[ca] CLI/Docker version check: 4 updates found (Claude Code, Copilot CLI, Zizmor, MCP Gateway) - 2026-08-05

[github-actions]

Summary

Checked CLI tools and pinned Docker images against pkg/constants/version_constants.go and pkg/cli/docker_images.go. Found 4 updates to apply: Claude Code CLI, GitHub Copilot CLI, the Zizmor Docker image, and the MCP Gateway (gh-aw-mcpg) Docker image. All changes have been applied locally in this workflow run (constants updated, make fmt + make build + make recompile x2 completed, targeted Go tests passing), but per this workflow's safe-outputs configuration there is no commit/PR capability — a maintainer needs to apply the diffs below (or re-run an equivalent update) for them to land on main.

Diffs to apply

pkg/constants/version_constants.go

-const DefaultClaudeCodeVersion Version = "2.1.220"
+const DefaultClaudeCodeVersion Version = "2.1.222"

-const DefaultCopilotVersion Version = "1.0.77"
+const DefaultCopilotVersion Version = "1.0.78"

-const DefaultMCPGatewayVersion Version = "v0.4.7"
+const DefaultMCPGatewayVersion Version = "v0.4.8"

pkg/cli/docker_images.go

-ZizmorImage = "ghcr.io/zizmorcore/zizmor:1.28.0@sha256:8e6b3e4fb74d1aa5d23e83ea369f386c66eced0d1fb944d32cd8b2aac100b00d"
+ZizmorImage = "ghcr.io/zizmorcore/zizmor:1.29.0@sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284"

After applying, run make fmt && make build && make recompile && make recompile (the double recompile is required for the MCP Gateway version bump per the doc comment on DefaultMCPGatewayVersion — the second pass refreshes the container SHA pin once the digest is resolvable via gh aw upgrade/container pin cache).

---

Claude Code CLI: 2.1.220 → 2.1.222

Release timeline: 2.1.220 (repo baseline) → 2.1.221 → 2.1.222 (latest, as of 2026-08-05).

No public changelog/release repo is available for Claude Code; assessment is based on a --help output diff between the cached 2.1.220 baseline and a freshly installed 2.1.222.

Impact assessment: Net-unchanged CLI surface. No new/removed flags, commands, or options detected in --help output between the two versions. Low risk — safe to adopt.

• Breaking: None detected.
• Features: None detected in help surface (may include internal/model-level improvements not reflected in --help).
• Fixes: Unknown (no changelog available).
• Security: None flagged.
• Performance: Unknown.

---

GitHub Copilot CLI: 1.0.77 → 1.0.78

Released: 2026-08-03. Changelog: https://github.com/github/copilot-cli/releases/tag/v1.0.78

Impact assessment: No breaking changes to CLI flags/commands. --help output diff (verified against the correct npm-global binary, after working around a stale hosted-tool-cache binary shadowing on PATH) showed zero differences from 1.0.77. Low risk — safe to adopt.

Categorized changes

Features

• Timeline duration display for tool calls (5s+, toggle via /settings showToolDurations)
• Auto-updating first-party plugins at session start
• New experimental /new-worktree command
• Browser-based login now default for TTY-less desktop subprocess logins; headless/remote still uses device code
• ACP: sessions can be closed via closeSession request; token usage now exposed in ACP prompt results and usage_update notifications
• New managed setting forceRemoteSettingsRefresh
• Sandbox bypass is now scoped to the current session only; smarter fallback offers rerun-outside-sandbox without model involvement when bypass is allowed
• Improved /rewind: no longer needs git, restores only Copilot-modified files, offers conversation-only vs conversation-plus-files rewind
• New /permissions command to switch approval modes
• New sandbox setting allowDevToolCaches (default: on)
• GitHub MCP toolset/tool configuration is now explicitly respected
• Unknown top-level keys in settings.json now warn at startup instead of silently being ignored
• Shell completion: --model now suggests auto and valid model names
• Performance: progressive rendering for long transcripts; session resume history now read once at startup in parallel (cited example: a 230MB/74k-event transcript loads in under a second vs. ~10s, at roughly a quarter of the peak memory)
• /allow-all safety-judge model selection is now automatic (no longer configurable)

Fixes

• Extension slash commands now execute their handler exactly once per call, even with multiple extensions loaded
• Fixed inline images repeating their first row after timeline scrolling
• sessionEnd hook for stdin-piped prompts now fires once per completed turn with reason complete/error (previously fired once at shutdown with user_exit), matching -p behavior
• Split-view sidebar close confirmation text clarified
• Managed settings now fall back to cached policy on fetch failures (network errors, bad HTTP status, malformed response)

Security

• Sandbox bypass is session-scoped only; new sessions always restart sandboxed
• Sandbox-blocked commands can only be rerun outside the sandbox with explicit bypass permission
• ⚠️ Notable policy shift: managed-settings fetch failure with no cached policy available now fails open rather than fails closed. Worth flagging to anyone relying on managed settings for enforcement — availability is now favored over strict enforcement in that edge case.

Performance

• See transcript rendering / session resume items above.

---

Docker Image: Zizmor (ZizmorImage) — 1.28.0 → 1.29.0

• Constant: ZizmorImage in pkg/cli/docker_images.go
• Version: 1.28.0 → 1.29.0
• Published: 2026-08-01T21:14:45Z — cooldown check passed (3-day cooldown satisfied as of this run on 2026-08-05; the prior run on 2026-08-04 correctly held this update back since it was only ~2d9h old at that time)
• Digest: sha256:8e6b3e4fb74d1aa5d23e83ea369f386c66eced0d1fb944d32cd8b2aac100b00d → sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284
• Full pinned reference: ghcr.io/zizmorcore/zizmor:1.29.0@sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284
• GitHub release: https://github.com/zizmorcore/zizmor/releases/tag/v1.29.0

Changelog summary

Features

• Experimental pre-commit auditing (Initial pre-commit modeling zizmorcore/zizmor#2209)
• New insecure-url-scheme audit (More pre-commit plumbing zizmorcore/zizmor#2228)
• GitHub self-repository reference syntax $/foo/bar (Feature: Support Self-Repository Syntax For Actions zizmorcore/zizmor#2248)

Changes

• Split the unpinned-uses and unpinned-images audits into separate audits (Move docker image checks from unpinned-uses to unpinned-images zizmorcore/zizmor#2222)

Removals

• Removed --collect=workflows-only and --collect=actions-only flags (Remove old deprecated --collect modes zizmorcore/zizmor#2242). Verified no impact: grepped gh-aw's codebase for these flags — no usages found, so this repo's Zizmor invocations are unaffected.

Bug Fixes

• Fixed a bug producing incorrect literal values for job outputs (Handle jobs.*.outputs literals gracefully zizmorcore/zizmor#2220)
• Fixed a false positive in the github-app audit (Don't flag org-only app token requests as missing repos zizmorcore/zizmor#2227)
• Fixed config discovery to correctly start from the repo root (Make config discovery root-aware zizmorcore/zizmor#2234)

Security: None flagged beyond the new insecure-url-scheme audit itself (a detection improvement, not a vulnerability in Zizmor).

Impact assessment: Low risk. The only removal (--collect=* flags) does not affect gh-aw's usage. New audits may surface additional (likely legitimate) findings in future Zizmor scan runs across the repo's workflows — worth a quick look after this lands in case new findings appear in CI.

---

Docker Image: MCP Gateway (gh-aw-mcpg, DefaultMCPGatewayVersion) — v0.4.7 → v0.4.8

• Constant: DefaultMCPGatewayVersion in pkg/constants/version_constants.go
• Version: v0.4.7 → v0.4.8
• Published: 2026-08-05T00:05:39Z (not subject to the 3-day Docker-image cooldown rule per the scoping in this workflow's instructions, which excludes MCP Gateway/GitHub MCP Server/Playwright Browser)
• Digest: sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00 → sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8
• Full pinned reference: ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8
• GitHub release: https://github.com/github/gh-aw-mcpg/releases/tag/v0.4.8
• Full changelog: github/gh-aw-mcpg@v0.4.7...v0.4.8

Changelog summary

Predominantly internal test coverage, refactors, and debug-logging additions (30+ PRs, mostly automated test-improver/repo-assist bot PRs). Notable items:

Security-adjacent

• Prevent private secrecy taint for public-scope repo reads when the visibility lookup is unknown (Prevent private secrecy taint for public-scope repo reads when visibility lookup is unknown gh-aw-mcpg#10472)
• rust-guard: remove org-scope clone in tool labeling, add private list_releases secrecy coverage (rust-guard: remove org-scope clone in tool labeling and add private list_releases secrecy coverage gh-aw-mcpg#10473)
• rust-guard: centralize repo-visibility fallback semantics in labeling helpers (rust-guard: centralize repo-visibility fallback semantics in labeling helpers gh-aw-mcpg#10624)
• Allow integrity audit access to public Actions logs and artifacts (Allow integrity audit access to public Actions logs and artifacts gh-aw-mcpg#10626)

Other

• Improve jq filter parse diagnostics with gojq ParseError details (Improve jq filter parse diagnostics with gojq ParseError details gh-aw-mcpg#10474)
• Test rejection of unknown top-level TOML fields (Test rejection of unknown top-level TOML fields gh-aw-mcpg#10684)
• Numerous test-coverage-only and debug-logging-only PRs with no behavioral impact

Breaking: None found.
Fixes: None distinct from the security-adjacent items above.
Performance: None flagged.

Impact assessment: Low risk, mostly internal hardening/test-coverage work. The secrecy-taint and rust-guard visibility-fallback changes are defense-in-depth improvements around repo-visibility handling for MCP tool guarding — worth adopting promptly given the security-adjacent nature, even though none of the changes appear to fix an active vulnerability.

Sandbox note: The Docker daemon is unavailable in this workflow's sandbox, so the documented digest-resolution path (make build && make recompile && make recompile) could not automatically resolve the new v0.4.8 digest. The digest above was manually resolved via a GHCR anonymous bearer-token manifest request and injected into .github/aw/actions-lock.json under the containers key before recompiling; recompiled lock files were verified to contain the fully pinned reference throughout (manifest comment, download step, download_docker_images.sh args, and relevant env vars).

---

Unchanged (re-verified, no action needed)

• OpenAI Codex CLI: 0.146.0
• Playwright MCP: 0.0.78
• Playwright CLI: 0.1.17
• Pi CLI: 0.83.0
• GitHub MCP Server (Docker): v1.8.0
• Playwright Browser (Docker): v1.62.1
• Docker images (digest re-verified, matching upstream): Actionlint 1.7.12, Syft v1.50.0, Grype v0.116.1, Grant v0.6.8, Yamllint (latest), Poutine 1.1.6, RunnerGuard 3.1.5

Verification performed

• make fmt, make build, make recompile (x2), plus one additional manual ./gh-aw compile --validate --verbose --purge --schedule-seed github/gh-aw after injecting the MCP Gateway digest into the container-pin cache
• go test ./pkg/constants/... — passed
• go test ./pkg/cli/... -run "Docker|Zizmor|Version" -v — passed
• Confirmed no gh-aw code references the Zizmor flags removed in 1.29.0

Generated by 🔢 CLI Version Checker · agent · 345.5 AIC · ⌖ 28 AIC · ⊞ 11.8K · ◷

• expires on Aug 6, 2026, 10:32 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.45 AIC · ⌖ 6.57 AIC · ⊞ 8.9K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.03 AIC · ⌖ 7.02 AIC · ⊞ 8.5K · ◷