Upgrade gh-aw extension to latest pre-release and recompile workflows

[lpcox]

• Updated github/codeql-action/upload-sarif from v4.37.4 to v4.37.6
• Updated github/gh-aw-actions/setup-cli from v0.84.1 to v0.86.0
• Updated github/gh-aw-actions/setup from v0.84.1 to v0.86.0
• Updated 5 container image pins
• Recompiled all 36 workflows

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pulls/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	gateway allowlist blocks all 7 — unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked — gh unauthenticated (GH_TOKEN not set)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked — gh unauthenticated (GH_TOKEN not set)	BLOCKED	✅

Note on Part B: The gateway enforces read-only by exposing only read tools in the MCP session allowlist. Write tools return Error [-32602]: unknown tool — gateway-enforced allowlist denial (tool absent from filtered session).

Overall: PASS ✅

References: §31190048953

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

Pull request overview

Upgrades gh-aw dependencies and regenerates workflows with compiler v0.86.0.

Changes:

• Updates gh-aw actions, CodeQL, firewall, and gateway image pins.
• Recompiles 36 workflows with updated runtime behavior.
• Refreshes agentic-workflow guidance and generated-file attributes.

Show a summary per file

File	Description
.github/workflows/smoke-otel-tracing.lock.yml	Regenerates OTel smoke workflow.
.github/workflows/gpl-dependency-checker.lock.yml	Regenerates GPL checker workflow.
.github/workflows/github-mcp-guard-coverage-checker.lock.yml	Regenerates guard coverage workflow.
.github/workflows/ghcr-download-tracker.lock.yml	Regenerates GHCR tracker workflow.
.github/skills/agentic-workflows/SKILL.md	Adds new upstream guidance mappings.
.github/aw/actions-lock.json	Updates action and container pins.
.gitattributes	Removes the ineffective lock-file merge driver.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 23/39 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused Error[-32602]:unknown tool	BLOCKED	✅
C	CLI	reads (issues, file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all refused (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all refused (gh unauthenticated)	BLOCKED	✅

Gateway enforcement (Part B): MCP tool allowlist has only 22 read tools; all 7 write calls returned gateway-level Error[-32602]: unknown tool.

CLI enforcement (Parts D/E): gh has no token; all REST and GraphQL write attempts rejected at auth layer.

Overall: PASS — §31190048910

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (issues, file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all refused: Bad credentials (401)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all refused: Bad credentials (401)	BLOCKED	✅

Overall: PASS

Run §31190048908

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime