chore: upgrade gh-aw-firewall v0.27.37 → v0.27.38 to clear critical CVE gate by Copilot · Pull Request #47469 · github/gh-aw

Copilot · 2026-07-23T05:17:39Z

The daily container image security scan (run 29966054717) failed because gh-aw-firewall v0.27.37 images carried critical CVEs that tripped the post-scan gate (critical_vulnerabilities == 0 check): agent (11), api-proxy (17), cli-proxy (17).

Changes

pkg/constants/version_constants.go — bump DefaultFirewallVersion v0.27.37 → v0.27.38
.github/aw/actions-lock.json — add v0.27.38 container pin entries (digests sourced from release containers.txt, verified via docker buildx imagetools inspect)
261 .lock.yml files — full recompile (make build && make recompile && make recompile) to pick up new image refs and SHA pins
13 golden test files — updated GH_AW_INFO_AWF_VERSION, imageTag, and schema URL references

v0.27.38 highlights

No new CLI flags or schema properties — no AWF*MinVersion bumps needed. Bug-fix release only:

Fix: exempt DIFC/cli-proxy host from proxy routing in isolation mode
Fix: exclude topology-attached MCP peers from agent proxy routing
Fix: skip squid log cleanup when squid never started

New image digests

Image	SHA256
`agent:0.27.38`	`cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243`
`api-proxy:0.27.38`	`cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c`
`cli-proxy:0.27.38`	`c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e`
`squid:0.27.38`	`6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917`

✨ PR Review Safe Output Test - Run 29983202532

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 76 AIC · ⌖ 19.6 AIC · ⊞ 6.1K · ◷
_{Comment /smoke-claude to run again}

The daily container image security scan (run/29966054717) failed because gh-aw-firewall v0.27.37 images had critical CVEs (agent: 11, api-proxy: 17, cli-proxy: 17 critical vulnerabilities) that triggered the gate check. Upgrade to v0.27.38 which includes bug fixes: - Exclude topology-attached MCP peers from agent proxy routing - Exempt DIFC/cli-proxy host from proxy routing in isolation mode - Skip squid log cleanup when squid never started No new AWF CLI flags or schema properties were introduced in v0.27.38, so no AWF*MinVersion constants need updating. Image digests for v0.27.38 (verified via containers.txt and docker buildx): - agent: sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243 - api-proxy: sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c - cli-proxy: sha256:c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e - squid: sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-23T05:50:37Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-23T05:50:40Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. This is a dependency upgrade (gh-aw-firewall v0.27.37 → v0.27.38) with only workflow lock files and testdata fixtures changed. Test Quality Sentinel analysis not required.

github-actions · 2026-07-23T05:50:41Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-07-23T05:50:45Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.

github-actions · 2026-07-23T05:53:06Z

⚠️ This PR cannot be accepted in its current form — it violates the project's contribution process.

What's Happening

The CONTRIBUTING.md for this project is very clear:

🚫 Traditional Pull Requests Are Not Enabled for non-Core team members: If you are not part of the core team, please do not create pull requests directly. Instead, you create detailed agentic plans in issues, discuss with the team, and a core team member will create and implement the PR for you using agents.

This PR appears to be authored by an agentic agent (app/copilot-swe-agent), but the contribution process requires that non-core contributors:

Create a detailed agentic plan in an issue (not a PR) describing what needs to be done
Discuss with the team in the issue
Wait for a core team member to implement the solution

The Issues

❌ Bypassed the discussion process — no linked issue showing prior discussion of the version upgrade
❌ No test coverage — 275 files changed with 10,414 net lines, but no test file changes in the diff

What Should Happen

If this is a security fix that needs an upgrade:

Create an issue with a detailed agentic plan describing the CVE details, why v0.27.38 resolves it, scope of changes, and expected downstream impact.
Tag the core team and discuss in the issue
Wait for a core team member to implement the PR

Note: If you are a core team member implementing this upgrade, the process concern is resolved. However, the PR should still include test validation for such a large change.

Review the gh-aw-firewall upgrade from v0.27.37 to v0.27.38 and create a GitHub issue with:
1. The CVE details and severity
2. An agentic implementation plan for the upgrade
3. Expected test changes needed
This will allow the core team to pick it up and implement it following the project contribution process.

Generated by ✅ Contribution Check · sonnet46 73.6 AIC · ⌖ 7.67 AIC · ⊞ 6.2K · ◷

github-actions

Review: gh-aw-firewall v0.27.37 → v0.27.38

This is a clean, mechanical firewall version bump to clear a critical CVE gate. All changes are consistent:

New digest entries added to actions-lock.json for all 4 firewall images (agent, api-proxy, cli-proxy, squid) at v0.27.38 with correct SHA256 pinning
All lock files updated with matching image references and GH_AW_INFO_AWF_VERSION env vars
No logic changes, no config drift, no stale references

LGTM ✅

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 14.8 AIC · ⌖ 5.17 AIC · ⊞ 5K

github-actions

Skills-Based Review 🧠

Applied /codebase-design — pure CVE remediation bump, no logic changes; approving.

📋 Review Summary

What was reviewed

pkg/constants/version_constants.go — DefaultFirewallVersion bumped v0.27.37 → v0.27.38 ✅
.github/aw/actions-lock.json — all four images (agent, api-proxy, cli-proxy, squid) have new SHA-pinned digests for v0.27.38 ✅
261 .lock.yml files — mechanically recompiled; manifest lines consistently updated ✅
13 golden test files — version references updated to match ✅

Positive Highlights

✅ Digest pinning is consistent across all four container images
✅ v0.27.37 entries retained in the lock file, preserving auditability of the previous pin
✅ PR description cites the triggering CVE scan run and links to release verification steps
✅ No AWF*MinVersion bumps needed — correctly omitted for a bug-fix-only release
✅ Golden tests updated consistently

This is a mechanical patch-level upgrade driven by a critical CVE gate failure. The change set is exactly what a make recompile should produce for a firewall version bump.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 19.1 AIC · ⌖ 4.58 AIC · ⊞ 6.7K
_{Comment /matt to run again}

github-actions

CVE remediation bump — LGTM

All four image digests (agent, api-proxy, cli-proxy, squid) are consistent across actions-lock.json, every awf-config.json inline blob, and the PR description. Version strings and schema URLs uniformly updated v0.27.37 -> v0.27.38. 261 lock files and 13 golden test files are machine-regenerated with no logic changes.

Digest spot-check:

agent: cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243
api-proxy: cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c
cli-proxy: c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e
squid: 6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917

All match across PR description, actions-lock.json, and sampled lock YAMLs. No issues found.

🔎 Code quality review by PR Code Quality Reviewer · sonnet46 45.5 AIC · ⌖ 4.56 AIC · ⊞ 5.7K
_{Comment /review to run again}

Copilot

Pull request overview

Upgrades the default firewall to v0.27.38 and regenerates pinned workflow artifacts to address critical CVEs.

Changes:

Bumps DefaultFirewallVersion.
Adds verified v0.27.38 container digests.
Regenerates workflow and WASM golden outputs.

WASM binary snapshots still contain v0.27.37 digests, and the required patch changeset is missing.

Show a summary per file

File	Description
`.github/aw/actions-lock.json`	Adds v0.27.38 pins.
`.github/workflows/*.lock.yml` (261 files)	Regenerates firewall references and digests.
`pkg/actionpins/data/action_pins.json`	Adds embedded container pins.
`pkg/constants/version_constants.go`	Bumps the default version.
`pkg/workflow/data/action_pins.json`	Mirrors new pins.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/{claude,codex,copilot,gemini,pi}.golden`	Updates engine golden outputs.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/{basic-copilot,playwright-cli-mode,smoke-copilot,with-imports}.golden`	Updates compile fixture outputs.
`pkg/workflow/testdata/wasm_golden/WasmBinary/basic-copilot.golden`	Updates WASM output; retains old digests.
`pkg/workflow/testdata/wasm_golden/WasmBinary/playwright-cli-mode.golden`	Updates WASM output; retains old digests.
`pkg/workflow/testdata/wasm_golden/WasmBinary/smoke-copilot.golden`	Updates WASM output; retains old digests.
`pkg/workflow/testdata/wasm_golden/WasmBinary/with-imports.golden`	Updates WASM output; retains old digests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 29/278 changed files
Comments generated: 5
Review effort level: Medium

@@ -434,7 +434,7 @@ jobs:
          GH_AW_SKILL_DIR: ".github/skills"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
      - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3


@@ -454,7 +454,7 @@ jobs:
          GH_AW_SKILL_DIR: ".github/skills"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
      - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3


@@ -593,7 +593,7 @@ jobs:
          GH_AW_SKILL_DIR: ".github/skills"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
      - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3 ghcr.io/github/serena-mcp-server:latest@sha256:bf343399e3725c45528f531a230f3a04521d4cdef29f9a5af6282ff0d3c393c5 mcr.microsoft.com/playwright/mcp
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3 ghcr.io/github/serena-mcp-server:latest@sha256:bf343399e3725c45528f531a230f3a04521d4cdef29f9a5af6282ff0d3c393c5 mcr.microsoft.com/playwright/mcp


@@ -435,7 +435,7 @@ jobs:
          GH_AW_SKILL_DIR: ".github/skills"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
      - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317 ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3


@@ -70,7 +70,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.6.0"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.27.37"
+const DefaultFirewallVersion Version = "v0.27.38"


pelikhan · 2026-07-23T06:10:20Z

@copilot update wasm golden to be resilient to version changes (normalize)

github-actions · 2026-07-23T06:10:58Z

🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧

github-actions · 2026-07-23T06:10:59Z

🌑 The shadows whisper... Smoke Codex failed to deliver outputs. The oracle requires further meditation...

github-actions · 2026-07-23T06:11:02Z

🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨

github-actions · 2026-07-23T06:11:05Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-07-23T06:11:05Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-07-23T06:13:16Z

✅ Smoke Copilot MAI completed successfully!

github-actions · 2026-07-23T06:14:42Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.54.0
jq	✅	1.7
yq	✅	4.53.3
curl	✅	8.5.0
gh	✅	2.96.0
node	✅	20.20.2
python3	✅	3.11.15 (PyPy 7.3.23)
go	✅	1.24.13
java	✅	10.0.301
dotnet	✅	10.0.301

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · sonnet46 16 AIC · ⌖ 7.97 AIC · ⊞ 5.9K · ◷
_{Comment /smoke-test-tools to run again}

github-actions · 2026-07-23T06:14:45Z

Smoke test FAIL

GitHub CLI: ✅
Web fetch: ✅
File write: ✅
Bash verify: ✅
Build: ❌

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

🥧 Smoke Pi — Powered by Pi · gpt54 2.6 AIC · ⌖ 5.16 AIC · ⊞ 4.5K · ◷
_{Comment /smoke-pi to run again}

github-actions · 2026-07-23T06:14:59Z

Smoke Test Results

GitHub MCP Testing: ✅
Web Fetch Testing: ✅
File Writing Testing: ✅
Bash Tool Testing: ✅
Build gh-aw: ❌

Overall Status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

✨ Smoke Gemini — Powered by Gemini · age00 11.1 AIC · ⌖ 1.51 AIC · ⊞ 9.3K · ◷
_{Comment /smoke-gemini to run again}

github-actions · 2026-07-23T06:16:28Z

Smoke Test summary: 30 commits in the last 24h, focused on security scanning/workflow automation and CLI/safe-outputs improvements.
Overall status: PASS
Run URL: https://github.com/github/gh-aw/actions/runs/29984252050

Generated by ⚡ Smoke Copilot MAI · mai10 3.09 AIC · ⌖ 1.46 AIC · ⊞ 18.8K · ◷
_{Comment /smoke-copilot-mai to run again}
_{Add label smoke to run again}

github-actions · 2026-07-23T06:19:58Z

Smoke Test 29984249953: tests 1,2,6 passed ✅; others failed ❌
Overall status: FAIL
@app/copilot-swe-agent @pelikhan @Copilot

📰 BREAKING: Report filed by Smoke Copilot - AOAI (apikey) · o40mini 13.9 AIC · ⌖ 3.89 AIC · ⊞ 18.2K · ◷
_{Comment /smoke-copilot-aoai-apikey to run again}
_{Add label smoke to run again}

github-actions · 2026-07-23T06:20:06Z

Smoke Test: Codex - 29983202629

Merged PRs: Clarify compiler-managed skill installation in .github/aw guidance; [jsweep] Clean write_large_content_to_file.cjs
Playwright: ❌
Web fetch: ❌
Build: ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex · gpt54 1.06 AIC · ⌖ 0.469 AIC · ⊞ 20.3K · ◷
_{Comment /smoke-codex to run again}

github-actions · 2026-07-23T06:20:07Z

Comment Memory

Quiet build at dawn
Symbols wake in measured light
Checks leave small footprints

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔮 The oracle has spoken through Smoke Codex · gpt54 1.06 AIC · ⌖ 0.469 AIC · ⊞ 20.3K · ◷
_{Comment /smoke-codex to run again}

github-actions · 2026-07-23T06:21:57Z

Comment Memory

Stone bot taps dark keys
Tiny sparks wake test tunnels
Green dawn says build lives

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

📰 BREAKING: Report filed by Smoke Copilot · gpt54 58.4 AIC · ⌖ 4.55 AIC · ⊞ 19.4K · ◷
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions · 2026-07-23T06:22:41Z

💥 Smoke Test Run 29983202532

Overall: PARTIAL

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 76 AIC · ⌖ 19.6 AIC · ⊞ 6.1K · ◷
_{Comment /smoke-claude to run again}

github-actions

💥 Automated smoke test review - all systems nominal! Run 29983202532.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 76 AIC · ⌖ 19.6 AIC · ⊞ 6.1K
_{Comment /smoke-claude to run again}

github-actions · 2026-07-23T06:22:47Z

      "digest": "sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67",
      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"
    },
+    "ghcr.io/github/gh-aw-firewall/agent:0.27.38": {


👍 New container image pins for v0.27.38 look correct. SHA digests match release artifacts. Smoke test Run 29983202532.

github-actions · 2026-07-23T06:22:47Z

@@ -1,5 +1,5 @@
 # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f58e9f677579006ed766220cf99992536a5d0fa8833ca870c11509dbfff05ca6","body_hash":"b7cb8146ee513d0babf1ed2942b26c60d25fd145d22e8073c1ecbc5d2c1a62e2","strict":true,"agent_id":"pi","agent_model":"copilot/gpt-5.4","engine_versions":{"pi":"0.80.10"}}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.37","digest":"sha256:1d5300d9b08e1c4f2ad1830860656a0656383a83280058f17e805a7c3ecda203","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.37@sha256:1d5300d9b08e1c4f2ad1830860656a0656383a83280058f17e805a7c3ecda203"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.3","digest":"sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.38","digest":"sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38","digest":"sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.38","digest":"sha256:c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.38@sha256:c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.38","digest":"sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.3","digest":"sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}


🔒 Lock file updated with new firewall image digests for v0.27.38. Pinned images follow the expected format. Smoke test Run 29983202532.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-23T06:23:37Z

@copilot update wasm golden to be resilient to version changes (normalize)

Addressed in 767e838. The tracked WASM snapshots are now normalized for AWF version-sensitive firewall references, and I regenerated the four WasmBinary goldens with the normalized form.

pelikhan · 2026-07-23T06:34:36Z

@copilot resolve the merge conflicts on this branch.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-23T06:53:03Z

@copilot resolve the merge conflicts on this branch.

Resolved in ae0796e by merging origin/main into this branch and regenerating .github/workflows/static-analysis-report.lock.yml to keep the merged workflow changes with the v0.27.38 firewall pins.

github-actions · 2026-07-23T12:16:36Z

🎉 This pull request is included in a new release.

Release: v0.83.1

Initial plan

e64f92e

Copilot AI assigned Copilot and pelikhan Jul 23, 2026

Copilot started work on behalf of pelikhan July 23, 2026 05:18 View session

Copilot AI changed the title ~~[WIP] Fix failure in Copilot actions run~~ chore: upgrade gh-aw-firewall v0.27.37 → v0.27.38 to clear critical CVE gate Jul 23, 2026

Copilot finished work on behalf of pelikhan July 23, 2026 05:47

Copilot AI requested a review from pelikhan July 23, 2026 05:47

pelikhan marked this pull request as ready for review July 23, 2026 05:48

Copilot AI review requested due to automatic review settings July 23, 2026 05:48

Copilot started reviewing on behalf of pelikhan July 23, 2026 05:49 View session

pelikhan added the smoke label Jul 23, 2026

github-actions Bot mentioned this pull request Jul 23, 2026

[Contribution Check Report] Contribution Check — 2026-07-23 #47444

Open

github-actions Bot approved these changes Jul 23, 2026

View reviewed changes

Copilot AI reviewed Jul 23, 2026

View reviewed changes

github-actions Bot temporarily deployed to aoai-model July 23, 2026 06:10 Inactive

Copilot started work on behalf of pelikhan July 23, 2026 06:11 View session

github-actions Bot mentioned this pull request Jul 23, 2026

[aw] Smoke Antigravity produced no safe outputs #47487

Open

github-actions Bot temporarily deployed to aoai-model July 23, 2026 06:19 Inactive

github-actions Bot mentioned this pull request Jul 23, 2026

Smoke Test: Copilot - AOAI (apikey) - 29984249953 #47492

Closed

github-actions Bot temporarily deployed to aoai-model July 23, 2026 06:20 Inactive

github-actions Bot temporarily deployed to aoai-model July 23, 2026 06:21 Inactive

github-actions Bot mentioned this pull request Jul 23, 2026

Smoke Test: Claude - 29983202532 #47498

Closed

github-actions Bot added the smoke-claude label Jul 23, 2026

github-actions Bot reviewed Jul 23, 2026

View reviewed changes

Normalize wasm golden firewall snapshots

767e838

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 23, 2026 06:24

Copilot started work on behalf of pelikhan July 23, 2026 06:35 View session

Merge origin/main into copilot/fix-copilot-failure

ae0796e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 23, 2026 06:53

pelikhan merged commit 83d5654 into main Jul 23, 2026

pelikhan deleted the copilot/fix-copilot-failure branch July 23, 2026 06:54

github-actions Bot mentioned this pull request Jul 23, 2026

Smoke Test: MAI-Code-1-Flash - 30022214548 #47616

Open

Uh oh!

Conversation

Copilot AI commented Jul 23, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

v0.27.38 highlights

New image digests

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026

What's Happening

The Issues

What Should Happen

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review: gh-aw-firewall v0.27.37 → v0.27.38

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

What was reviewed

Positive Highlights

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

CVE remediation bump — LGTM

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

pelikhan commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026

Agent Container Tool Check

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Comment Memory

Copilot AI commented Jul 23, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading