fix: SHA-pin build-tools firewall image for arc-dind topology by Copilot · Pull Request #44044 · github/gh-aw

Copilot · 2026-07-07T13:54:41Z

When compiling a workflow with runner.topology: arc-dind, the build-tools sysroot init container (ghcr.io/github/gh-aw-firewall/build-tools:0.27.26) was emitted tag-only with no digest, while the other four gh-aw-firewall images (agent, api-proxy, cli-proxy, squid) were correctly SHA-pinned.

Changes

pkg/workflow/awf_helpers.go — buildAWFImageTagWithDigests now conditionally appends build-tools=sha256:<digest> to the --image-tag string when isArcDindTopology is true. The build-tools image is arc-dind-specific so it is excluded from the default (non-arc-dind) tag string.

Pin data (.github/aw/actions-lock.json, pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json) — Added the missing build-tools:0.27.26 entry:

"ghcr.io/github/gh-aw-firewall/build-tools:0.27.26": {
  "image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.26",
  "digest": "sha256:5823f6cec65210cd6e3e6320c165979fb46f78c76600f58f4189d2c89c2be8da",
  "pinned_image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.26@sha256:5823f6cec65210cd6e3e6320c165979fb46f78c76600f58f4189d2c89c2be8da"
}

Tests — Added TestCompileWorkflow_BuildToolsImagePinnedForArcDind (compile-level regression test mirroring the existing #43307 guard) and two new sub-tests in TestBuildAWFImageTagWithDigests verifying arc-dind inclusion and non-arc-dind exclusion of build-tools.

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

pelikhan · 2026-07-07T14:35:15Z

@copilot merge main and recompile

Copilot

Pull request overview

This PR fixes a digest-pinning gap for the gh-aw-firewall/build-tools init container when compiling workflows that use runner.topology: arc-dind, ensuring the compiled lock output is fully SHA-pinned (matching the other firewall images) and that AWF’s --image-tag metadata includes build-tools=<digest> only for arc-dind.

Changes:

Update buildAWFImageTagWithDigests to append build-tools=<sha256> only when the workflow topology is arc-dind.
Add the missing ghcr.io/github/gh-aw-firewall/build-tools:0.27.26 pin (image + digest + pinned_image) to embedded pin datasets.
Add regression coverage (unit + compile-level) to prevent future arc-dind build-tools pinning regressions, and regenerate workflow lockfiles.

Show a summary per file

Changed files

File	Description
pkg/workflow/awf_helpers.go	Include `build-tools` digest metadata in AWF `--image-tag` only for `arc-dind`.
pkg/workflow/awf_helpers_test.go	Add unit coverage for arc-dind inclusion / non-arc-dind exclusion of `build-tools` digest metadata.
pkg/workflow/docker_firewall_pin_compile_test.go	Add compile-level regression test asserting `build-tools` is digest-pinned for `arc-dind`.
.github/aw/actions-lock.json	Add `build-tools:0.27.26` digest pin entry.
pkg/actionpins/data/action_pins.json	Add `build-tools:0.27.26` digest pin entry (embedded pins).
pkg/workflow/data/action_pins.json	Add `build-tools:0.27.26` digest pin entry (workflow-embedded pins).
.github/workflows/ab-testing-advisor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/ace-editor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/agent-persona-explorer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/agent-performance-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/agentic-token-audit.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/agentic-token-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/agentic-token-trend-audit.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/ai-moderator.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/approach-validator.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/artifacts-summary.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/audit-workflows.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/auto-triage-issues.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/aw-failure-investigator.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/avenger.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/blog-auditor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/bot-detection.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/brave.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/breaking-change-checker.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/changeset.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/ci-coach.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/ci-doctor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/claude-code-user-docs-review.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/cli-consistency-checker.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/cli-version-checker.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/cloclo.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/code-scanning-fixer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/code-simplifier.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/commit-changes-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/contribution-check.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/constraint-solving-potd.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-agent-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-centralization-drilldown.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-centralization-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-cli-deep-research.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-pr-merged-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-opt.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/copilot-session-insights.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/craft.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-ambient-context-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-architecture-diagram.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-assign-issue-to-user.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-byok-ollama-test.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-caveman-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-choice-test.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-code-metrics.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-community-attribution.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-compiler-quality.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-credit-limit-test.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-doc-healer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-doc-updater.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-experiment-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-fact.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-file-diet.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-firewall-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-formal-spec-verifier.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-function-namer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-geo-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-hippo-learn.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-issues-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-malicious-code-scan.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-max-ai-credits-test.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-model-inventory.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-model-resolution.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-multi-device-docs-tester.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-news.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-observability-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-performance-summary.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-regulatory.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-reliability-review.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-repo-chronicle.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-safe-output-integrator.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-safe-output-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-safe-outputs-conformance.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-safeoutputs-git-simulator.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-secrets-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-semgrep-scan.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-sentrux-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-security-observability.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-security-red-team.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-skill-optimizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-spdd-spec-planner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-syntax-error-quality.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-team-evolution-insights.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-team-status.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-testify-uber-super-expert.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-token-consumption-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-windows-terminal-integration-builder.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-workflow-updater.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-yamllint-fixer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dead-code-remover.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/deep-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dependabot-burner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dependabot-go-checker.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dependabot-repair.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/deployment-incident-monitor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/designer-drift-audit.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/detection-analysis-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dev-hawk.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dev.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/dictation-prompt.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/discussion-task-miner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/docs-noob-tester.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/draft-pr-cleanup.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/duplicate-code-detector.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/daily-community-attribution.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/eslint-miner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/eslint-monster.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/eslint-refiner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/example-failure-category-filter.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/example-permissions-warning.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/example-workflow-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/firewall-escape.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/firewall.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/functional-pragmatist.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/github-mcp-structural-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/github-mcp-tools-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/glossary-maintainer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/go-fan.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/go-logger.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/go-pattern-detector.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/gpclean.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/grumpy-reviewer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/hippo-embed.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/hourly-ci-cleaner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/impeccable-skills-reviewer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/instructions-janitor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/issue-arborist.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/issue-monster.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/issue-triage-agent.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/jsweep.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/layout-spec-maintainer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/lint-monster.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/linter-miner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/lockfile-stats.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/mattpocock-skills-reviewer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/mcp-inspector.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/mergefest.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/metrics-collector.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/necromancer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/notion-issue-summary.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/objective-impact-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/org-health-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/outcome-collector.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/pdf-summary.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/plan.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/poem-bot.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/portfolio-analyst.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/pr-code-quality-reviewer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/pr-description-caveman.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/pr-nitpick-reviewer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/pr-sous-chef.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/pr-triage-agent.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/prompt-clustering-analysis.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/python-data-charts.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/q.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/release.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/repo-audit-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/repo-tree-map.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/refactoring-cadence.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/refiner.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/research.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/repository-quality-improver.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/ruflo-backed-task.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/safe-output-health.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/schema-consistency-checker.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/schema-feature-coverage.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/scout.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/security-compliance.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/security-review.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/semantic-function-refactor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/sergo.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/skillet.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/slide-deck-maintainer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-agent-all-merged.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-agent-all-none.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-agent-public-approved.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-agent-public-none.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-agent-scoped-approved.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-antigravity.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-call-workflow.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-ci.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-claude-on-copilot.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-claude.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-codex.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-copilot-arm.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-copilot-aoai-apikey.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-copilot-aoai-entra.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-copilot-sdk.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-copilot-sub-agents.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-copilot.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-crush.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-gemini.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-multi-pr.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-opencode.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-otel-backends.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-pi.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-project.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-service-ports.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-temporary-id.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-test-tools.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-workflow-call-with-inputs.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/smoke-workflow-call.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/spec-enforcer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/spec-extractor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/spec-librarian.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/stale-pr-cleanup.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/stale-repo-identifier.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/static-analysis-report.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/sub-issue-closer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/super-linter.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/technical-doc-writer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/terminal-stylist.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/test-quality-sentinel.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/tidy.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/typist.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/uk-ai-operational-resilience.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/unbloat-docs.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/update-astro.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/ubuntu-image-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/video-analyzer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/visual-regression-checker.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/weekly-blog-post-writer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/weekly-editors-health-check.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/weekly-issue-summary.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/workflow-generator.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/workflow-health-manager.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/workflow-normalizer.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.
.github/workflows/workflow-skill-extractor.lock.yml	Recompiled lockfile; includes firewall logs chmod fallback.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 264/264 changed files
Comments generated: 1
Review effort level: Low

+          # Best-effort permission fix for artifact upload (AWF cleanup may not have run)
+          sudo -n chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null || chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null || true


…l-fix-build-tools-image Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-07T14:55:09Z

@copilot merge main and recompile

Done — merged main, recompiled all 258 workflows, and updated the wasm golden files. All checks pass.

gh-aw-bot · 2026-07-07T15:45:22Z

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 11.9 AIC · ⌖ 7.75 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Initial plan

7e932d7

Copilot AI assigned Copilot and lpcox Jul 7, 2026

Copilot started work on behalf of lpcox July 7, 2026 13:55 View session

Copilot AI linked an issue Jul 7, 2026 that may be closed by this pull request

gh-aw-firewall build-tools image emits only the tag in v0.82.3 lock files (mising SHA pinning) #44040

Closed

Copilot AI and others added 2 commits July 7, 2026 14:02

Initial plan: add build-tools digest pinning for arc-dind topology

7ea877d

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

fix: add build-tools digest pinning for arc-dind topology (gh-aw#44040)

f7e2d8a

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix build-tools image to include SHA pinning in v0.82.3~~ fix: SHA-pin build-tools firewall image for arc-dind topology Jul 7, 2026

Copilot finished work on behalf of lpcox July 7, 2026 14:14

Copilot AI requested a review from lpcox July 7, 2026 14:14

pelikhan marked this pull request as ready for review July 7, 2026 14:34

Copilot AI review requested due to automatic review settings July 7, 2026 14:34

Copilot started reviewing on behalf of pelikhan July 7, 2026 14:36 View session

Copilot started work on behalf of pelikhan July 7, 2026 14:37 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Copilot AI and others added 2 commits July 7, 2026 14:44

Merge remote-tracking branch 'origin/main' into copilot/gh-aw-firewal…

8cbe420

…l-fix-build-tools-image Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

chore: merge main and recompile workflows

6d8143d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 7, 2026 14:55

Copilot AI requested a review from pelikhan July 7, 2026 14:55

pelikhan merged commit b7541e5 into main Jul 7, 2026
29 checks passed

pelikhan deleted the copilot/gh-aw-firewall-fix-build-tools-image branch July 7, 2026 15:44

github-actions Bot mentioned this pull request Jul 7, 2026

[pr-sous-chef] Run report — 18 nudged, 2 not nudged #44065

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: SHA-pin build-tools firewall image for arc-dind topology#44044

fix: SHA-pin build-tools firewall image for arc-dind topology#44044
pelikhan merged 5 commits into
mainfrom
copilot/gh-aw-firewall-fix-build-tools-image

Copilot AI commented Jul 7, 2026 •

edited

Loading

Uh oh!

pelikhan commented Jul 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI commented Jul 7, 2026

Uh oh!

Uh oh!

gh-aw-bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		# Best-effort permission fix for artifact upload (AWF cleanup may not have run)
		sudo -n chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null \|\| chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null \|\| true

Uh oh!

Conversation

Copilot AI commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan commented Jul 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI commented Jul 7, 2026

Uh oh!

Uh oh!

gh-aw-bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jul 7, 2026 •

edited

Loading