Mitigate mcp/memory scan findings by removing container usage and pin references

[Copilot]

The issue reported critical/high vulnerabilities and license violations in the pinned mcp/memory container image used by workflow MCP configuration. This change removes active usage of that image and eliminates it from pinned container catalogs consumed by workflow compilation.

• Workflow usage changes

  • shared/mcp/server-memory.md no longer uses container: "mcp/memory".
  • The server is switched to a uvx-launched MCP memory service with explicit persisted storage path under cache-memory.
  • mcp-inspector.md excludes server-memory.md from inspection imports with a security note tied to the vulnerability report.

• Pinned image catalog cleanup

  • Removed mcp/memory from .github/aw/actions-lock.json.
  • Synced generated pin catalogs in:
    • pkg/actionpins/data/action_pins.json
    • pkg/workflow/data/action_pins.json
  • Regenerated lock output updates mcp-inspector.lock.yml so the vulnerable image is no longer present in compiled workflow container sets.

mcp-servers:
  memory:
    command: "uvx"
    args: ["--from", "mcp-memory-service", "memory", "server"]
    env:
      MCP_MEMORY_BASE_DIR: "/tmp/gh-aw/cache-memory/server-memory"

• Fixes [container-image-scan] Container findings for mcp/memory #51716

---

Run: https://github.com/github/gh-aw/actions/runs/31386523734> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.8 AIC · ⌖ 7.79 AIC · ⊞ 6.1K · ◷

_{Comment /souschef to run again}

[pelikhan]

@copilot remove usage of this mcp all together

[Copilot]

@copilot remove usage of this mcp all together

Done in 2d24ec8. I removed the memory MCP component entirely by deleting .github/workflows/shared/mcp/server-memory.md, removed the related exclusion note in mcp-inspector.md, and recompiled to keep mcp-inspector.lock.yml in sync.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

Pull request overview

Mitigates #51716 by removing the vulnerable mcp/memory container reference.

Changes:

• Removes the shared memory-server configuration and inspector import.
• Removes the image from pin catalogs.
• Regenerates the inspector lock workflow.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Removes the vulnerable image pin.
.github/workflows/mcp-inspector.md	Excludes the memory server import.
.github/workflows/mcp-inspector.lock.yml	Regenerates output without the container.
.github/workflows/shared/mcp/server-memory.md	Deletes the shared memory configuration.
pkg/actionpins/data/action_pins.json	Removes the action-pin catalog entry.
pkg/workflow/data/action_pins.json	Removes the workflow catalog entry.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

.github/workflows/shared/mcp/server-memory.md:1

• Deleting this shared configuration instead of replacing its frontmatter removes the memory service entirely. docs/src/content/docs/reference/cache-memory.md:74 still tells users to import this path, and missing imports are hard compilation errors (pkg/parser/import_error_integration_test.go:47-59). Restore this file with the uvx/mcp-memory-service configuration described in the PR so the documented shared import remains usable without the vulnerable container.

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Addressed in eaa8602 by adding the server-memory.md removal note to .github/workflows/mcp-inspector.md, updating cache-memory.md so it no longer references the deleted shared import, and removing remaining vulnerable container examples/pins.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in f0327a6 by merging origin/main into this branch and fixing the conflict in .github/workflows/mcp-inspector.lock.yml with a regenerated lock file from the merged workflow source.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in f0327a6 by merging origin/main, regenerating workflow lock output, and pushing the resolved branch.

@copilot resolve the merge conflicts on this branch.

Resolved in f0327a6 by merging origin/main, regenerating workflow lock output, and pushing the resolved branch.

[gh-aw-bot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly, and run the pr-finisher skill before handing this back to maintainers.

Open review context (newest first):

• copilot-pull-request-reviewer left blocking feedback that .github/workflows/shared/mcp/server-memory.md should remain usable because docs still reference it; please verify current head against that review and resolve any addressed thread.

No failed checks were listed in the compact candidate snapshot.
Branch refresh was requested.
Run details: https://github.com/github/gh-aw/actions/runs/31386523734

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.8 AIC · ⌖ 7.79 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

[github-actions]

Triage: Mitigate mcp/memory scan findings by removing container usage and pin references

• Category: bug (security) | Risk: medium | Score: 70/100 (impact 30, urgency 25, quality 15)
• Recommended action: fast_track (batch: security-container-mitigation)
• Notes: Removes vulnerable pinned image, switches to uvx-launched memory service. Small diff (6 files). CI copilot check still in_progress at triage time — confirm before merge.

Generated by 🔧 PR Triage Agent · auto · 49.6 AIC · ⌖ 2.51 AIC · ⊞ 7.8K · ◷

[Copilot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly...

Completed in eaa8602. I refreshed against origin/main (already current), addressed the review by adding the server-memory.md removal note, removed the stale cache-memory.md import reference, removed remaining vulnerable container examples/pins, and replied on the review thread. Local validation passed: make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress. CI is stale on the agent-pushed head and needs a maintainer re-trigger before merge.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in 1c89797 by merging origin/main, resolving the workflow catalog/lock conflicts while keeping mcp/memory removed from active pins and generated lock output, and rerunning make recompile plus make agent-report-progress.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2