chore: bump firewall version to v0.27.30#45025
Merged
Merged
Conversation
…MinVersion TODO Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Bump firewall version to v0.27.30
chore: bump firewall version to v0.27.30
Jul 12, 2026
Contributor
🤖 PR Triage
Rationale: Firewall version bump + resolves
|
Contributor
There was a problem hiding this comment.
Pull request overview
Bumps gh-aw-firewall from v0.27.29 to v0.27.30, activates gVisor/docker-sbx runtime support, and refreshes generated artifacts.
Changes:
- Updates firewall and container-runtime minimum versions.
- Adds v0.27.30 image digests and regenerated locks/goldens.
- Updates runtime gating and pinning tests.
Show a summary per file
| File | Description |
|---|---|
pkg/constants/version_constants.go |
Updates firewall version gates. |
pkg/workflow/gvisor_test.go |
Updates gVisor gating expectations. |
pkg/workflow/docker_sbx_test.go |
Preserves old-version rejection coverage. |
pkg/workflow/docker_firewall_pin_compile_test.go |
Updates expected image digests. |
pkg/workflow/data/action_pins.json |
Adds v0.27.30 pins. |
pkg/actionpins/data/action_pins.json |
Adds v0.27.30 pins. |
.github/aw/actions-lock.json |
Adds repository-level pins. |
.github/workflows/example-permissions-warning.lock.yml |
Regenerates workflow output. |
.github/workflows/codex-github-remote-mcp-test.lock.yml |
Regenerates workflow output. |
.github/workflows/bot-detection.lock.yml |
Regenerates workflow output. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden |
Refreshes firewall output. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden |
Refreshes firewall output. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden |
Refreshes firewall output. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden |
Refreshes firewall output. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden |
Refreshes Pi output. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden |
Refreshes Gemini output. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden |
Refreshes Copilot output. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden |
Refreshes Codex output. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden |
Refreshes Claude output. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 35/272 changed files
- Comments generated: 4
- Review effort level: Medium
| // Until then, no released AWF binary accepts containerRuntime, so the compiler must not | ||
| // emit the field for workflows pinned to any currently-available version. | ||
| const AWFContainerRuntimeMinVersion Version = "v0.28.0" | ||
| const AWFContainerRuntimeMinVersion Version = "v0.27.30" |
| // Until then, no released AWF binary accepts containerRuntime, so the compiler must not | ||
| // emit the field for workflows pinned to any currently-available version. | ||
| const AWFContainerRuntimeMinVersion Version = "v0.28.0" | ||
| const AWFContainerRuntimeMinVersion Version = "v0.27.30" |
| @@ -73,7 +73,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.5.0" | |||
| // | |||
| // The first recompile regenerates all lock files using the new version; the second recompile | |||
| // refreshes the container SHA pins that were resolved during the first pass. | |||
| const DefaultFirewallVersion Version = "v0.27.29" | |||
| const DefaultFirewallVersion Version = "v0.27.30" | |||
Comment on lines
+167
to
+170
| `agent=sha256:3cc1e14efa9e52ed1fc29d72a0eabf02ff86b30c6af9685fa9ddd687caca6613`, | ||
| `api-proxy=sha256:fdbd94bb668ed736a27c146633842db5c7e658dc7a0d6a0e6011e74e18132785`, | ||
| `cli-proxy=sha256:959c876217038ac6f9c2047b591e819e5f1f726625a34490ccdcacaa71d83e4c`, | ||
| `squid=sha256:eb74fca5309c7542df0f32aef41b92c728ecef7ac3b0cca9f9a6b97cc324d22a`, |
Contributor
|
Hey
|
Collaborator
|
Unresolved review feedback to address:
|
- Add containerRuntime property to awf-config.schema.json container object - Update docs/README/changeset v0.28.0 placeholder → v0.27.30 - Add patch changeset for v0.27.30 firewall bump - Add agent-act=sha256:d0beee… assertion to docker_firewall_pin_compile_test.go - Enable schema validation in TestGVisorFrontmatterExtraction Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Contributor
Author
Addressed all four review threads in commit
|
Collaborator
|
@copilot run pr-finisher skill |
Comment on lines
+574
to
+575
| "type": "string", | ||
| "description": "OCI runtime for the agent container. Set to \"gvisor\" to run the agent under gVisor's runsc runtime for additional kernel-level isolation. AWF translates \"gvisor\" to \"runsc\" internally. Requires AWF >= v0.27.30." |
| // Default version (v0.27.29) predates containerRuntime support. | ||
| Firewall: &FirewallConfig{Enabled: true}, | ||
| // Pin to a version that predates containerRuntime support. | ||
| Firewall: &FirewallConfig{Enabled: true, Version: "v0.27.29"}, |
| @@ -364,6 +365,8 @@ func TestDockerSbxValidation_DefaultVersionRejected(t *testing.T) { | |||
| Runtime: AgentRuntimeDockerSbx, | |||
| NetworkIsolation: false, // sudo: true → NetworkIsolation=false (overridden by isDockerSbxRuntime) | |||
| SudoExplicitlyEnabled: true, | |||
| // Pin to a version that predates containerRuntime support. | |||
| Version: "v0.27.29", | |||
Copilot stopped work on behalf of
lpcox due to an error
July 12, 2026 03:16
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
DefaultFirewallVersionfromv0.27.29tov0.27.30and resolves the long-standingAWFContainerRuntimeMinVersionTODO — gh-aw-firewall PRs #6093 (gVisor runtime) and #6101 (Docker sbx microVM) both shipped in v0.27.30, so the placeholderv0.28.0is replaced with the actual release version.Constants (
pkg/constants/version_constants.go)DefaultFirewallVersion:v0.27.29→v0.27.30AWFContainerRuntimeMinVersion:v0.28.0→v0.27.30(resolves TODO;containerRuntimefield is now live)Container image SHA pins
Added v0.27.30 digest entries for all six sidecar images (
agent,agent-act,api-proxy,cli-proxy,build-tools,squid) to.github/aw/actions-lock.jsonand bothaction_pins.jsoncopies.Test updates
docker_firewall_pin_compile_test.go— hardcoded v0.27.29 SHA digests updated to v0.27.30docker_sbx_test.go/gvisor_test.go— version-gating tests that previously relied on the default version predatingAWFContainerRuntimeMinVersionnow explicitly pinv0.27.29to preserve the "too-old" coverage path;TestGVisorFrontmatterExtractionflipped to assertcontainerRuntimeis emitted with the default versionLock files
All 256
.lock.ymlfiles regenerated viamake build && make recompile && make recompile.