Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pinned artifacts by Copilot · Pull Request #48236 · github/gh-aw

Copilot · 2026-07-26T23:53:31Z

This updates gh-aw’s default pinned runtime versions to the latest AWF and MCP Gateway releases and regenerates pinned workflow artifacts to match those defaults.

Version pins
- Updated /pkg/constants/version_constants.go:
  - DefaultFirewallVersion: v0.27.41 → v0.27.42
  - DefaultMCPGatewayVersion: v0.4.5 → v0.4.6
Container digest pin set
- Added container pin entries for the new default tags in /.github/aw/actions-lock.json:
  - ghcr.io/github/gh-aw-firewall/{agent,agent-act,api-proxy,cli-proxy,squid}:0.27.42
  - ghcr.io/github/gh-aw-mcpg:v0.4.6
- Synced generated pin tables:
  - /pkg/actionpins/data/action_pins.json
  - /pkg/workflow/data/action_pins.json
Recompiled generated workflow locks
- Regenerated .github/workflows/*.lock.yml so compiled outputs use the updated defaults and refreshed digest pins.
Changeset
- Added /.changeset/patch-bump-awf-v0-27-42-mcpg-v0-4-6.md.

// pkg/constants/version_constants.go
const DefaultFirewallVersion Version = "v0.27.42"
const DefaultMCPGatewayVersion Version = "v0.4.6"

Fixes Bump firewall to v0.27.42 and mcpg to v0.4.6 #48234

Run: https://github.com/github/gh-aw/actions/runs/30233154470

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 7.3 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

✨ PR Review Safe Output Test - Run 30236132659

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 68.1 AIC · ⌖ 20.2 AIC · ⊞ 6.1K · ◷
_{Comment /smoke-claude to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-07-27T01:06:11Z

🤖 PR Triage

Field	Value
Category	chore
Risk	🟢 low
Priority Score	32 / 100
Score Breakdown	Impact: 15 · Urgency: 7 · Quality: 10
Recommended Action	⏸ defer (DRAFT)

Summary: Version bump for default AWF (v0.27.41 → v0.27.42) and MCP Gateway (v0.4.5 → v0.4.6) with pinned artifact refresh. Draft, no reviews, no CI data yet. Routine maintenance chore.

Next action: Defer — author undraft when ready; low-risk merge once CI passes.

Generated by 🔧 PR Triage Agent · sonnet46 · 49 AIC · ⌖ 8.25 AIC · ⊞ 5.7K · ◷

Copilot

Pull request overview

Bumps default AWF/MCP Gateway versions and refreshes corresponding generated artifacts. Review found that AWF v0.27.42’s runtime schema still rejects apiProxy.providers, which this bump enables.

Changes:

Updated runtime version defaults.
Added synchronized container digest pins.
Recompiled workflow locks and added a patch changeset.

Show a summary per file

File	Description
`pkg/constants/version_constants.go`	Updates default versions.
`.github/aw/actions-lock.json`	Adds new image pins.
`pkg/actionpins/data/action_pins.json`	Syncs embedded pins.
`pkg/workflow/data/action_pins.json`	Syncs workflow pins.
`.github/workflows/smoke-ci.lock.yml`	Refreshes generated runtime pins.
`.github/workflows/release.lock.yml`	Refreshes generated runtime pins.
`.github/workflows/firewall.lock.yml`	Refreshes generated runtime pins.
`.github/workflows/example-permissions-warning.lock.yml`	Refreshes generated runtime pins.
`.github/workflows/daily-max-ai-credits-test.lock.yml`	Refreshes generated runtime pins.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Refreshes generated runtime pins.
`.github/workflows/ai-moderator.lock.yml`	Refreshes generated runtime pins.
`.changeset/patch-bump-awf-v0-27-42-mcpg-v0-4-6.md`	Records the patch release change.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 23/267 changed files
Comments generated: 1
Review effort level: Medium

Copilot · 2026-07-27T03:12:26Z

@@ -70,7 +70,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.7.0"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.27.41"
+const DefaultFirewallVersion Version = "v0.27.42"


Addressed in commits b4363ec and e4d45be:

Bumped AWFAPIProxyProvidersMinVersion to v0.27.43 so awfSupportsAPIProxyProviders returns false for the default v0.27.42 — apiProxy.providers is no longer emitted

Recompiled the two affected lock files (daily-model-inventory, smoke-copilot) to remove the previously emitted apiProxy.providers field

lpcox · 2026-07-27T02:43:51Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

…sed for AWF v0.27.42 AWF v0.27.42 does not include apiProxy.providers in its config schema. Setting DefaultFirewallVersion=v0.27.42 matched the previous minimum version value, causing awfSupportsAPIProxyProviders to return true and emit a field that AWF v0.27.42 rejects. Advance the minimum to v0.27.43 so the feature stays gated off until a release that actually ships the schema support. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

gh-aw-bot · 2026-07-27T02:58:21Z

@copilot please run the pr-finisher skill, update the branch if GitHub allows it, and move this PR toward merge readiness.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 7.3 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-27T02:58:41Z

@copilot address review feedback

Fixed in commit fix: bump AWFAPIProxyProvidersMinVersion to v0.27.43. AWFAPIProxyProvidersMinVersion is now v0.27.43, so awfSupportsAPIProxyProviders returns false for the default v0.27.42 — keeping apiProxy.providers gated off until a future AWF release that actually ships the schema support. Updated the TestAWFSupportsAPIProxyProviders tests accordingly (v0.27.42 is now a must-fail case, v0.27.43 is the new minimum-passing case).

…jects it) After bumping AWFAPIProxyProvidersMinVersion to v0.27.43, the compiled lock files that contained apiProxy.providers for the default AWF version needed regeneration. Two lock files (daily-model-inventory, smoke-copilot) had apiProxy.providers emitted; the recompile correctly drops that field. Also reverts an accidental one-line addition to SKILL.md from the plan commit. Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-07-27T04:18:00Z

Smoke test results:

GitHub PR list: ❌
mcpscripts-gh PR list: ❌
Serena CLI symbols: ❌
Playwright CLI: ❌
web-fetch tool: ❌
File create/cat: ❌
Discussion interaction: ❌
Build: ❌
Artifact upload: ❌
Create discussion: ❌
Workflow dispatch: ❌
PR review tools: ❌
Comment memory: ❌
File summarizer: ❌
Create check run: ❌
Overall status: FAIL
Author: @app/copilot-swe-agent
Assignees: @lpcox, @Copilot

📰 BREAKING: Report filed by Smoke Copilot - AOAI (apikey) · o40mini · 15 AIC · ⌖ 3.27 AIC · ⊞ 18.3K · ◷
_{Comment /smoke-copilot-aoai-apikey to run again}
_{Add label smoke to run again}

github-actions · 2026-07-27T04:19:37Z

🤖 Smoke Test Results — Run 30236132659

Core Tests (#1–12): ✅✅✅✅✅✅✅✅✅✅✅✅
PR Review Tests (#13–19): ✅✅✅⚠️✅❌⚠️

Overall: PARTIAL (push blocked by allowed-files config; thread resolve skipped; no test PR to close)

Run: https://github.com/github/gh-aw/actions/runs/30236132659

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 68.1 AIC · ⌖ 20.2 AIC · ⊞ 6.1K · ◷
_{Comment /smoke-claude to run again}

github-actions · 2026-07-27T04:19:43Z

PR: Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pinned artifacts
Author: app/copilot-swe-agent
Assignees: lpcox, Copilot
T1-4: ❌ ✅ ✅ ❌
T5-8: ❌ ✅ ✅ ✅
T9-12: ✅ ❌ ✅ ✅
T13-16: ✅ ✅ ✅ ✅
Overall: FAIL

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · gpt54 · 63.2 AIC · ⌖ 6.56 AIC · ⊞ 19.5K · ◷
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions

💥 Automated smoke test review - all systems nominal! Run 30236132659

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 68.1 AIC · ⌖ 20.2 AIC · ⊞ 6.1K
_{Comment /smoke-claude to run again}

github-actions · 2026-07-27T04:19:45Z

+"gh-aw": patch
+---
+
+Bump the default gh-aw-firewall version to v0.27.42 and gh-aw-mcpg version to v0.4.6, and refresh embedded container digest pins for those defaults.


🤖 Smoke test review comment #1 (Run 30236132659): Good description! Consider mentioning specific digest hashes for complete traceability.

github-actions · 2026-07-27T04:19:45Z

@@ -0,0 +1,5 @@
+---
+"gh-aw": patch


🤖 Smoke test review comment #2 (Run 30236132659): The patch bump type looks correct for a version pin update that adds backwards-compatible new container digests.

github-actions · 2026-07-27T04:19:53Z

Comment Memory

Bots drum on cold stone
Checks blink green in cave fire light
Night run hums, still warm

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · gpt54 · 63.2 AIC · ⌖ 6.56 AIC · ⊞ 19.5K · ◷
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions

Smoke run mixed. Build pass. Tool smoke partly fail. See #aw_smoke1.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · gpt54 · 63.2 AIC · ⌖ 6.56 AIC · ⊞ 19.5K
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-07-27T04:22:20Z

@copilot run the pr-finisher skill

PR finisher complete. Here's the state:

✅ Reviews — The one unresolved thread (apiProxy.providers gating) was addressed in b4363ec/5df3fd3 and the reply is on record. Additionally found and fixed wasm golden files that were out of sync with the version bump (commit cc278ce).
✅ Checks (local) — make fmt, make lint, make test-unit (full suite) all pass. Two pre-existing CLI test failures (TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent, TestFallbackAWFilesMatchesLocalAWDirectory) fail on the base branch too and are unrelated to this PR.
❓ Checks (CI) — Stale after agent push; needs human re-trigger. Prior CI runs were in-progress when checked.
✅ Mergeable — PR is open, not draft.

Actions taken: Regenerated wasm golden files (pkg/workflow/testdata/) to match container.imageTag: 0.27.42; no apiProxy.providers field is emitted, confirming the gate is working correctly.

Hand-off: CI must be re-triggered by a maintainer (close/reopen PR or push) before merge.

pelikhan · 2026-07-27T05:48:42Z

@copilot merge main and recompile

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…-to-v02742-and-mcpg-to-v046 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-27T06:03:48Z

@copilot merge main and recompile

Done. Merged main into the branch and recompiled all 263 workflow lock files (0 errors). make fmt, make lint, and make test-unit all pass.

Initial plan

8a4d1ef

Copilot AI assigned Copilot and lpcox Jul 26, 2026

Copilot started work on behalf of lpcox July 26, 2026 23:54 View session

Copilot AI linked an issue Jul 26, 2026 that may be closed by this pull request

Bump firewall to v0.27.42 and mcpg to v0.4.6 #48234

Open

Bump firewall to v0.27.42 and mcpg to v0.4.6

950847d

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Bump firewall to v0.27.42 and mcpg to v0.4.6~~ Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pinned artifacts Jul 27, 2026

Copilot AI requested a review from lpcox July 27, 2026 00:13

Copilot finished work on behalf of lpcox July 27, 2026 00:13

github-actions Bot added pr-action:defer pr-agent:copilot pr-priority:low pr-risk:low pr-type:chore labels Jul 27, 2026

github-actions Bot mentioned this pull request Jul 27, 2026

[Contribution Check Report] Contribution Check — 2026-07-27 #48248

Open

lpcox marked this pull request as ready for review July 27, 2026 02:35

Copilot AI review requested due to automatic review settings July 27, 2026 02:35

Copilot started reviewing on behalf of lpcox July 27, 2026 02:35 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 27, 2026 02:44 View session

Copilot AI and others added 2 commits July 27, 2026 02:50

plan: address review - gate apiProxy.providers off for AWF v0.27.42

0282876

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions Bot mentioned this pull request Jul 27, 2026

[pr-sous-chef] PR Sous Chef run report #48239

Open

Copilot finished work on behalf of lpcox July 27, 2026 02:59

Copilot started work on behalf of gh-aw-bot July 27, 2026 02:59 View session

github-actions Bot deployed to aoai-model July 27, 2026 04:16 Active

github-actions Bot mentioned this pull request Jul 27, 2026

[aw] Smoke Codex is missing required data #48263

Open

github-actions Bot mentioned this pull request Jul 27, 2026

Smoke Test: Claude - 30236132659 #48265

Open

github-actions Bot added the smoke-claude label Jul 27, 2026

github-actions Bot reviewed Jul 27, 2026

View reviewed changes

test: update wasm golden files for v0.27.42 container imageTag

cc278ce

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions Bot mentioned this pull request Jul 27, 2026

[aw] Smoke Copilot is missing required tool #48268

Open

Copilot finished work on behalf of lpcox July 27, 2026 04:22

Copilot started work on behalf of pelikhan July 27, 2026 05:49 View session

Copilot AI and others added 3 commits July 27, 2026 05:54

plan: merge main and recompile workflows

02e7a3e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into copilot/bump-firewall…

c6ff95c

…-to-v02742-and-mcpg-to-v046 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

merge main and recompile all workflow lock files

d5420d3

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 27, 2026 06:04

Copilot AI requested a review from pelikhan July 27, 2026 06:04

pelikhan added smoke and removed smoke smoke-claude pr-risk:low pr-action:defer pr-agent:copilot pr-priority:low pr-type:chore labels Jul 27, 2026

Uh oh!

Conversation

Copilot AI commented Jul 26, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026

🤖 PR Triage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox commented Jul 27, 2026

Uh oh!

gh-aw-bot commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

🤖 Smoke Test Results — Run 30236132659

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 27, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

pelikhan commented Jul 27, 2026

Uh oh!

Copilot AI commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jul 26, 2026 •

edited by github-actions Bot

Loading