chore: upgrade gh-aw to v0.68.4 and recompile workflows by lpcox · Pull Request #2019 · github/gh-aw-firewall

lpcox · 2026-04-16T04:41:48Z

Summary

Upgrades gh-aw from v0.68.1 to v0.68.4 and recompiles all agentic workflows.

Action updates

Action	From	To
`github/gh-aw-actions/setup`	v0.68.3	v0.68.4
`github/gh-aw/actions/setup`	v0.68.1	v0.68.4
`actions/github-script`	v8/v9	v9.0.0
`softprops/action-gh-release`	v2.6.1	v3.0.0

Container image pins refreshed (14 images)

All GHCR container images (agent, squid, api-proxy, cli-proxy, mcpg, github-mcp-server, playwright-mcp) and base images (alpine, node) re-pinned to latest digests.

Workflows recompiled

All 29 workflows recompiled and post-processed. Lock files updated with:

New action versions and SHA pins
Post-processing applied (local build, session-state-dir, cache-memory TTL, security policies)

Notes

smoke-opencode.md failed to compile — opencode is not yet a supported engine in gh-aw v0.68.4. No changes to its lock file.
No codemods were needed (✓ No fixes needed).

- Updated gh-aw-actions/setup v0.68.3 → v0.68.4 - Updated gh-aw/actions/setup v0.68.1 → v0.68.4 - Updated actions/github-script v8/v9 → v9.0.0 - Updated softprops/action-gh-release v2.6.1 → v3.0.0 - Refreshed 14 container image pins - Recompiled all 29 workflows + post-processed lock files - smoke-opencode.md skipped (opencode engine not yet supported) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-16T04:42:49Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	85.35%	85.43%	📈 +0.08%
Statements	85.24%	85.33%	📈 +0.09%
Functions	87.96%	87.96%	➡️ +0.00%
Branches	77.95%	78.00%	📈 +0.05%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	86.8% → 87.1% (+0.30%)	86.4% → 86.7% (+0.29%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Upgrades the repository’s agentic workflow toolchain to gh-aw v0.68.4 and refreshes the compiled workflow lock files so CI runs with updated action pins, container image pins, and the newer gh-aw-generated workflow wiring.

Changes:

Bumped gh-aw compiler metadata across lock files to v0.68.4, updating pinned action SHAs (notably github/gh-aw-actions/setup, actions/github-script, actions/upload-artifact, and actions/cache where used).
Refreshed container references in workflow manifests/steps (including adding digest-pinned references for several images) and updated runtime/agent steps (Copilot error detection, MCP gateway startup via Node, prompt handling via --prompt-file, etc.).
Updated repo-level pin registry in .github/aw/actions-lock.json and gh-aw agent documentation links to v0.68.4.

Show a summary per file

File	Description
.github/workflows/update-release-notes.lock.yml	Recompiled lock with v0.68.4, updated action pins, container list, Copilot error detection, and new base-branch agent-config save/restore steps.
.github/workflows/smoke-codex.lock.yml	Recompiled Codex smoke workflow with updated pins, MCP config path adjustments, and added cleanup step (see comment).
.github/workflows/security-review.lock.yml	Recompiled security review workflow with updated pins, Copilot error detection outputs, and container pin refresh.
.github/workflows/plan.lock.yml	Recompiled plan-command workflow with updated pins, Copilot error detection outputs, and container pin refresh.
.github/workflows/issue-monster.lock.yml	Recompiled issue triage workflow with updated pins and updated safe-outputs tooling metadata.
.github/workflows/firewall-issue-dispatcher.lock.yml	Recompiled dispatcher workflow with updated pins and refreshed mcpg image tag for CLI proxy (see comment).
.github/workflows/copilot-token-usage-analyzer.lock.yml	Recompiled analyzer workflow with updated pins, Copilot error detection outputs, and container pin refresh.
.github/workflows/copilot-token-optimizer.lock.yml	Recompiled optimizer workflow with updated pins, Copilot error detection outputs, and container pin refresh.
.github/workflows/cli-flag-consistency-checker.lock.yml	Recompiled checker workflow with updated pins, Copilot error detection outputs, and schedule scatter update.
.github/workflows/claude-token-usage-analyzer.lock.yml	Recompiled analyzer workflow with updated pins, Copilot error detection outputs, and container pin refresh.
.github/workflows/ci-cd-gaps-assessment.lock.yml	Recompiled assessment workflow with updated pins and added digest pin for `alpine:latest`.
.github/aw/actions-lock.json	Updated central action pins (and added a container pin registry section).
.github/agents/agentic-workflows.agent.md	Updated gh-aw documentation links to reference v0.68.4.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 31/31 changed files
Comments generated: 2

Copilot · 2026-04-16T04:46:05Z

+      - name: Clean up engine output files
+        run: |
+          rm -fr ${{ runner.temp }}/gh-aw/mcp-config/logs/


The workflow deletes ${{ runner.temp }}/gh-aw/mcp-config/logs/ in the new "Clean up engine output files" step, but later still includes the same directory in the "Upload agent artifacts" paths. This makes the uploaded artifact miss the Codex engine logs. Either move this cleanup after the artifact upload, or remove the logs directory from the upload list (or clean up a different path).

Suggested change

- name: Clean up engine output files

run: |

rm -fr ${{ runner.temp }}/gh-aw/mcp-config/logs/

Copilot · 2026-04-16T04:46:06Z

          GITHUB_SERVER_URL: ${{ github.server_url }}
          CLI_PROXY_POLICY: '{"allow-only":{"min-integrity":"none","repos":["github/gh-aw","github/gh-aw-firewall"]}}'
-          CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.2.17'
+          CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.2.19'


CLI_PROXY_IMAGE is still set to a mutable tag (ghcr.io/github/gh-aw-mcpg:v0.2.19) even though this workflow pins the same image by digest elsewhere (e.g., in the download step/manifest). For supply-chain safety and reproducibility, prefer passing the digest-pinned image reference here as well.

Suggested change

CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.2.19'

CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.2.19@sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd'

BYOK providers require an explicit model. The compiler generates an empty string fallback which causes Copilot CLI to error with: 'BYOK providers require an explicit model.' Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-16T04:53:08Z

Smoke Test Results

✅ GitHub MCP — #2006 "fix: add explicit model for Copilot BYOK smoke test", #2003 "feat: add smoke test for Copilot CLI offline BYOK mode"
✅ Playwright — github.com title contains "GitHub"
✅ File write — /tmp/gh-aw/agent/smoke-test-claude-24492723038.txt created and verified
✅ Bash — file content confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-16T04:54:04Z

Smoke Test: GitHub Actions Services Connectivity ✅

All checks passed:

Service	Check	Result
Redis `host.docker.internal:6379`	`PING`	✅ `PONG`
PostgreSQL `host.docker.internal:5432`	`pg_isready`	✅ accepting connections
PostgreSQL `smoketest` db	`SELECT 1`	✅ returned `1`

Note: redis-cli was not available and sudo is restricted in this environment. Redis connectivity was verified via bash TCP (/dev/tcp).

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-04-16T04:54:26Z

🤖 OpenCode Smoke Test — PASS

✅ GitHub MCP: reviewed last 2 merged PRs (fix: add explicit model for Copilot BYOK smoke test #2006 "fix: add explicit model for Copilot BYOK smoke test", feat: add smoke test for Copilot CLI offline BYOK mode #2003 "feat: add smoke test for Copilot CLI offline BYOK mode")
✅ File write: /tmp/gh-aw/agent/smoke-test-opencode-24492723052.txt created and verified
✅ Bash: file contents confirmed via cat
✅ Build: npm ci && npm run build succeeded

Overall: PASS

🌐 Transmitted by Smoke OpenCode

github-actions · 2026-04-16T04:55:34Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2019 · ● 624.5K · ◷

lpcox · 2026-04-16T05:02:01Z

Closing — byok-copilot feature flag needs compiler fixes upstream (gh-aw#26565) before this can land cleanly.

Copilot AI review requested due to automatic review settings April 16, 2026 04:41

lpcox requested a review from Mossaka as a code owner April 16, 2026 04:41

Copilot started reviewing on behalf of lpcox April 16, 2026 04:42 View session

feat: replace cli-proxy with byok-copilot feature flag in smoke-copilot

e5b7855

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI reviewed Apr 16, 2026

View reviewed changes

github-actions bot mentioned this pull request Apr 16, 2026

[aw] Smoke Codex failed #2020

Closed

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-claude label Apr 16, 2026

This was referenced Apr 16, 2026

[aw] Smoke Copilot BYOK failed #2021

Closed

[aw] Smoke Copilot failed #2022

Closed

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-opencode label Apr 16, 2026

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-services label Apr 16, 2026

github-actions bot mentioned this pull request Apr 16, 2026

[aw] Security Guard failed #2023

Closed

This comment has been minimized.

Sign in to view

github-actions bot added the build-test label Apr 16, 2026

lpcox closed this Apr 16, 2026

lpcox deleted the copilot/upgrade-gh-aw-0.68.4 branch April 16, 2026 05:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: upgrade gh-aw to v0.68.4 and recompile workflows#2019

chore: upgrade gh-aw to v0.68.4 and recompile workflows#2019
lpcox wants to merge 3 commits intomainfrom
copilot/upgrade-gh-aw-0.68.4

lpcox commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

lpcox commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	- name: Clean up engine output files
	run: \|
	rm -fr ${{ runner.temp }}/gh-aw/mcp-config/logs/

	CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.2.19'
	CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.2.19@sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd'

Conversation

lpcox commented Apr 16, 2026

Summary

Action updates

Container image pins refreshed (14 images)

Workflows recompiled

Notes

Uh oh!

github-actions bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Apr 16, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Apr 16, 2026

Smoke Test: GitHub Actions Services Connectivity ✅

Uh oh!

github-actions bot commented Apr 16, 2026

🤖 OpenCode Smoke Test — PASS

Uh oh!

github-actions bot commented Apr 16, 2026

🏗️ Build Test Suite Results

Uh oh!

lpcox commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Apr 16, 2026 •

edited

Loading