Upgrade workflows to latest gh-aw pre-release

[lpcox]

Summary

Upgrades the agentic workflows with the latest gh-aw pre-release (v0.87.0) and recompiles all 36 workflows.

Changes

• Ran gh aw upgrade --pre-releases
• Recompiled all workflows with gh aw compile
• Refreshed the generated lockfiles for the three readonly stress workflows

Validation

• All 36 workflows compiled successfully
• make agent-finished passed

[Copilot]

Pull request overview

Upgrades generated workflows to gh-aw v0.87.0 and refreshes affected read-only stress workflows.

Changes:

• Pins gh-aw compiler/setup metadata to v0.87.0.
• Corrects read-only validation criteria and proxy coverage descriptions.

Show a summary per file

File	Description
readonly-stress-default.lock.yml	Refreshes default-runtime workflow.
readonly-stress-gvisor.lock.yml	Refreshes gVisor workflow.
readonly-stress-sbx.lock.yml	Refreshes docker-sbx workflow.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps (no write leaked — no FAIL):

• Part B: All 7 write tools absent from catalog (Error [-32602]: unknown tool). Backend launched with GITHUB_READ_ONLY=1 → write tools never registered. Cannot independently confirm gateway-layer DIFC enforcement (expected per test plan; not a FAIL).
• Parts D & E: gh CLI is unauthenticated in this environment (no GH_TOKEN). All gh api write attempts returned "set the GH_TOKEN environment variable". Token-scope boundary cannot be validated this run.

No writes succeeded. Reads all passed.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	data returned	ALLOWED	✅
A	MCP	list_pull_requests	data returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	data returned	ALLOWED	✅
A	MCP	list_commits	data returned	ALLOWED	✅
B	MCP	add_issue_comment (reaction)	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	star_repository	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	issue_write (create)	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	add_issue_comment (body)	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_branch	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_or_update_file	unknown tool [-32602]	BLOCKED	⚠️
B	MCP	create_pull_request	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	github list_issues	data returned	ALLOWED	✅
C	CLI	github get_file_contents	data returned	ALLOWED	✅
D	CLI	REST writes (6 ops)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (3 ops)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps:

• Part B: All 7 write tools absent from the MCP catalog (backend launched with GITHUB_READ_ONLY=1). Refusals confirm backend defense-in-depth but do not independently exercise mcpg's DIFC/guard enforcement layer, since write tools never reach the gateway's blocking path. Classified INCONCLUSIVE per test methodology.
• Parts D/E: gh CLI not authenticated (GH_TOKEN not set in this workflow). Token-scope boundary and GraphQL mutation blocking could not be tested. No writes attempted or leaked.

No writes leaked. No FAIL condition triggered.

References: §32023621204

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	"unknown tool" [-32602]	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	—	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	—	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tool targets (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the 23-tool catalog — error [-32602]: unknown tool. The backend is launched with GITHUB_READ_ONLY=1 so no write tools are registered; refusal proves backend/toolset config, not independent gateway-level enforcement. Per methodology: INCONCLUSIVE.

⚠️ Parts D/E: gh CLI is not authenticated in this environment (GH_TOKEN is invalid). Unauthenticated 401s cannot confirm the token-scope boundary. Token-scope enforcement cannot be verified this run.

No write succeeded. No artifact was created or mutated.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime