Add regression guard for vulnerable gh-aw-firewall squid 0.27.44 container pin

[Copilot]

Daily container scanning flagged ghcr.io/github/gh-aw-firewall/squid:0.27.44 (sha256:83e48bbe…) for 14 High / 8 Medium CVEs in Alpine bind-libs/bind-tools.

Findings

The pin was already removed from every pin source, and DefaultFirewallVersion is v0.28.1:

• pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json, .github/aw/actions-lock.json all carry only squid:0.28.1
• The vulnerable digest appears nowhere except the existing changeset text
• .changeset/patch-remove-vulnerable-awf-0-27-44-squid-pin.md is present

The gap: sibling guards exist for api-proxy:0.27.44 and cli-proxy:0.27.44, but not for squid.

Changes

• pkg/actionpins/actionpins_internal_test.go: add TestEmbeddedContainerPins_DoNotIncludeVulnerableAWFSquid02744, mirroring the existing api-proxy/cli-proxy assertions, so the digest cannot be re-embedded unnoticed.

func TestEmbeddedContainerPins_DoNotIncludeVulnerableAWFSquid02744(t *testing.T) {
	t.Parallel()

	_, ok := GetContainerPin("ghcr.io/github/gh-aw-firewall/squid:0.27.44")

	assert.False(t, ok, "ghcr.io/github/gh-aw-firewall/squid:0.27.44 should not be embedded as a pinned container image")
}

Out of scope

gh-aw-firewall/agent:0.27.44 is still pinned in the lock data. It was not part of this scan finding, so it is left untouched here; prior remediations handled each flagged image individually.

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.27.44 #52652

[github-actions]

PR Triage

• Category: chore | Risk: low | Score: 25/100 (Impact 8, Urgency 7, Quality 10)
• Action: defer
• WIP/draft PR with 0 diff so far (branch not yet populated); addresses container image scan finding. Revisit once commits land.

Generated by 🔧 PR Triage Agent · auto · 37.4 AIC · ⌖ 2.04 AIC · ⊞ 8.1K · ◷