feat: refresh gh-aw-node digest and replace manual scanner installs with gh aw compile flags by Copilot · Pull Request #47958 · github/gh-aw

Copilot · 2026-07-25T08:22:13Z

Bumps the pinned gh-aw-node image digest and replaces the manual syft/grype/grant binary installation in the daily container vulnerability workflow with the built-in gh aw compile --syft --grype --grant flags.

gh-aw-node digest bump

sha256:529d02e → sha256:a808216

Updated in:

.github/aw/actions-lock.json (source of truth)
pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json (via make sync-action-pins)
pkg/workflow/docker_pin_test.go (hardcoded expected value)
All 261 .lock.yml files (via make recompile)

daily-squid-image-scan refactor

Removes the separate scan_image pre-job and its ~300-line shell script that manually downloaded, checksum-verified, and ran syft/grype/grant binaries. Replaces with agent pre-steps that build gh-aw and invoke the compiler's built-in scanner flags:

steps:
  - name: Build gh-aw from source
    run: make build && "$GITHUB_WORKSPACE/gh-aw" --version
  - name: Pull security scanner Docker images
    run: |
      docker pull anchore/syft:v1.48.0
      docker pull anchore/grype:latest
      docker pull anchore/grant:latest
  - name: Run compile with vulnerability scanners
    continue-on-error: true
    run: |
      "$GITHUB_WORKSPACE/gh-aw" compile --syft --grype --grant \
        2>&1 | tee /tmp/gh-aw/agent/image-scan/compile-output.txt || true

The post-step gates now grep the compiler text output for [Critical] (grype) and license policy violation: (grant) instead of parsing a bespoke JSON summary. Other changes: packages: read added to permissions, go added to network allowlist, timeout raised to 90 min.

…lity scanner to use gh aw compile builtin flags Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-07-25T08:25:23Z

@copilot

remove predownload container step
pin grant, grype to release ref in Go
ensure gh-aw-node is mart of gh-aw-manifest when used

…gest in test - Pin GrypeImage to anchore/grype:v0.116.0 (was :latest) - Pin GrantImage to anchore/grant:v0.6.8 (was :latest) - Remove manual 'Pull security scanner Docker images' step from daily-squid-image-scan.md - Fix TestCollectDockerImages_SafeOutputsAddsGhAwNodeImage: update hardcoded gh-aw-node digest to sha256:a8082161... (missed in previous commit) - Recompile all 261 lock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-25T08:57:25Z

@copilot

remove predownload container step...

Done in the latest commit. Here's what was addressed:

Remove predownload container step — Removed the Pull security scanner Docker images step from daily-squid-image-scan.md. The gh aw compile --syft --grype --grant command handles image availability internally via CheckAndPrepareDockerImages.

Pin grant, grype to release ref in Go — GrypeImage is now anchore/grype:v0.116.0 and GrantImage is now anchore/grant:v0.6.8 in pkg/cli/docker_images.go, matching the versions previously used in the manual install script.

gh-aw-node in gh-aw-manifest — ghcr.io/github/gh-aw-node is already consistently tracked in DockerImagePins (and thus the gh-aw-manifest containers list) for all compiled workflows: collectDockerImages adds it whenever safe-outputs is enabled, which always applies via applyDefaultCreateIssue. I also fixed a missed test update in TestCollectDockerImages_SafeOutputsAddsGhAwNodeImage where the hardcoded gh-aw-node digest still referenced the old sha256:529d02eb... value instead of the updated sha256:a8082161....

Copilot

Pull request overview

Refreshes the gh-aw-node digest and simplifies daily container scanning through built-in compiler scanners.

Changes:

Synchronizes the new node image digest across pin data, tests, and generated workflows.
Pins Grype and Grant versions.
Refactors the daily image scan workflow around --syft --grype --grant.

Show a summary per file

File	Description
`.github/aw/actions-lock.json`	Updates the canonical node digest.
`pkg/actionpins/data/action_pins.json`	Synchronizes action-pin data.
`pkg/workflow/data/action_pins.json`	Synchronizes embedded workflow pins.
`pkg/workflow/docker_pin_test.go`	Updates expected digest assertions.
`pkg/cli/docker_images.go`	Pins Grype and Grant release tags.
`.github/workflows/daily-squid-image-scan.md`	Replaces the bespoke scan job with compiler scanners.
`.github/workflows/daily-squid-image-scan.lock.yml`	Compiles the refactored scan workflow.
`.github/workflows/*.lock.yml` (260 remaining files)	Regenerates workflows with the refreshed node digest.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (3)

.github/workflows/daily-squid-image-scan.md:42

The scan can now pass when compilation or any scanner fails. || true discards the compiler status, and non-strict Syft/Grype/Grant failures are only printed as * scan failed warnings; the post-step merely checks that this output file exists and greps two finding patterns. Record and gate the compiler exit status and explicitly fail on scanner operational-error messages, preserving the previous operational_errors gate.
.github/workflows/daily-squid-image-scan.md:71
The agent cannot actually review the promised Syft SBOM. --syft writes JSON under /tmp/gh-aw-syft-sboms, but without --verbose neither its path nor contents reach compile-output.txt, and the bash allowlist only permits reading that text file. Expose and allow-read the SBOM artifacts, or remove the Syft-review requirement.
.github/workflows/daily-squid-image-scan.md:42
The built-in scanner path never resolves each mutable image tag's current digest, so this workflow no longer detects image updates even though its description still promises update scanning. Restore the imagetools inspect digest comparison (or explicitly narrow the workflow's stated scope) rather than silently dropping that signal.

Files reviewed: 112/267 changed files
Comments generated: 2
Review effort level: Medium

Copilot · 2026-07-25T10:06:22Z

+  - name: Run compile with vulnerability scanners
    continue-on-error: true
-    uses: actions/download-artifact@v8.0.1
-    with:
-      name: container-image-scan
-      path: /tmp/gh-aw/agent/image-scan
-  - name: Ensure image scan summary exists
-    if: always()
-    env:
-      DOWNLOAD_OUTCOME: ${{ steps.download_scan.outcome }}
    run: |
-      results="/tmp/gh-aw/agent/image-scan"
-      mkdir -p "$results"
-      if [ "$DOWNLOAD_OUTCOME" != "success" ] ||
-         ! jq -e 'type == "object"' "$results/summary.json" > /dev/null 2>&1; then
-        jq -n '{
-          images: [],
-          total_vulnerabilities: 0,
-          critical_vulnerabilities: 0,
-          fixable_vulnerabilities: 0,
-          license_rejected: false,
-          operational_errors: ["The scan job did not publish a valid result artifact."],
-          tools: {
-            syft: "unknown",
-            grype: "unknown",
-            grant: "unknown"
-          }
-        }' > "$results/summary.json"
-      fi
+      set -uo pipefail
+      output_dir="/tmp/gh-aw/agent/image-scan"
+      mkdir -p "$output_dir"
+      "$GITHUB_WORKSPACE/gh-aw" compile --syft --grype --grant 2>&1 | tee "$output_dir/compile-output.txt" || true


Acknowledged. The compiler's built-in --syft/--grype/--grant flags currently resolve to the runner's native architecture (linux/amd64 on GitHub-hosted runners) and do not support per-platform child-digest enumeration. This is a genuine coverage reduction compared to the old explicit platform-iteration loop.

Adding multi-arch/--platform support to the compiler scanners is out of scope for this PR (it would require changes to the CheckAndPrepareDockerImages → StartDockerImageDownload path and the scanner invocations). The daily-squid-image-scan workflow's primary purpose here is simplified operation via the compiler's built-in flags; the arm64 coverage gap can be addressed as a follow-up once multi-platform support is added to the compiler.

Copilot · 2026-07-25T10:06:14Z

+	GrypeImage       = "anchore/grype:v0.116.0"
+	GrantImage       = "anchore/grant:v0.6.8"


Fixed in the latest commit. Syft, Grype, and Grant are now pinned by immutable manifest digest alongside the human-readable version tag in pkg/cli/docker_images.go:

anchore/syft:v1.48.0@sha256:b4f1df79f97b817682d8b5ff941eb6bfe74f6172553a5e312c75bbc2eabc405c

anchore/grype:v0.116.0@sha256:fd4ab4d1042b522c896e73bdf09ab8bf384fa417df99d6dd0d6e1008c7e7c821

anchore/grant:v0.6.8@sha256:172463611795f43b77302cdfbd7b3f81295492a7330e0820cfe41c3674920237

gh-aw-bot · 2026-07-25T09:42:11Z

@copilot this branch has merge conflicts. Please run make merge-main to merge the latest main branch and resolve any conflicts, then push the result. After that, run the pr-finisher skill and rerun checks.

Run: https://github.com/github/gh-aw/actions/runs/30152885438

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.3 AIC · ⌖ 8.82 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

pelikhan · 2026-07-25T09:51:16Z

@copilot merge main and recompile

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-25T09:59:31Z

@copilot this branch has merge conflicts. Please run make merge-main to merge the latest main branch and resolve any conflicts, then push the result. After that, run the pr-finisher skill and reru...

Merged origin/main and resolved the single conflict in .github/workflows/daily-multi-device-docs-tester.lock.yml (it was only in the metadata/manifest header comments). Recompiled all 261 workflows cleanly — commit merge: resolve conflicts with origin/main and recompile workflows.

pelikhan · 2026-07-25T10:00:11Z

@copilot merge main and recompile

…digest Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-25T10:20:24Z

@copilot merge main and recompile

Completed in the latest commit. All 261 workflows recompiled cleanly after merging origin/main.

@copilot merge main and recompile

Done — merged 6 new commits from main, resolved all lock-file conflicts (taking our versions and recompiling), 261/261 workflows compiled cleanly.

github-actions · 2026-07-25T11:49:41Z

🎉 This pull request is included in a new release.

Release: v0.83.3

feat: update gh-aw-node digest and refactor daily container vulnerabi…

11ad752

…lity scanner to use gh aw compile builtin flags Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Jul 25, 2026

Copilot AI changed the title ~~feat: update gh-aw-node digest and refactor daily container vulnerability scanner~~ feat: refresh gh-aw-node digest and replace manual scanner installs with gh aw compile flags Jul 25, 2026

Copilot finished work on behalf of pelikhan July 25, 2026 08:22

Copilot AI requested a review from pelikhan July 25, 2026 08:22

Copilot created this pull request from a session on behalf of pelikhan July 25, 2026 08:22 View session

Copilot started work on behalf of pelikhan July 25, 2026 08:26 View session

Copilot finished work on behalf of pelikhan July 25, 2026 08:58

pelikhan marked this pull request as ready for review July 25, 2026 08:58

Copilot AI review requested due to automatic review settings July 25, 2026 08:58

github-actions Bot mentioned this pull request Jul 25, 2026

Smoke Test: Copilot - 30151690498 #47964

Closed

Copilot started reviewing on behalf of pelikhan July 25, 2026 08:58 View session

Copilot AI reviewed Jul 25, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 25, 2026

[pr-sous-chef] PR Sous Chef run report - 2026-07-25T00:16:35Z #47879

Open

Copilot started work on behalf of gh-aw-bot July 25, 2026 09:42 View session

merge: resolve conflicts with origin/main and recompile workflows

dbd9d41

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

fix: pin Syft, Grype, and Grant scanner images by immutable manifest …

9bdf1de

…digest Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 25, 2026 10:09

Copilot AI requested a review from gh-aw-bot July 25, 2026 10:09

Copilot started work on behalf of pelikhan July 25, 2026 10:09 View session

merge: sync with origin/main and recompile 261 workflows

719952c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 25, 2026 10:21

pelikhan merged commit b369ee9 into main Jul 25, 2026
24 checks passed

pelikhan deleted the copilot/update-gh-aw-node-digest branch July 25, 2026 10:53

github-actions Bot mentioned this pull request Jul 25, 2026

Smoke Test: MAI-Code-1-Flash - 30162378433 #48022

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: refresh gh-aw-node digest and replace manual scanner installs with gh aw compile flags#47958

feat: refresh gh-aw-node digest and replace manual scanner installs with gh aw compile flags#47958
pelikhan merged 5 commits into
mainfrom
copilot/update-gh-aw-node-digest

Copilot AI commented Jul 25, 2026 •

edited

Loading

Uh oh!

pelikhan commented Jul 25, 2026

Uh oh!

Copilot AI commented Jul 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 25, 2026

Uh oh!

Copilot AI Jul 25, 2026

Uh oh!

gh-aw-bot commented Jul 25, 2026

Uh oh!

pelikhan commented Jul 25, 2026

Uh oh!

Copilot AI commented Jul 25, 2026

Uh oh!

pelikhan commented Jul 25, 2026

Uh oh!

Copilot AI commented Jul 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		GrypeImage = "anchore/grype:v0.116.0"
		GrantImage = "anchore/grant:v0.6.8"

Uh oh!

Conversation

Copilot AI commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gh-aw-node digest bump

daily-squid-image-scan refactor

Uh oh!

pelikhan commented Jul 25, 2026

Uh oh!

Copilot AI commented Jul 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Jul 25, 2026

Uh oh!

pelikhan commented Jul 25, 2026

Uh oh!

Copilot AI commented Jul 25, 2026

Uh oh!

pelikhan commented Jul 25, 2026

Uh oh!

Copilot AI commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 25, 2026 •

edited

Loading

Copilot AI commented Jul 25, 2026 •

edited

Loading