Remove vulnerable gh-aw-firewall agent 0.27.44 container image pin

[Copilot]

Daily container scanning flagged ghcr.io/github/gh-aw-firewall/agent:0.27.44 (digest sha256:0d727725…bada8b4) for High-severity Node.js CVEs (CVE-2026-56846, CVE-2026-56848, CVE-2026-58043) plus brace-expansion and ip-address advisories. This was the last remaining 0.27.44 firewall pin — the squid, cli-proxy, and api-proxy pins for the same version were already removed in earlier remediations.

Changes

• .github/aw/actions-lock.json — dropped the ghcr.io/github/gh-aw-firewall/agent:0.27.44 container entry:

  "ghcr.io/github/gh-aw-firewall/agent:0.27.44": {
    "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44",
    "digest": "sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4",
    "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725…"
  },

• pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json — regenerated via make sync-action-pins.

• .changeset/patch-remove-vulnerable-awf-0-27-44-agent-pin.md — patch changeset following the wording of the prior 0.27.44 pin removals.

Notes

• Default firewall version is already v0.28.1; its pins are untouched.
• No workflow markdown or .lock.yml referenced the removed digest, so no recompilation is required. Removing the historical entry prevents the vulnerable digest from being resolved from embedded lock metadata.

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/agent:0.27.44 #52650

[Copilot]

Pull request overview

Removes the vulnerable gh-aw-firewall agent 0.27.44 digest from embedded lock metadata.

Changes:

• Removes the vulnerable pin from all synchronized catalogs.
• Adds a patch changeset documenting the remediation.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Removes the source container pin.
pkg/actionpins/data/action_pins.json	Updates embedded action-pin data.
pkg/workflow/data/action_pins.json	Updates embedded workflow data.
.changeset/patch-remove-vulnerable-awf-0-27-44-agent-pin.md	Documents the security fix.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.0