Skip to content

feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 24 commits into from
Jul 16, 2026
Merged

feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
224da07
feat: default to strict security mode, deprecate sudo/host-access
lpcox Jul 14, 2026
946e5aa
fix: address review feedback on legacy-security PR
lpcox Jul 14, 2026
b89da77
chore: begin review feedback follow-up
Copilot Jul 14, 2026
a29dcc3
fix: opt service-port workflows into legacy security
Copilot Jul 14, 2026
8c420f9
chore: revert incidental lockfile updates
Copilot Jul 14, 2026
c225286
Merge branch 'main' into feat/legacy-security-compiler
github-actions[bot] Jul 14, 2026
e846401
chore: start PR finisher pass
Copilot Jul 14, 2026
3965642
Merge remote-tracking branch 'origin/main' into feat/legacy-security-…
Copilot Jul 14, 2026
3ce6ce6
test: align harness AWF assertion with strict mode
Copilot Jul 14, 2026
abaeea0
Plan unresolved PR feedback
Copilot Jul 14, 2026
fd06a61
Merge remote-tracking branch 'origin/main' into feat/legacy-security-…
Copilot Jul 15, 2026
bb5d597
chore: merge main and recompile workflows
Copilot Jul 15, 2026
8887d4a
Merge remote-tracking branch 'origin/main' into feat/legacy-security-…
Copilot Jul 15, 2026
8e31b97
Revert .lock.yml changes and bump firewall to v0.27.33
lpcox Jul 15, 2026
58d28c0
Merge remote-tracking branch 'origin/main' into feat/legacy-security-…
Copilot Jul 15, 2026
74066f9
test: cover invalid deployment status validation and refresh lockfiles
Copilot Jul 15, 2026
1257034
Revert lockfile updates to main state
Copilot Jul 15, 2026
80cce26
chore: start PR finisher pass
Copilot Jul 15, 2026
1e9186b
Merge remote-tracking branch 'origin/main' into feat/legacy-security-…
Copilot Jul 15, 2026
3998b55
chore: bump awf to v0.27.34 and restore lockfiles
Copilot Jul 15, 2026
27285bb
chore: start PR finisher pass
Copilot Jul 15, 2026
211edee
Merge remote-tracking branch 'refs/remotes/origin/main' into feat/leg…
Copilot Jul 15, 2026
1d8c322
chore: merge main and sync detection analysis lockfile
Copilot Jul 15, 2026
1c81bc4
chore: bump awf firewall containers to v0.27.35
Copilot Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions .github/aw/actions-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,16 @@
"digest": "sha256:58fee05c1c54ba5ca1e7056b3aaea30281841d5899093002e2c650710c50540f",
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent-act:0.27.31@sha256:58fee05c1c54ba5ca1e7056b3aaea30281841d5899093002e2c650710c50540f"
},
"ghcr.io/github/gh-aw-firewall/agent-act:0.27.34": {

@github-actions github-actions Bot Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke test review: new pinned image entry looks correctly formatted with digest.

Copilot AI Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed on the current head (1d8c322): no change was needed here; the pinned image entry remains correctly formatted with its digest.

"image": "ghcr.io/github/gh-aw-firewall/agent-act:0.27.34",
"digest": "sha256:b802a55dcfdd4e229f415d29a928a0d97fd381e4b84b6edbe9025a6ef855cb04",
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent-act:0.27.34@sha256:b802a55dcfdd4e229f415d29a928a0d97fd381e4b84b6edbe9025a6ef855cb04"
},
"ghcr.io/github/gh-aw-firewall/agent-act:0.27.35": {
"image": "ghcr.io/github/gh-aw-firewall/agent-act:0.27.35",
"digest": "sha256:b00340a7b09c917c522cb806af6da1d12f2146e25a4a6198f1589b0116aee992",
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent-act:0.27.35@sha256:b00340a7b09c917c522cb806af6da1d12f2146e25a4a6198f1589b0116aee992"
},
"ghcr.io/github/gh-aw-firewall/agent:0.25.18": {
"image": "ghcr.io/github/gh-aw-firewall/agent:0.25.18",
"digest": "sha256:c77e8c26bab6c39e8568d8e2f8c17015944849a8cbcdfb4bd9725d8893725ca2",
Expand Down Expand Up @@ -307,6 +317,16 @@
"digest": "sha256:84d861cb6da723ac10b7a00dddf778be681b8cd74b2091f18ce1d67fe4b3e7a1",
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.31@sha256:84d861cb6da723ac10b7a00dddf778be681b8cd74b2091f18ce1d67fe4b3e7a1"
},
"ghcr.io/github/gh-aw-firewall/agent:0.27.34": {

@github-actions github-actions Bot Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke test review: agent image version bump entry is consistent with the firewall entry above.

Copilot AI Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed on the current head (1d8c322): no change was needed here; the agent image version bump remains aligned with the firewall entry.

"image": "ghcr.io/github/gh-aw-firewall/agent:0.27.34",
"digest": "sha256:f227a65aba93e52fb61364ced597ef7f301d82a5cd025674affceac7f2c66605",
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.34@sha256:f227a65aba93e52fb61364ced597ef7f301d82a5cd025674affceac7f2c66605"
},
"ghcr.io/github/gh-aw-firewall/agent:0.27.35": {
"image": "ghcr.io/github/gh-aw-firewall/agent:0.27.35",
"digest": "sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed",
"pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"
},
"ghcr.io/github/gh-aw-firewall/agent:0.27.4": {
"image": "ghcr.io/github/gh-aw-firewall/agent:0.27.4",
"digest": "sha256:b268ebf37df2428b19efcb383f001d65dc6a5ec10af43feb886d1a8477ab0e3a",
Expand Down Expand Up @@ -432,6 +452,16 @@
"digest": "sha256:80d982fe7925c640d76cbbfbe94081d2d34f7657b7c37494d8d5488f5dae3c63",
"pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.31@sha256:80d982fe7925c640d76cbbfbe94081d2d34f7657b7c37494d8d5488f5dae3c63"
},
"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.34": {
"image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.34",
"digest": "sha256:b9540035f89a1a64273c1e307f710c1639e9f664d62dfb41783ad977559af6d7",
"pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.34@sha256:b9540035f89a1a64273c1e307f710c1639e9f664d62dfb41783ad977559af6d7"
},
"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35": {
"image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35",
"digest": "sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04",
"pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"
},
"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.4": {
"image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.27.4",
"digest": "sha256:3ea0d12a2d124db8ed6e2d18aff040e30ab3568161f258a132fccdeede4198cd",
Expand Down Expand Up @@ -482,6 +512,16 @@
"digest": "sha256:b10c0c125cb63fc0f039503a4594b40391be7991985e6e19aee63d068a84d7ad",
"pinned_image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.31@sha256:b10c0c125cb63fc0f039503a4594b40391be7991985e6e19aee63d068a84d7ad"
},
"ghcr.io/github/gh-aw-firewall/build-tools:0.27.34": {
"image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.34",
"digest": "sha256:f4cba61c366795958438e468a493a7e1a6b90a0f5a6e2bb8a1e69b75ac2cde45",
"pinned_image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.34@sha256:f4cba61c366795958438e468a493a7e1a6b90a0f5a6e2bb8a1e69b75ac2cde45"
},
"ghcr.io/github/gh-aw-firewall/build-tools:0.27.35": {
"image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.35",
"digest": "sha256:b7a01d0d67fe6f0162fb4da3162ef5569db872e25c1cbb7694e86c66ab62c3a0",
"pinned_image": "ghcr.io/github/gh-aw-firewall/build-tools:0.27.35@sha256:b7a01d0d67fe6f0162fb4da3162ef5569db872e25c1cbb7694e86c66ab62c3a0"
},
"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.28": {
"image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.28",
"digest": "sha256:fdf310e4678ce58d248c466b89399e9680a3003038fd19322c388559016aaac7",
Expand Down Expand Up @@ -572,6 +612,16 @@
"digest": "sha256:7c63bc4e57d6eac1be996bb793a5a2d74d40b15a616003f4b6805a457046c673",
"pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.31@sha256:7c63bc4e57d6eac1be996bb793a5a2d74d40b15a616003f4b6805a457046c673"
},
"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.34": {
"image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.34",
"digest": "sha256:bada1c3b15f4b602590921cf1eab20a277ef4539d1d4b36322a7ca810b93ba99",
"pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.34@sha256:bada1c3b15f4b602590921cf1eab20a277ef4539d1d4b36322a7ca810b93ba99"
},
"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35": {
"image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35",
"digest": "sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5",
"pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"
},
"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.4": {
"image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.4",
"digest": "sha256:72c378c029d2fad4684847ab44c329e526ac6b1a78cdf97656870ea11d201545",
Expand Down Expand Up @@ -697,6 +747,16 @@
"digest": "sha256:c05a3f086946fab0833e078f46d35571080f187ca72f038958d45aa5cc150494",
"pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.31@sha256:c05a3f086946fab0833e078f46d35571080f187ca72f038958d45aa5cc150494"
},
"ghcr.io/github/gh-aw-firewall/squid:0.27.34": {
"image": "ghcr.io/github/gh-aw-firewall/squid:0.27.34",
"digest": "sha256:77ab3258a47786c380d371d00e40654096304053d7a54a76d035554a78c14e86",
"pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.34@sha256:77ab3258a47786c380d371d00e40654096304053d7a54a76d035554a78c14e86"
},
"ghcr.io/github/gh-aw-firewall/squid:0.27.35": {
"image": "ghcr.io/github/gh-aw-firewall/squid:0.27.35",
"digest": "sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3",
"pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"
},
"ghcr.io/github/gh-aw-firewall/squid:0.27.4": {
"image": "ghcr.io/github/gh-aw-firewall/squid:0.27.4",
"digest": "sha256:87979038897e40caed22245b64d1daa796390d2dca289b99d3d1174c85740af8",
Expand Down
40 changes: 20 additions & 20 deletions .github/workflows/ab-testing-advisor.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

26 changes: 13 additions & 13 deletions .github/workflows/ace-editor.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

40 changes: 20 additions & 20 deletions .github/workflows/agent-performance-analyzer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

40 changes: 20 additions & 20 deletions .github/workflows/agent-persona-explorer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/agentic-token-audit.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

28 changes: 14 additions & 14 deletions .github/workflows/agentic-token-optimizer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/agentic-token-trend-audit.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

28 changes: 14 additions & 14 deletions .github/workflows/ai-moderator.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/api-consumption-report.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/approach-validator.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/archie.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

50 changes: 25 additions & 25 deletions .github/workflows/architecture-guardian.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/artifacts-summary.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

42 changes: 21 additions & 21 deletions .github/workflows/audit-workflows.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

50 changes: 25 additions & 25 deletions .github/workflows/auto-triage-issues.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/avenger.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/aw-failure-investigator.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

48 changes: 24 additions & 24 deletions .github/workflows/blog-auditor.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

24 changes: 12 additions & 12 deletions .github/workflows/bot-detection.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/brave.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

52 changes: 26 additions & 26 deletions .github/workflows/breaking-change-checker.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/changeset.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/chaos-pr-bundle-fuzzer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

52 changes: 26 additions & 26 deletions .github/workflows/ci-coach.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

40 changes: 20 additions & 20 deletions .github/workflows/ci-doctor.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/claude-code-user-docs-review.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

34 changes: 17 additions & 17 deletions .github/workflows/cli-consistency-checker.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/cli-version-checker.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/cloclo.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

40 changes: 20 additions & 20 deletions .github/workflows/code-scanning-fixer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

38 changes: 19 additions & 19 deletions .github/workflows/code-simplifier.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

24 changes: 12 additions & 12 deletions .github/workflows/codex-github-remote-mcp-test.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/commit-changes-analyzer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions .github/workflows/constraint-solving-potd.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

48 changes: 24 additions & 24 deletions .github/workflows/contribution-check.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

42 changes: 21 additions & 21 deletions .github/workflows/copilot-agent-analysis.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

Loading
Loading