🔄 chore: bump pinned gh-aw schema URL to v0.84.3

[github-actions]

Schema URL Update

Updates the MCP Gateway JSON schema validation URL from the previous version to v0.84.3.

Files Changed

• internal/config/validation_errors.go — SchemaURL constant updated to v0.84.3
• internal/config/validation_schema_test.go — hardcoded schema URL updated to v0.84.3

Why

Pinning to a specific release tag ensures reproducible, deterministic configuration validation — the schema won't silently change between runs.

Release Notes

See the gh-aw release notes for changes in this schema version.

Generated by Nightly Schema Updater · gpt54 · 23 AIC · ⊞ 32.3K · ◷

• expires on Aug 13, 2026, 3:48 AM UTC

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool (gateway enforcement)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	rejected — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	rejected — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Note on Part B enforcement: All 7 write tool calls returned JSON-RPC Error [-32602]: unknown tool "<name>" from the gateway — the gateway strips write tools from its exposed MCP surface, blocking them at the protocol level before any request reaches the GitHub API.

Note on Parts D/E: The gh CLI has no GH_TOKEN in this sandbox, so REST and GraphQL writes are rejected at authentication. No write reached the GitHub API.

References: §31069483899

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (-32602)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Part B writes were refused with MCP error -32602: unknown tool — write tools are absent from the gateway-filtered tool list, confirming gateway enforcement. Parts D and E were additionally blocked by the absence of GH_TOKEN in this environment.

References: §31069483895

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	HTTP 401 Bad credentials	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	HTTP 401 Bad credentials	BLOCKED	✅

Overall: PASS

Note: Part B write tools absent from gateway tool list (MCP -32602 unknown tool). Part D/E blocked by unauthenticated gh CLI (401).

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[lpcox]

@copilot fix this failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/31069483958/job/92661452007?pr=10759