Bump gh-aw-firewall to v0.27.37 and sync AWF integration artifacts - #46637
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 622ac3ca-2829-4746-96cb-6d10c8e0bc44
There was a problem hiding this comment.
Pull request overview
Bumps AWF from v0.27.35 to v0.27.36 and synchronizes schemas, container pins, and generated workflows.
Changes:
- Updates the default AWF version and embedded schema.
- Adds v0.27.36 container digests.
- Regenerates 258 workflow lock files, currently without applying those digests.
Show a summary per file
| File | Description |
|---|---|
pkg/constants/version_constants.go |
Updates the default AWF version. |
pkg/workflow/schemas/awf-config.schema.json |
Synchronizes v0.27.36 schema changes. |
.github/aw/actions-lock.json |
Adds firewall container digest pins. |
pkg/actionpins/data/action_pins.json |
Embeds the new digest pins. |
pkg/workflow/data/action_pins.json |
Adds workflow compiler pins. |
.changeset/patch-bump-awf-v0-27-36.md |
Records the patch release. |
.github/workflows/*.lock.yml (258 files) |
Regenerates workflows for AWF v0.27.36. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 36/264 changed files
- Comments generated: 1
- Review effort level: Medium
| @@ -630,7 +630,7 @@ jobs: | |||
| GH_AW_SKILL_DIR: ".github/skills" | |||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh" | |||
| - name: Download container images | |||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04 ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3 ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3 | |||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.36 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.36 ghcr.io/github/gh-aw-firewall/squid:0.27.36 ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3 | |||
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 No GitHub write actions yet; collecting smoke-test results and handling unavailable browser/web-fetch tooling. |
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
|
✅ Smoke Copilot MAI completed successfully! |
|
✅ Smoke Copilot Small completed successfully! |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
✅ Smoke OTEL completed successfully! |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
🌑 The shadows whisper... Smoke Codex failed to deliver outputs. The oracle requires further meditation... |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
✅ Smoke Copilot MAI completed successfully! |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
|
✅ Smoke OTEL completed successfully! |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
✅ Smoke Copilot Small completed successfully! |
Smoke Test: Gemini - 29704409268
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke Test summary: most commits in the last 24h focus on workshop/UI changes, with additional safe-output, linter, parser, and logging fixes. Overall status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
Smoke Test: Codex - 29704409247
|
|
Smoke tests completed: Overall FAIL. See issue #{{aw_smoke1}}.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Smoke review tools ran.
📰 BREAKING: Report filed by Smoke Copilot · 60.8 AIC · ⌖ 5.45 AIC · ⊞ 19.7K
Comment /smoke-copilot to run again
Add label smoke to run again
|
🎉 This pull request is included in a new release. Release: |
Summary
Bumps the default gh-aw-firewall (AWF) version from v0.27.35 → v0.27.37 (release) and syncs the related integration artifacts.
Changes
pkg/constants/version_constants.go:DefaultFirewallVersion→v0.27.37. NoAWF*MinVersiongates changed — the release range (v0.27.35…v0.27.37) is fixes/docs with no new gated CLI flags.pkg/workflow/schemas/awf-config.schema.json: synced to the release schema (preserving themain-branch$idand the gh-aw–specific sbxcontainerRuntimenote). Schema changes carried in from v0.27.36:apiProxy.enabledmarked deprecated (the API proxy sidecar is now always enabled)legacySecurityboolean property;securityModedeprecated in its favor.github/aw/actions-lock.json+pkg/actionpins/data/action_pins.json+pkg/workflow/data/action_pins.json: added the resolved0.27.37firewall container digest pins (agent, api-proxy, cli-proxy, squid)..lock.ymlfiles recompiled to reference0.27.37..changeset/patch-bump-awf-v0-27-37.md.v0.27.37 release highlights
~/.local/binto sandbox PATH for rootless copilot installsANTHROPIC_AUTH_TOKENin AWF credential-isolation pathsValidation
make build,make fmtclean;pkg/workflowAWF/schema tests andpkg/constantstests pass.make recompileintermittently fails only ondeep-report.md— a transient npmE404foragentdb@alphathat also fails on cleanmain, so it is pre-existing and unrelated to this bump (compiles fine when npm is reachable).