Remove vulnerable cli-proxy 0.27.44 container pin

[Copilot]

The pinned cli-proxy:0.27.44 image contains multiple high-severity Node.js and npm dependency vulnerabilities. The default firewall version already uses the unaffected 0.28.1 image.

• Container pins

  • Remove cli-proxy:0.27.44 from canonical lock data.
  • Synchronize its removal across embedded pin catalogs.

• Regression coverage

  • Verify the vulnerable image can no longer be resolved from embedded metadata.

• Release metadata

  • Add a patch changeset documenting the removal.

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44 #52651

[github-actions]

Great work addressing the container vulnerability! 🛡️ This PR cleanly removes the vulnerable cli-proxy:0.27.44 image pin that carried 6 high-severity Node.js CVEs and replaces it with the safe 0.28.1 version already in use by the default firewall configuration.

What's working well:

• ✅ Focused scope — the change removes the vulnerable pin from all three locations (canonical lock data + 2 embedded catalogs) and adds regression test coverage.
• ✅ Tests included — the test file changes verify the vulnerable image can no longer be resolved from embedded metadata.
• ✅ Clear description — the PR body explains the security issue, what's being removed, and the remediation.
• ✅ Release metadata — changelog entry documenting the patch is included.
• ✅ Aligns with process — this is an agentic workflow contribution created by Copilot SWE agent for a high-priority security fix, which fits the project's contribution model.

This looks ready for review. The diff is small (13 additions, 15 deletions), well-scoped, and addresses the security concern from issue #52651 directly.

Generated by ✅ Contribution Check · auto · 48.9 AIC · ⌖ 3.27 AIC · ⊞ 9.1K · ◷

[Copilot]

Pull request overview

Removes the vulnerable cli-proxy:0.27.44 digest from canonical and embedded container-pin metadata.

Changes:

• Removes the vulnerable pin from all three catalogs.
• Adds regression coverage preventing reintroduction.
• Adds patch release metadata.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Removes the canonical vulnerable pin.
pkg/actionpins/data/action_pins.json	Updates the embedded pin catalog.
pkg/workflow/data/action_pins.json	Synchronizes workflow pin data.
pkg/actionpins/actionpins_internal_test.go	Verifies the image cannot be resolved from embedded metadata.
.changeset/patch-remove-vulnerable-awf-0-27-44-cli-proxy-pin.md	Documents the security-related patch.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.0