chore: upgrade workflows to gh-aw-actions v0.67.2 by lpcox · Pull Request #1731 · github/gh-aw-firewall

lpcox · 2026-04-06T23:10:32Z

Summary

Upgrades all agentic workflows to gh-aw-actions v0.67.2 (from v0.67.0).

Changes

Updated github/gh-aw-actions/setup v0.67.0 → v0.67.2
Updated github/gh-aw/actions/setup v0.67.0 → v0.67.2
Recompiled all 27 workflow lock files
Applied post-processing to smoke/build-test lock files
Updated agent file (.github/agents/agentic-workflows.agent.md)
Updated .github/aw/actions-lock.json with new action pins

Files changed

27 .lock.yml workflow files
1 agent file
1 actions-lock.json

- Updated github/gh-aw-actions/setup v0.67.0 → v0.67.2 - Updated github/gh-aw/actions/setup v0.67.0 → v0.67.2 - Recompiled all 27 workflow lock files - Applied post-processing to smoke/build-test lock files Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-06T23:11:17Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit f3f7901

github-actions · 2026-04-06T23:11:32Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	86.20%	86.29%	📈 +0.09%
Statements	86.07%	86.16%	📈 +0.09%
Functions	87.41%	87.41%	➡️ +0.00%
Branches	78.56%	78.61%	📈 +0.05%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	86.6% → 87.0% (+0.39%)	86.1% → 86.5% (+0.38%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Upgrades the repository’s generated agentic workflow lock files and related metadata for gh-aw workflows, updating pinned action SHAs and regenerating lock artifacts.

Changes:

Regenerated all 27 *.lock.yml workflows (new gh-aw metadata/version fields, updated action pins, and new “report incomplete”/rate-limit logging artifacts in several workflows).
Updated .github/aw/actions-lock.json with new action pin entries.
Updated .github/agents/agentic-workflows.agent.md to point at the newer gh-aw documentation version.

Show a summary per file

File	Description
.github/workflows/update-release-notes.lock.yml	Regenerated lock; updates gh-aw metadata/version env vars, action pins, and adds additional log artifact paths/“incomplete” handling.
.github/workflows/smoke-services.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/smoke-copilot.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/smoke-claude.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/smoke-chroot.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/smoke-codex.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/build-test.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/ci-doctor.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/ci-cd-gaps-assessment.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/security-review.lock.yml	Regenerated lock; pins setup action by SHA and updates scheduled cron time.
.github/workflows/security-guard.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/plan.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/pelis-agent-factory-advisor.lock.yml	Regenerated lock; pins setup action by SHA and updates scheduled cron time.
.github/workflows/issue-monster.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/issue-duplication-detector.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/firewall-issue-dispatcher.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/dependency-security-monitor.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/doc-maintainer.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/test-coverage-improver.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/copilot-token-optimizer.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/claude-token-usage-analyzer.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/claude-token-optimizer.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/secret-digger-copilot.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/secret-digger-claude.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/workflows/secret-digger-codex.lock.yml	Regenerated lock; updates pins/versions and adds “incomplete” handling and rate-limit log artifact path.
.github/aw/actions-lock.json	Updates action pin entries, including new gh-aw-actions/setup pins.
.github/agents/agentic-workflows.agent.md	Updates referenced gh-aw documentation links to the newer version.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 30/30 changed files
Comments generated: 5

Copilot · 2026-04-06T23:13:38Z

.github/workflows/update-release-notes.lock.yml

@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"84e6e2ebb02e905fbd045e470ac994f6a090f7bcbf56a102326a04e34fdb7ccf","compiler_version":"v0.67.0","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"84e6e2ebb02e905fbd045e470ac994f6a090f7bcbf56a102326a04e34fdb7ccf","compiler_version":"v0.67.1","strict":true,"agent_id":"copilot"}


This workflow was updated to gh-aw v0.67.1 (metadata/uses/CLI version), but the PR title/description says the upgrade is to v0.67.2. If v0.67.2 is the intended target, recompile/update this lock file so the gh-aw metadata (compiler_version), GH_AW_* version env vars, and setup action pin all reflect v0.67.2; otherwise adjust the PR description to match v0.67.1.

Copilot · 2026-04-06T23:13:39Z

.github/workflows/security-review.lock.yml

  schedule:
-  - cron: "41 12 * * *"
+  - cron: "42 12 * * *"


The scheduled run time changed (cron was modified). Since this affects when the security review runs, please confirm this schedule shift is intentional (and not just a byproduct of recompiling/"scattered" cron generation). If it should remain stable, keep the previous cron value in the source workflow and recompile.

Copilot · 2026-04-06T23:13:39Z

.github/workflows/pelis-agent-factory-advisor.lock.yml

 "on":
  schedule:
-  - cron: "29 10 * * *"
+  - cron: "26 21 * * *"


The scheduled run time changed significantly (cron and time-of-day were modified). Please confirm this is intentional, since it changes operational behavior; if it’s unintended churn from recompilation, keep the prior cron in the source workflow and recompile.

Copilot · 2026-04-06T23:13:39Z

.github/aw/actions-lock.json

+    "github/gh-aw-actions/setup@v0.67.1": {
      "repo": "github/gh-aw-actions/setup",
-      "version": "v0.67.0",
-      "sha": "cde65c546c2b0f6d3f3a9492a04e6687887c4fe8"
+      "version": "v0.67.1",
+      "sha": "80471a493be8c528dd27daf73cd644242a7965e0"
    },
-    "github/gh-aw/actions/setup@v0.67.0": {
+    "github/gh-aw-actions/setup@v0.67.2": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.67.2",
+      "sha": "03e31e064a68e8d5ad890c92f303cfb5a3536006"
+    },
+    "github/gh-aw/actions/setup@v0.67.2": {
      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.67.0",
-      "sha": "245d16844b16f61042aebf5931af62a750b202fc"
+      "version": "v0.67.2",
+      "sha": "5fb582bad4dfee2841251e97f9d22caa7eb3c82d"


actions-lock.json adds a v0.67.2 pin, but the updated workflow lock files in this PR appear to still reference gh-aw-actions/setup v0.67.1 (sha 80471a…). Either update the workflows to use the v0.67.2 sha (03e31e…) so the lock matches the PR’s stated upgrade target, or drop the unused v0.67.2 entry to avoid confusion.

Copilot · 2026-04-06T23:13:40Z

.github/agents/agentic-workflows.agent.md

 - Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
 - Workflow lock files: `.github/workflows/*.lock.yml`
 - Shared components: `.github/workflows/shared/*.md`
- Configuration: https://github.com/github/gh-aw/blob/v0.67.0/.github/aw/github-agentic-workflows.md
+- Configuration: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/github-agentic-workflows.md

 ## Problems This Solves


This agent doc updates links to gh-aw v0.67.1, but the PR title/description says v0.67.2. If the repo is meant to be upgraded to v0.67.2, update these links accordingly (or update the PR description if v0.67.1 is the intended version).

lpcox · 2026-04-06T23:18:28Z

@copilot apply changes based on the comments in this thread

…clean up actions-lock.json Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/22f1d4ea-d8d2-43a3-a501-6113abe8c06f Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-04-06T23:24:31Z

@copilot apply changes based on the comments in this thread

Applied all changes from the review in commit c978317:

All 27 lock files now reference v0.67.2 (compiler_version, action SHA 03e31e0, and version env vars)
Cron schedules restored to their original stable values (41 12 * * * for security-review, 29 10 * * * for pelis-agent-factory-advisor) — the changes were unintentional compilation artifacts
Agent doc links updated from v0.67.1 → v0.67.2
actions-lock.json now only contains the v0.67.2 entry (removed the unused v0.67.1 entry)
Post-processing re-applied to smoke/build-test lock files

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/actions/checkout/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/releases --jq .[].tag_name (http block)
https://api.github.com/repos/actions/github-script/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/releases --jq .[].tag_name (http block)
https://api.github.com/repos/actions/setup-node/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/releases --jq .[].tag_name (http block)
https://api.github.com/repos/actions/upload-artifact/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/releases --jq .[].tag_name (http block)
https://api.github.com/repos/docker/build-push-action/releases
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/releases --jq .[].tag_name (http block)
https://api.github.com/repos/docker/login-action/releases
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/releases --jq .[].tag_name (http block)
https://api.github.com/repos/docker/setup-buildx-action/releases
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/releases --jq .[].tag_name (http block)
https://api.github.com/repos/github/gh-aw-actions/releases
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/releases --jq .[].tag_name (http block)
https://api.github.com/repos/github/gh-aw/releases
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/releases --jq .[].tag_name (http block)
https://api.github.com/repos/github/gh-aw/releases/latest
- Triggering command: /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw upgrade (http block)
https://api.github.com/repos/softprops/action-gh-release/releases
- Triggering command: /usr/bin/gh gh api /repos/softprops/action-gh-release/releases --jq .[].tag_name (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-04-06T23:33:24Z

Smoke Test Results

✅ GitHub MCP: feat: propagate host.docker.internal to child containers (#422) #1722 "feat: propagate host.docker.internal to child containers", fix: enforce shared net namespace for child containers #1721 "fix: enforce shared net namespace for child containers"
✅ Playwright: github.com title contains "GitHub"
✅ File write: /tmp/gh-aw/agent/smoke-test-claude-24056188641.txt created
✅ Bash verify: file read back successfully

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-06T23:34:07Z

🤖 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	⚠️ (template vars unresolved)
File write/read	✅ `/tmp/gh-aw/agent/smoke-test-copilot-24056188603.txt`

PR: chore: upgrade workflows to gh-aw-actions v0.67.2
Author: @lpcox | Reviewer: @Mossaka

Overall: PASS ✅

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-04-06T23:34:08Z

Smoke test results:

PR title: feat: support npm install -g in agent container ✅
PR title: fix: enable color output when --tty flag is set ✅
GitHub MCP (last 2 merged PRs): ✅
safeinputs-gh pr list --repo github/gh-aw-firewall --limit 2 --json number,title,author: ❌
Playwright (title contains "GitHub"): ✅
Tavily search: ❌
File write + bash cat: ✅
Discussion query/comment: ❌
Build (npm ci && npm run build): ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-04-06T23:35:49Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note (Java): Maven's default local repository (~/.m2/repository) was not writable due to directory ownership. Used -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo as a workaround — both gson and caffeine compiled and tested successfully.

Generated by Build Test Suite for issue #1731 · ● 475.8K · ◷

github-actions · 2026-04-06T23:36:12Z

Smoke Test: GitHub Actions Services Connectivity

Result: ❌ All checks failed

Check	Status	Details
Redis PING (`host.docker.internal:6379`)	❌ Fail	`redis-cli` not installed; raw TCP to `172.17.0.1:6379` unreachable
PostgreSQL `pg_isready` (`host.docker.internal:5432`)	❌ Fail	`no response` (exit 2)
PostgreSQL `SELECT 1` (`smoketest` db)	❌ Fail	Not attempted (pg_isready already failed)

Root cause: The AWF iptables ruleset blocks database and Redis ports by default. host.docker.internal resolves to 172.17.0.1 but TCP connections to ports 6379 and 5432 are dropped. The --allow-host-service-ports flag was not configured for this run, so no exemptions are in place for these service ports.

🔌 Service connectivity validated by Smoke Services

lpcox requested a review from Mossaka as a code owner April 6, 2026 23:10

Copilot AI review requested due to automatic review settings April 6, 2026 23:10

Copilot started reviewing on behalf of lpcox April 6, 2026 23:11 View session

Copilot AI reviewed Apr 6, 2026

View reviewed changes

github-actions bot mentioned this pull request Apr 6, 2026

[aw] Security Guard failed #1732

Open

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-claude label Apr 6, 2026

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-copilot label Apr 6, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox April 6, 2026 23:18 View session

fix: update all workflows to v0.67.2, restore stable cron schedules, …

c978317

…clean up actions-lock.json Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/22f1d4ea-d8d2-43a3-a501-6113abe8c06f Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox April 6, 2026 23:25

github-actions bot mentioned this pull request Apr 6, 2026

[aw] No-Op Runs #1668

Open

github-actions bot added the build-test label Apr 6, 2026

lpcox enabled auto-merge (squash) April 6, 2026 23:40

lpcox merged commit 21616f5 into main Apr 6, 2026
60 of 61 checks passed

lpcox deleted the chore/upgrade-workflows-20260406 branch April 6, 2026 23:50

github-actions bot mentioned this pull request Apr 7, 2026

test: add CLI proxy sidecar integration tests #1734

Merged

4 tasks

		@@ -1,4 +1,4 @@
		# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"84e6e2ebb02e905fbd045e470ac994f6a090f7bcbf56a102326a04e34fdb7ccf","compiler_version":"v0.67.0","strict":true,"agent_id":"copilot"}
		# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"84e6e2ebb02e905fbd045e470ac994f6a090f7bcbf56a102326a04e34fdb7ccf","compiler_version":"v0.67.1","strict":true,"agent_id":"copilot"}

Conversation

lpcox commented Apr 6, 2026

Summary

Changes

Files changed

Uh oh!

github-actions bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Apr 6, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Apr 6, 2026

🤖 Smoke Test Results

Uh oh!

github-actions bot commented Apr 6, 2026

Uh oh!

github-actions bot commented Apr 6, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions bot commented Apr 6, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Apr 6, 2026 •

edited

Loading

github-actions bot commented Apr 6, 2026 •

edited

Loading

Copilot AI commented Apr 6, 2026 •

edited

Loading