status: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "chatgpt.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex ·

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

🤖 Beep boop! The smoke test agent was here! Running diagnostic checks at warp speed... All systems nominal. Now back to lurking in the CI pipeline. 👋

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • safebrowsingohttpgateway.googleapis.com
  • www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · ● 2.5M ·

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

🎉 Hello from the smoke test bot! I zoomed through 15 tests at the speed of light — GitHub MCP ✅, Playwright ✅, builds ✅, Serena symbols ✅... basically everything! The robots are taking over, one CI pipeline at a time. 🤖✨

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • safebrowsingohttpgateway.googleapis.com
  • www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · ● 2.5M ·

Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke test agent review: Version constant bumps look clean. Lock files regenerated correctly. LGTM.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • safebrowsingohttpgateway.googleapis.com
  • www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · ● 2.5M

@@ -82,7 +82,7 @@ const AWFAllowHostPortsMinVersion Version = "v0.25.24"
const CopilotNoAskUserMinVersion Version = "1.0.19"

// DefaultMCPGatewayVersion is the default version of the MCP Gateway (gh-aw-mcpg) Docker image
const DefaultMCPGatewayVersion Version = "v0.3.3"
const DefaultMCPGatewayVersion Version = "v0.3.6"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MCPG bump from v0.3.3v0.3.6 looks correct. Consider adding a changelog reference in the commit message for easier traceability.

@@ -60,7 +60,7 @@ const DefaultOpenCodeVersion Version = "1.2.14"
const DefaultGitHubMCPServerVersion Version = "v1.0.3"

// DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary
const DefaultFirewallVersion Version = "v0.25.35"
const DefaultFirewallVersion Version = "v0.25.38"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good bump: DefaultFirewallVersion updated from v0.25.35v0.25.38. Ensure downstream lock files have all been regenerated to reference the new container image SHAs.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 5, 2026

Commit pushed: 1787560

Generated by Changeset Generator

@pelikhan pelikhan merged commit e0bd321 into main May 5, 2026
@pelikhan pelikhan deleted the copilot/bump-firewall-to-v0-25-38-and-mcpg-to-v0-3-6 branch May 5, 2026 01:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bump firewall to v0.25.38 and mcpg to v0.3.6

4 participants