[release] 🌟 Release Highlights: v0.4.4

[github-actions]

🌟 Release Highlights

This release focuses on security hardening, reliability improvements, and documentation accuracy — strengthening the Rust guard, tightening DIFC labeling coverage, and ensuring documentation matches actual behavior.

✨ What's New

• assign_copilot_to_issue_with_intent DIFC coverage (#9844): The new Copilot issue-assignment tool is now fully classified in write-operation guards and DIFC labeling, ensuring correct security enforcement for AI-assisted workflows.

• Rust guard: GraphQL authorAssociation support (#9697): The Rust guard now correctly honors authorAssociation from GraphQL project item queries, improving trust classification accuracy for project-level events.

• Pinned container base images with drift guard (#9841): MCP Gateway container base images are now pinned by digest with an automated drift guard, reducing supply-chain risk.

• JSON Pointer error locations in config schema validation (#9698): Configuration schema errors now report locations as JSON Pointers (e.g., /servers/github/command), making misconfiguration easier to diagnose.

• Read-only stress workflows across runtimes (#9720): New stress test workflows validate MCP Gateway under default, gVisor, and Docker sandbox runtimes, increasing confidence in multi-runtime deployments.

🐛 Bug Fixes & Improvements

• Proxy --policy default aligned (#9779): The proxy flag's default now matches the shared environment config helpers, eliminating a subtle discrepancy.
• Deterministic HTTP transport reconnect tests (#9725): Flaky shutdown timing in reconnect-retry tests eliminated.
• HMAC body handling refactored (#9731): Shared request-body read/restore helper removes duplication and reduces potential for body-drain bugs.

📚 Documentation

• README and CONTRIBUTING reconciled (#9745): CLI flags, environment variables, and config behavior now accurately reflected. See the Configuration Reference.
• TOML 1.1 parsing documented (#9846): Config parsing behavior and error coverage clarified.
• Documentation inaccuracies fixed (#9876): Corrected claims about TOML unknown-key handling and JSON stdin required fields.

🐳 Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.4.4
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

---

For complete details, see the full release notes.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Release · 23.8 AIC · ⊞ 6.4K · ◷