Bump default gh-aw-firewall (AWF) version to v0.28.5 by Copilot · Pull Request #54894 · github/gh-aw

Copilot · 2026-08-22T18:51:06Z

Pins the gh-aw-firewall (AWF) default version to the latest release, v0.28.5.

Version constant

pkg/constants/version_constants.go: DefaultFirewallVersion bumped from v0.28.4 → v0.28.5.
Compared v0.28.5's CLI options against v0.28.4: no new, changed, deprecated, or removed flags — the release is internal fixes only (Cloud Hypervisor readiness recovery, filesystem allowWrite boundary enforcement, CLI artifact redirect routing, tracking-issue link fixes). No AWF*MinVersion constants required changes.

Generated artifacts

Recompiled all workflow .lock.yml files to reference the new default.
Refreshed AWF container image digest pins for squid, agent, api-proxy, and cli-proxy at v0.28.5 in .github/aw/actions-lock.json and pkg/actionpins/data/action_pins.json / pkg/workflow/data/action_pins.json.

Changeset

Added a patch changeset documenting the version bump.

Fixes Bump AWF/firewall versions to v0.28.5 #54893

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

Bumps the default AWF release to v0.28.5 and regenerates dependent pins and workflows. The update misses AWF’s new filesystem schema integration and unintentionally removes a workflow-router entry.

Changes:

Updates the default AWF version and container digests.
Recompiles workflow lock files for v0.28.5.
Adds a patch changeset but removes skills/plugin routing guidance.

Show a summary per file

File	Description
`pkg/constants/version_constants.go`	Bumps the default AWF version.
`pkg/workflow/data/action_pins.json`	Adds v0.28.5 image pins.
`pkg/actionpins/data/action_pins.json`	Adds v0.28.5 image pins.
`.github/aw/actions-lock.json`	Adds v0.28.5 image pins.
`.github/workflows/smoke-ci.lock.yml`	Regenerates Smoke CI with v0.28.5.
`.github/workflows/notion-issue-summary.lock.yml`	Regenerates Notion workflow.
`.github/workflows/hippo-embed.lock.yml`	Regenerates Hippo workflow.
`.github/workflows/firewall.lock.yml`	Regenerates firewall test workflow.
`.github/workflows/example-permissions-warning.lock.yml`	Regenerates permissions example.
`.github/workflows/daily-arxiv-researcher.lock.yml`	Regenerates researcher workflow.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Regenerates Codex test workflow.
`.github/skills/agentic-workflows/SKILL.md`	Removes a skills/plugin routing entry.
`.changeset/patch-bump-firewall-v0-28-5.md`	Documents the patch release change.

Review details

Files reviewed: 21/295 changed files
Comments generated: 2
Review effort level: Balanced


 When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.
+


@@ -64,7 +64,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.10.0"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.28.4"
+const DefaultFirewallVersion Version = "v0.28.5"


lpcox · 2026-08-22T19:21:19Z

@copilot run the pr-finisher skill

github-actions · 2026-08-22T19:23:49Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-22T19:24:04Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #54894 does not have the implementation label and has 0 new lines of code in business logic directories (threshold: 100). The PR modifies 295 files but none in src/, lib/, pkg/, internal/, app/, core/, domain/, services/, or api/.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-22T19:24:05Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship. This PR is a pure version bump (DefaultFirewallVersion v0.28.4->v0.28.5) plus generated artifacts (recompiled .lock.yml files, actions-lock.json, action_pins.json) and a changeset entry. No hand-written logic in the diff to assess for over-engineering.

Generated by Ponytail Reviewer for #54894

github-actions · 2026-08-22T19:24:06Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. This PR bumps the gh-aw-firewall (AWF) version to v0.28.5, updating generated workflow lock files (.lock.yml), a changeset, and documentation. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-22T19:25:02Z

✅ PR Code Quality Reviewer completed the code quality review.

No new review comments were posted because the actionable issues in the changed lines were already covered by existing PR review comments, and I found no additional non-duplicate changed-line defects.

🔎 Code quality review by PR Code Quality Reviewer

github-actions

Skills-Based Review 🧠

Applied /codebase-design and /grill-with-docs — requesting changes on two issues already surfaced by inline review comments.

📋 Key Themes

Issues to Address

Unrelated deletion in SKILL.md — The skills/plugins dispatcher routing line was removed with no explanation. This silently breaks the skill-routing path for skills:/plugins: frontmatter requests. Restore it or document why it should go.
Schema not updated for filesystem.allowWrite — v0.28.5 adds a top-level filesystem.allowWrite config field per upstream PR #7634. pkg/workflow/schemas/awf-config.schema.json does not yet accept this field, so workflows using it will fail validation after the bump. The schema update (or AWFMinVersion guard) should accompany this version bump.

Positive Highlights

✅ All 295 lock files are consistently recompiled to the new digest pins
✅ Container image digests are SHA-pinned — good supply-chain hygiene
✅ Changeset entry is correctly scoped as patch
✅ PR description clearly documents the diff against v0.28.4 CLI flags

Please address the two existing inline comments before merging.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 30.5 AIC · ⌖ 13.6 AIC · ⊞ 7.6K
_{Comment /matt to run again}

github-actions

Review: Bump default AWF version to v0.28.5

This is a version bump PR with ~295 regenerated lock files. The core change (DefaultFirewallVersion constant + recompiled artifacts) looks mechanically correct.

The two existing inline comments already flag the substantive concerns:

.github/skills/agentic-workflows/SKILL.md — an unrelated skills routing entry deletion that should be restored.
pkg/constants/version_constants.go — schema compatibility gap for the new filesystem.allowWrite config field introduced in v0.28.5.

No additional issues found beyond what is already flagged.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 27 AIC · ⌖ 9 AIC · ⊞ 6.2K

github-actions · 2026-08-22T19:29:49Z

Comment Memory

reviewed_at: 2026-08-22T00:00:00Z
review_event: COMMENT
top_themes:
  - existing blocking concerns already raised by prior reviewer
  - no additional changed-line issues found in regenerated lockfiles/files reviewed
files_reviewed:
  - .changeset/patch-bump-firewall-v0-28-5.md
  - .github/aw/actions-lock.json
  - .github/skills/agentic-workflows/SKILL.md
  - .github/workflows/ab-testing-advisor.lock.yml
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 18.1 AIC · ⌖ 6.81 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

gh-aw-bot · 2026-08-22T19:37:53Z

@copilot this PR still needs forward progress.

Please investigate the failing checks on the current HEAD: Unit tests (N-R): https://github.com/github/gh-aw/actions/runs/32593033813/job/97081134704
Please address the outstanding requested changes and unresolved review feedback on the current HEAD.
Refresh the branch if needed and run the pr-finisher skill before handing back.

Run: https://github.com/github/gh-aw/actions/runs/32593943861

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.8 AIC · ⌖ 8.27 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-08-22T19:43:39Z

@copilot run the pr-finisher skill

Ran the pr-finisher workflow and pushed edb8c19.

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-22T20:01:47Z

@copilot this PR still needs forward progress.

Please investigate the failing checks on the current HEAD: Unit tests (N-R): https://github.com/github/gh-aw/actions/runs/32593033813/job/97081134704...

Restored the skills/plugins dispatcher route in f68ca78. The requested AWF filesystem schema/model/mapping integration is included in edb8c19. I reviewed the Unit tests (N-R) log and reproduced its exact full-shard command locally with CI=true; it passed without the reported closed-file coverage error.

done

github-actions · 2026-08-25T05:13:19Z

🎉 This pull request is included in a new release.

Release: v0.87.5

Initial plan

94a11b0

Copilot AI assigned Copilot and lpcox Aug 22, 2026

Copilot started work on behalf of lpcox August 22, 2026 18:51 View session

Copilot AI linked an issue Aug 22, 2026 that may be closed by this pull request

Bump AWF/firewall versions to v0.28.5 #54893

Closed

Bump default gh-aw-firewall (AWF) version to v0.28.5

937ca5d

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update AWF/firewall versions to v0.28.5~~ Bump default gh-aw-firewall (AWF) version to v0.28.5 Aug 22, 2026

Copilot finished work on behalf of lpcox August 22, 2026 19:08

Copilot AI requested a review from lpcox August 22, 2026 19:08

lpcox marked this pull request as ready for review August 22, 2026 19:12

Copilot AI balanced review requested due to automatic review settings August 22, 2026 19:12

Copilot started reviewing on behalf of lpcox August 22, 2026 19:13 View session

Copilot AI reviewed Aug 22, 2026

View reviewed changes

Copilot started work on behalf of lpcox August 22, 2026 19:21 View session

github-actions Bot mentioned this pull request Aug 22, 2026

[pr-sous-chef] PR Sous Chef run report #54661

Closed

github-actions Bot previously requested changes Aug 22, 2026

View reviewed changes

github-actions Bot reviewed Aug 22, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 22, 2026

[aw] No-Op Runs #48838

Open

Integrate AWF filesystem write boundaries

edb8c19

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox August 22, 2026 19:44

Copilot started work on behalf of gh-aw-bot August 22, 2026 19:44 View session

Copilot AI and others added 2 commits August 22, 2026 19:48

Report AWF follow-up plan

8fdee0f

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Restore skills and plugins routing

f68ca78

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 22, 2026 20:02

Copilot AI requested a review from gh-aw-bot August 22, 2026 20:02

pelikhan merged commit efaf339 into main Aug 22, 2026

pelikhan deleted the copilot/bump-awf-firewall-versions branch August 22, 2026 20:17

github-actions Bot mentioned this pull request Aug 23, 2026

[compiler-threat-spec] Daily compiler threat spec audit — add CTR-026 (generated job timeout expression injection) #54973

Merged


		When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.

Uh oh!

Conversation

Copilot AI commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version constant

Generated artifacts

Changeset

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Issues to Address

Positive Highlights

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review: Bump default AWF version to v0.28.5

Uh oh!

github-actions Bot commented Aug 22, 2026

Comment Memory

Uh oh!

gh-aw-bot commented Aug 22, 2026

Uh oh!

Copilot AI commented Aug 22, 2026

Uh oh!

Copilot AI commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading