Refresh serena/gh-aw-node container pins and document accepted-risk :latest tag

[Copilot]

Static analysis flagged ghcr.io/oraios/serena:latest for carrying 50 Critical + 125 High CVEs, attributing this to a floating :latest tag in .github/workflows/shared/mcp/serena.md that could silently drift between compiles.

Investigation

• oraios/serena publishes no semver release tags or GitHub releases upstream — ghcr.io/oraios/serena only ever ships latest, with the underlying digest updated periodically.
• The repo already pins floating container tags to an immutable digest at compile time (pkg/actionpins, .github/aw/actions-lock.json, ADR 27762), and the daily container security scan already runs gh aw compile --force-refresh-container-pins to keep pins current — so there's no dangling drift, and no better tag to switch to.

Changes

• Documentation: added a comment in shared/mcp/serena.md explaining why latest is used intentionally (no versioned upstream alternative) and pointing to the existing digest-pin + refresh mitigation, so this doesn't get re-flagged as an oversight.
• Pin refresh: ran gh aw compile --force-refresh-container-pins to update ghcr.io/oraios/serena and ghcr.io/github/gh-aw-node to their newest currently-published digests in .github/aw/actions-lock.json.
• Recompile: regenerated all 286 .lock.yml files so compiled workflows reference the refreshed digests (digest-only diffs).

# .github/workflows/shared/mcp/serena.md
# Container pinning note:
#   oraios/serena publishes container images only under the `latest` tag on
#   ghcr.io (no semver release tags exist upstream, and no GitHub releases are
#   published: https://github.com/oraios/serena/releases). The compiler still
#   pins this reference to an immutable digest at compile time ...

• Fixes [static-analysis] Report - 2026-08-20 #54158

[github-actions]

Great work, Copilot team! 🎉 This PR follows the project's agentic development process perfectly — it's created by the core team's Copilot bot with a clear, detailed plan for investigating and addressing the container image versioning issue (#54158). The step-by-step approach (investigating upstream tags, documenting risks, refreshing digests, and running validation) demonstrates solid thinking. Since this is a draft with planned implementation steps, keep pushing forward with the plan as outlined. Looks ready to proceed!

Generated by ✅ Contribution Check · auto · 55.7 AIC · ⌖ 4.11 AIC · ⊞ 9.2K · ◷

[Copilot]

Pull request overview

Refreshes container digests used by compiled workflows and documents the rationale for Serena’s tag selection.

Changes:

• Updates Serena and gh-aw-node digest caches.
• Adds Serena pinning documentation.
• Regenerates all 286 workflow lock files.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Refreshes cached container digests.
pkg/actionpins/data/action_pins.json	Refreshes embedded action-pin data.
pkg/workflow/data/action_pins.json	Refreshes embedded workflow pin data.
.github/workflows/shared/mcp/serena.md	Documents Serena pinning rationale.
.github/workflows/*.lock.yml (286 files)	Regenerates workflows with refreshed immutable digests.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 119/290 changed files
• Comments generated: 2
• Review effort level: Balanced

[gh-aw-bot]

@copilot Please run make merge-main on this branch to resolve the current merge conflict and then run the pr-finisher skill. Leave a concise maintainer-facing handoff with validation status and any remaining human actions.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/32418499490

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.32 AIC · ⌖ 8.05 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}