Update CI failure fixer AWF tooling

[vitek-karas]

Note

This PR description was generated with Copilot assistance.

Summary

Updates the generated CI Outer-Loop Failure Fixer workflow lock to use gh-aw-firewall 0.27.7 instead of 0.25.40.

This intentionally changes only the generated lock file pins for the AWF tooling/images used by the workflow. The workflow prompt/source is unchanged.

Rationale

A recent CI Outer-Loop Failure Fixer run posted a security review warning because threat detection could not parse a THREAT_DETECTION_RESULT record. Looking at that run showed the detector did not actually produce malformed output. Instead, the AWF sandbox failed before the detector could run because awf-squid did not become healthy:

dependency failed to start: container awf-squid is unhealthy

Newer gh-aw-firewall releases include sandbox/proxy startup hardening, including fixes in the Squid startup path. Updating the lock should pick up those AW tooling fixes and reduce these false parse-warning cases where threat detection never starts.

Validation

• Verified all gh-aw-firewall 0.25.40 references were removed from .github/workflows/ci-failure-fix.lock.yml.
• Verified the 0.27.7 agent, api-proxy, squid, and cli-proxy digests match the gh-aw-firewall v0.27.7 release manifest.
• Verified the diff only changes .github/workflows/ci-failure-fix.lock.yml.
• git diff --check passed.

Local gh aw compile/gh aw lint attempts did not complete in this Windows environment, so this PR keeps the change deliberately narrow to the release-version and digest pins in the generated lock.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR updates the pinned GitHub Agentic Workflows / AWF (gh-aw-firewall) tooling used by the “CI Outer-Loop Failure Fixer” workflow by bumping the lockfile from 0.25.40 to 0.27.7 (including updated image digests and schema URLs). This keeps the workflow’s compiled content the same while refreshing the sandbox/proxy components the workflow depends on.

Changes:

• Bumped ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid} image tags and digests to 0.27.7.
• Updated the referenced AWF version strings used for installing the AWF binary and for workflow metadata (GH_AW_INFO_AWF_VERSION).
• Updated AWF config schema URLs and the embedded imageTag string to reflect v0.27.7 and corresponding digests.

[davidnguyen-tech]

LGTM — all four 0.27.7 image digests match GHCR, and a local recompile with a newer gh-aw (v0.80.9, pinning 0.27.7) independently reproduces the identical SHAs. No leftover 0.25.40 refs either.

NOTE: this edits the generated .lock.yml but not the source .md, so a future gh aw compile will regenerate these pins from whatever gh-aw version is installed and might quietly revert them to 0.25.40 if that's the last version gh-aw knows of. Fine as a stop-gap — just worth a follow-up to pin it durably (bump the gh-aw toolchain + recompile) so it sticks.

Note

Drafted with GitHub Copilot.

[kotlarmilos]

LGTM, thanks!