fix: upgrade cli-proxy gh to 2.97.0 by lpcox · Pull Request #6845 · github/gh-aw-firewall

lpcox · 2026-08-02T17:33:29Z

Summary

upgrade the CLI-proxy image from gh 2.96.0 to 2.97.0 using official per-architecture checksums
pick up google.golang.org/grpc 1.82.1 and golang.org/x/text 0.40.0
remove the obsolete Grype exceptions for GHSA-hrxh-6v49-42gf and GO-2026-5970

Testing

npm test -- --runInBand (4,964 passed, 1 skipped)
npm run lint
npm run build
verified the release artifact checksum and embedded Go module versions

Upgrade the cli-proxy image to the first gh release containing patched grpc and x/text dependencies. Remove the obsolete Grype exceptions. Closes #6555 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 95adf431-ca48-4118-bb79-bd1cfc0f9feb

Copilot

Pull request overview

Upgrades the CLI-proxy’s GitHub CLI binary to 2.97.0, resolving vulnerable embedded dependencies and removing obsolete scanner exceptions.

Changes:

Updates per-architecture GitHub CLI binaries and checksums.
Removes resolved gRPC and x/text Grype exceptions.

Show a summary per file

File	Description
`containers/cli-proxy/Dockerfile`	Pins GitHub CLI 2.97.0 with verified checksums.
`.grype.yaml`	Removes obsolete vulnerability suppressions.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 0
Review effort level: Balanced

github-actions · 2026-08-02T17:46:18Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-08-02T17:46:18Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-08-02T17:46:21Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-08-02T17:46:21Z

✅ Smoke Claude passed

github-actions · 2026-08-02T17:46:23Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-08-02T17:46:24Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-08-02T17:46:24Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-08-02T17:46:26Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-08-02T17:46:28Z

✅ Contribution Check completed successfully!

Contribution check complete — no guideline issues found in PR #6845. The PR has a clear description, references related issue #6555, includes tests/build/lint validation in the description, and places changes in the correct container config file. No comment needed.

github-actions · 2026-08-02T17:46:29Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-08-02T17:46:30Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

github-actions · 2026-08-02T17:46:31Z

✅ Build Test Suite completed successfully!

github-actions · 2026-08-02T17:46:34Z

✅ Security Guard completed successfully!

PR #6845 reviewed: gh CLI upgrade 2.96.0→2.97.0 in cli-proxy container. No security weakening detected. Checksums updated correctly for all architectures. No firewall rules, capabilities, egress policies, or ACLs modified. This is a standard dependency update with no security concerns.

github-actions · 2026-08-02T17:46:35Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-08-02T17:46:59Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-08-02T17:47:42Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS ✅

Generated by Smoke Claude for #6845 · haiku45 · 54.8 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:48:11Z

@lpcox Network isolation egress smoke test results:

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Denied domain (example.com) blocked: CONNECT tunnel failed (403)

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:48:26Z

Smoke Test: Copilot Engine — PASS ✅

MCP connectivity: ✅ (PR chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows #6844, PR test: fix gvisor runtime matrix fixture #6832 fetched)
GitHub.com connectivity: ✅ (HTTP 200)
File write/read: ✅

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:48:29Z

🔥 Smoke Test: Copilot BYOK (Direct) Mode

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

✅ GitHub MCP: PR chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows #6844 (chore: upgrade gh-aw to v0.84.2...), PR test: fix gvisor runtime matrix fixture #6832 (test: fix gvisor runtime matrix fixture)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference test

Overall: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:48:48Z

Smoke Test: GitHub Actions Services Connectivity

Redis PING: ❌ (name resolution failure)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (name resolution failure)

Overall: FAIL — host.docker.internal could not be resolved from the sandbox; all connectivity checks failed with "Temporary failure in name resolution".

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:49:01Z

📡 OTel Tracing Smoke Test Results

Scenario	Result
1. Module Loading	✅ `otel.js` loads successfully; `isEnabled()` returns `true`; exports: `startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, _parseOtlpHeaders, _buildResourceSpans`, etc.
2. Test Suite	✅ 59/59 tests passed (2 suites: `otel.test.js`, `otel-fanout.test.js`) — 0 failures
3. Env Var Forwarding	⚠️ `src/services/api-proxy-service.ts` does not yet forward `OTEL_EXPORTER_OTLP_ENDPOINT` / `GITHUB_AW_OTEL_TRACE_ID` (expected during development — not yet wired up)
4. Token Tracker Integration	✅ `token-tracker-http.js` contains `onUsage` callback (4 references) — OTEL hook point present
5. OTEL Diagnostics	⚠️ No `/tmp/gh-aw/sandbox/firewall/logs/api-proxy/otel.jsonl` produced this run — no live api-proxy invocation occurred in this smoke test, so no spans were exported

Summary: Core OTEL module (span creation, token usage attributes via GenAI semantic conventions, OTLP export, graceful degradation) is fully implemented and unit-tested (59/59 passing). Remaining gap: env var forwarding from api-proxy-service.ts to the container is not yet implemented — this is expected/pending development work, not a regression. No unexpected failures detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:49:26Z

Gemini Smoke Test Results

GitHub MCP Testing: ❌ (Tools missing)
GitHub.com Connectivity: ❌ (Status 000)
File Writing Testing: ✅
Bash Tool Testing: ✅

PR Title:

test: add coverage for docker-manager barrel re-exports ([Test Coverage] src/docker-manager.ts #6817)

Overall Status: FAIL

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:50:15Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

All repositories cloned successfully.
Java: Maven required -Dmaven.repo.local override (default ~/.m2/repository was owned by root in this environment, not writable by the runner user); ~/.m2/settings.xml proxy config applied as instructed.
No failures encountered in any ecosystem.

Generated by Build Test Suite for #6845 · auto · 39.9 AIC · ⊞ 11.4K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:50:15Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. smoke-chroot label not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:50:45Z

Smoke test summary:

chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows ✅
test: fix gvisor runtime matrix fixture ✅
Overall: FAIL
Build failed during npm ci with 403 Forbidden fetching yocto-queue from registry.npmjs.org

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T17:51:17Z

Smoke Test: Docker Sbx Validation

✅ GitHub MCP connectivity verified
✅ github.com connectivity (HTTP 200)
✅ File write/read test passed

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

Copilot AI review requested due to automatic review settings August 2, 2026 17:33

Copilot started reviewing on behalf of lpcox August 2, 2026 17:33 View session

Copilot AI reviewed Aug 2, 2026

View reviewed changes

lpcox added the ready-for-aw label Aug 2, 2026

lpcox had a problem deploying to aoai-model August 2, 2026 17:46 — with GitHub Actions Failure

github-actions Bot added the smoke-claude label Aug 2, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 2, 2026

lpcox temporarily deployed to aoai-model August 2, 2026 17:48 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot label Aug 2, 2026

github-actions Bot added the smoke-copilot-byok label Aug 2, 2026

lpcox temporarily deployed to aoai-model August 2, 2026 17:48 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Aug 2, 2026

[aw] No-Op Runs #6709

Open

github-actions Bot added the build-test label Aug 2, 2026

github-actions Bot added the smoke-docker-sbx label Aug 2, 2026

lpcox merged commit 927b24c into main Aug 2, 2026
135 of 138 checks passed

lpcox deleted the fix-gh-cli-297 branch August 2, 2026 18:09

Uh oh!

Conversation

lpcox commented Aug 2, 2026

Summary

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: Copilot Engine — PASS ✅

Uh oh!

github-actions Bot commented Aug 2, 2026

🔥 Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

github-actions Bot commented Aug 2, 2026

📡 OTel Tracing Smoke Test Results

Uh oh!

github-actions Bot commented Aug 2, 2026

Gemini Smoke Test Results

Uh oh!

github-actions Bot commented Aug 2, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Aug 2, 2026

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading