Remove vulnerable gh-aw-firewall/squid:0.27.44 digest pin from shared container pin catalogs

[Copilot]

Daily image scanning flagged the pinned ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48... image for multiple High/Medium CVEs. This change removes that vulnerable historical squid pin from shared lock metadata so it can no longer be resolved by embedded pin catalogs.

• Scope of change

  • Deleted the ghcr.io/github/gh-aw-firewall/squid:0.27.44 container entry from:
    • .github/aw/actions-lock.json
    • pkg/actionpins/data/action_pins.json
    • pkg/workflow/data/action_pins.json
  • Kept current 0.28.1 squid pin intact.

• Release note

  • Added a patch changeset documenting the security remediation:
    • .changeset/patch-remove-vulnerable-awf-0-27-44-squid-pin.md

• Pin delta (illustrative)

  // removed
  "ghcr.io/github/gh-aw-firewall/squid:0.27.44": {
    "digest": "sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"
  }

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid #52453

[github-actions]

🎉 Great work! This PR successfully addresses a security vulnerability in the pinned squid container image (gh-aw-firewall/squid:0.27.44).

The PR is well-focused and properly documented:

• ✅ Clear scope — Removes only the vulnerable 0.27.44 pin from all three pin catalog locations
• ✅ Security-focused — Preserves the current pin, ensuring continuity
• ✅ Release note included — Changeset entry documents the remediation
• ✅ No extraneous changes — Laser-focused on the vulnerability remediation

This is exactly the kind of security-driven infrastructure maintenance the project needs. Looks ready to go!

Generated by ✅ Contribution Check · auto · 50.6 AIC · ⌖ 3.74 AIC · ⊞ 8.8K · ◷

[Copilot]

Pull request overview

Removes the vulnerable AWF Squid 0.27.44 digest from shared pin catalogs and documents the security change.

Changes:

• Removes the affected digest from all three pin catalogs.
• Retains Squid 0.28.1.
• Adds a patch changeset.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Removes the vulnerable canonical pin.
pkg/actionpins/data/action_pins.json	Removes the embedded actionpins copy.
pkg/workflow/data/action_pins.json	Removes the embedded workflow copy.
.changeset/patch-remove-vulnerable-awf-0-27-44-squid-pin.md	Documents the remediation.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.3