Skip to content

Upgrade gh-aw extension to v0.82.14 pre-release and recompile workflows - #9736

Merged
lpcox merged 1 commit into
mainfrom
upgrade-gh-aw-pre-release-july20
Jul 20, 2026
Merged

Upgrade gh-aw extension to v0.82.14 pre-release and recompile workflows#9736
lpcox merged 1 commit into
mainfrom
upgrade-gh-aw-pre-release-july20

Conversation

@lpcox

@lpcox lpcox commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

Upgrades the gh-aw extension from v0.82.12 to v0.82.14 (pre-release) and recompiles all workflows.

Changes

  • gh-aw extension: v0.82.12 → v0.82.14
  • Codemods applied: Moved engine.model to top-level model in 2 workflows (github-mcp-guard-coverage-checker.md, nightly-schema-updater.md)
  • GitHub Actions updated:
    • github/gh-aw-actions/setup-cli v0.82.12 → v0.82.14
    • github/gh-aw-actions/setup v0.82.12 → v0.82.14
    • actions/checkout v7.0.0 → v7.0.1
    • actions/setup-python v6.3.0 → v7.0.0
  • Recompiled all 36 workflow lock files

Verification

✅ make agent-finished passed (format, build, lint, unit tests, integration tests, Rust guard tests)

@lpcox
Upgrade gh-aw extension to v0.82.14 pre-release and recompile workflows
f97db31 
- Upgraded gh-aw from v0.82.12 to v0.82.14
- Applied codemods: moved engine.model to top-level model in 2 workflows
- Updated GitHub Actions versions:
  - github/gh-aw-actions/setup-cli v0.82.12 → v0.82.14
  - github/gh-aw-actions/setup v0.82.12 → v0.82.14
  - actions/checkout v7.0.0 → v7.0.1
  - actions/setup-python v6.3.0 → v7.0.0
- Recompiled all 36 workflow lock files

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 20, 2026 22:11
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part Surface Op Result Expected Status
A MCP list_issues 3 issues returned ALLOWED ✅
A MCP list_pull_requests 3 PRs returned ALLOWED ✅
A MCP get_file_contents (README.md) content returned ALLOWED ✅
A MCP list_commits 3 commits returned ALLOWED ✅
B MCP add_issue_reaction Error [-32602]: unknown tool (gateway) BLOCKED ✅
B MCP star_repository Error [-32602]: unknown tool (gateway) BLOCKED ✅
B MCP create_issue Error [-32602]: unknown tool (gateway) BLOCKED ✅
B MCP add_issue_comment Error [-32602]: unknown tool (gateway) BLOCKED ✅
B MCP create_branch Error [-32602]: unknown tool (gateway) BLOCKED ✅
B MCP create_or_update_file Error [-32602]: unknown tool (gateway) BLOCKED ✅
B MCP create_pull_request Error [-32602]: unknown tool (gateway) BLOCKED ✅
C CLI list_issues (github CLI) 3 issues returned ALLOWED ✅
C CLI get_file_contents (github CLI) content returned ALLOWED ✅
D CLI REST writes (reaction/star/issue/comment/file) gh unauthenticated BLOCKED ✅
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh unauthenticated BLOCKED ✅

Notes:

  • Part B: All 7 write tools rejected by the gateway in ~5ms with JSON-RPC -32602: unknown tool. Gateway exposes only 22 read-only tools; write tools are absent from the allowlist entirely.
  • Parts D & E: gh has no GH_TOKEN in this runtime; all REST/GraphQL write attempts rejected immediately — no network call reached GitHub.

Overall: PASS

References: §29783045079

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part Surface Op Result Expected Status
A MCP reads data returned ALLOWED ✅
B MCP writes (reaction/star/issue/comment/branch/file/PR) Error [-32602]: unknown tool BLOCKED ✅
C CLI reads data returned ALLOWED ✅
D CLI REST writes (reaction/star/issue/comment/file) gh unauthenticated BLOCKED ✅
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh unauthenticated BLOCKED ✅

Overall: PASS

Notes:

  • Part B: gateway exposes only 22 read-only tools; all write calls return MCP [-32602]: unknown tool — gateway-enforced
  • Parts D/E: gh has no GH_TOKEN; all REST/GraphQL write attempts rejected at auth layer

References: §29783045136

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

Copilot AI reviewed Jul 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Upgrades gh-aw to v0.82.14, applies model-field codemods, refreshes action pins, and recompiles all agentic workflows.

Changes:

  • Moves two workflows to the top-level model field.
  • Updates GitHub Actions and gh-aw action versions.
  • Regenerates all 36 workflow lock files.
Show a summary per file
File Description
.github/aw/actions-lock.json Updates action versions and SHAs.
.github/workflows/test-coverage-improver.md Updates checkout to v7.0.1.
.github/workflows/release.md Updates checkout to v7.0.1.
.github/workflows/nightly-schema-updater.md Moves model to top level.
.github/workflows/github-mcp-guard-coverage-checker.md Moves model to top level.
.github/workflows/daily-compliance-checker.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/duplicate-code-detector.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/gateway-issue-dispatcher.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/ghcr-download-tracker.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/github-mcp-guard-coverage-checker.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/go-fan.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/go-logger.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/gpl-dependency-checker.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/guard-status-tracker.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/integrity-filtering-audit.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/issue-monster.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/large-payload-tester.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/mcp-gateway-log-analyzer.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/nightly-docs-reconciler.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/nightly-schema-updater.lock.yml Recompiled with migrated model configuration.
.github/workflows/nightly-workflow-compiler.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/plan.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/readonly-stress-default.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/readonly-stress-gvisor.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/readonly-stress-sbx.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/release.lock.yml Recompiled with updated actions.
.github/workflows/repo-assist.lock.yml Recompiled, but retains a stale checkout pin.
.github/workflows/rust-guard-improver.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/semantic-function-refactor.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-allowonly.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-copilot.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-long-session.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-otel-tracing.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-proxy-github-script.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-safeoutputs-discussions.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-safeoutputs-issues.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-safeoutputs-labels.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-safeoutputs-prs.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/smoke-safeoutputs-reviews.lock.yml Recompiled with gh-aw v0.82.14.
.github/workflows/test-coverage-improver.lock.yml Recompiled with updated actions.
.github/workflows/test-improver.lock.yml Recompiled with gh-aw v0.82.14.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 34/41 changed files
  • Comments generated: 1
  • Review effort level: Medium

Comment thread .github/workflows/repo-assist.lock.yml
# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"23fd0ef1f0a76a3707df928f9c733abd98e4ec75","version":"v0.82.12"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
# This file was automatically generated by gh-aw (v0.82.12). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"fba3e6ba7b33d6d351d55d34ab87e351834fe75330ab846af687f58f41f2244d","body_hash":"b650bc2164f4675fdf55f265904a4714f72dbbb3c13a333ab03cf46b531a45bf","compiler_version":"v0.82.14","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.71"}}
# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part Surface Op Result Expected Status
A MCP reads (issues/PRs/file/commits) data returned ALLOWED ✅
B MCP writes (reaction/star/issue/comment/branch/file/PR) unknown tool -32602 BLOCKED ✅
C CLI reads (issues/file) data returned ALLOWED ✅
D CLI REST writes (reaction/star/issue/comment/file) gh unauthenticated BLOCKED ✅
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh unauthenticated BLOCKED ✅

Overall: PASS

Notes:

  • Part B: All 7 write tools absent from gateway-filtered tool list (MCP error -32602 — gateway enforcement confirmed).
  • Parts D & E: gh CLI has no GH_TOKEN in this runtime; all REST/GraphQL write attempts rejected before reaching GitHub API.

References: §29783045113

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

@lpcox
lpcox merged commit 1a0478d into main Jul 20, 2026
45 checks passed
@lpcox
lpcox deleted the upgrade-gh-aw-pre-release-july20 branch July 20, 2026 22:18
This was referenced Jul 20, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

readonly-stress-pass-default readonly-stress-pass-gvisor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lpcox