Bump Claude, Copilot, Zizmor, and MCP Gateway defaults

[Copilot]

Updates default agent CLI and scanner pins to their latest approved versions, regenerating compiled workflow locks to propagate the new runtime references.

• Agent CLIs

  • Claude Code: 2.1.220 → 2.1.222
  • GitHub Copilot CLI: 1.0.77 → 1.0.78
  • Synchronizes Copilot compatibility metadata and installer fallback.

• Container pins

  • Zizmor: 1.28.0 → 1.29.0 with the updated immutable digest.
  • Carries the MCP Gateway v0.4.8 default through regenerated workflow locks.

• Generated artifacts

  • Recompiled workflow lock files.
  • Refreshed the Claude WASM golden fixture.
  • Added a patch changeset.

const DefaultClaudeCodeVersion Version = "2.1.222"
const DefaultCopilotVersion Version = "1.0.78"

• Fixes [ca] CLI/Docker version check: 4 updates found (Claude Code, Copilot CLI, Zizmor, MCP Gateway) - 2026-08-05 #50505

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.3 AIC · ⌖ 9.76 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in merge commit fa450ab.

[Copilot]

Pull request overview

Updates approved agent CLI, scanner, and MCP Gateway defaults and propagates them through generated workflow artifacts.

Changes:

• Bumps Claude Code, Copilot CLI, Zizmor, and MCP Gateway pins.
• Synchronizes Copilot installer compatibility metadata.
• Refreshes generated locks, golden output, and release changeset.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates default runtime versions.
pkg/cli/docker_images.go	Pins Zizmor 1.29.0 and digest.
actions/setup/sh/install_copilot_cli.sh	Updates Copilot fallback version.
.github/aw/compat.json	Expands Copilot compatibility to 1.0.78.
.changeset/patch-bump-cli-scanner-versions.md	Adds patch release note.
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden	Refreshes Claude golden output.
.github/workflows/workflow-skill-extractor.lock.yml	Refreshes runtime pins.
.github/workflows/workflow-normalizer.lock.yml	Refreshes runtime pins.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Refreshes runtime pins.
.github/workflows/weekly-editors-health-check.lock.yml	Refreshes runtime pins.
.github/workflows/visual-regression-checker.lock.yml	Refreshes runtime pins.
.github/workflows/video-analyzer.lock.yml	Refreshes runtime pins.
.github/workflows/update-astro.lock.yml	Refreshes runtime pins.
.github/workflows/uk-ai-operational-resilience.lock.yml	Refreshes runtime pins.
.github/workflows/super-linter.lock.yml	Refreshes runtime pins.
.github/workflows/squad-game-planner.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-workflow-call.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-service-ports.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-multi-pr.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-copilot-small.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-copilot-sdk.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-ci.lock.yml	Refreshes runtime pins.
.github/workflows/smoke-checkout-pr-dispatch.lock.yml	Refreshes runtime pins.
.github/workflows/sighthound-security-scan.lock.yml	Refreshes runtime pins.
.github/workflows/repo-tree-map.lock.yml	Refreshes runtime pins.
.github/workflows/pr-nitpick-reviewer.lock.yml	Refreshes runtime pins.
.github/workflows/pr-description-caveman.lock.yml	Refreshes runtime pins.
.github/workflows/objective-impact-report.lock.yml	Refreshes runtime pins.
.github/workflows/notion-issue-summary.lock.yml	Refreshes runtime pins.
.github/workflows/layout-spec-maintainer.lock.yml	Refreshes runtime pins.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Refreshes runtime pins.
.github/workflows/firewall.lock.yml	Refreshes runtime pins.
.github/workflows/example-permissions-warning.lock.yml	Refreshes runtime pins.
.github/workflows/example-failure-category-filter.lock.yml	Refreshes runtime pins.
.github/workflows/designer-drift-audit.lock.yml	Refreshes runtime pins.
.github/workflows/daily-team-status.lock.yml	Refreshes runtime pins.
.github/workflows/daily-max-ai-credits-test.lock.yml	Refreshes runtime pins.
.github/workflows/daily-credit-limit-test.lock.yml	Refreshes runtime pins.
.github/workflows/daily-byok-ollama-test.lock.yml	Refreshes runtime pins.
.github/workflows/bot-detection.lock.yml	Refreshes runtime pins.
.github/workflows/agent-persona-explorer.lock.yml	Refreshes Copilot detection metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 133/233 changed files
• Comments generated: 0
• Review effort level: Balanced

[gh-aw-bot]

@copilot please refresh this branch if it is behind main, then run the pr-finisher skill and push any final polish before maintainer review.

Run: https://github.com/github/gh-aw/actions/runs/31058900780

Generated by 👨🍳 PR Sous Chef · gpt54
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.3 AIC · ⌖ 9.76 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.85.4