chore: upgrade gh-aw to v0.81.6 pre-release by lpcox · Pull Request #5668 · github/gh-aw-firewall

lpcox · 2026-06-29T10:03:56Z

Summary

Upgrades the gh-aw extension to the latest pre-release version (v0.81.6) using gh aw upgrade --pre-releases and recompiles all workflow lock files with post-processing applied.

Changes

Upgraded gh-aw from previous version to v0.81.6 (pre-release)
Recompiled all .lock.yml workflow files
Applied post-processing via npx ts-node scripts/ci/postprocess-smoke-workflows.ts

Notes

The upgrade produced some informational warnings about copilot-requests: write permissions and deprecated Playwright MCP mode — these are non-blocking
One workflow (smoke-copilot-byok-aoai-entra.md) has a known codemod error about top-level env secrets that requires manual intervention (pre-existing issue)

Ran `gh aw upgrade --pre-releases` and recompiled all workflow lock files with post-processing applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-06-29T10:05:54Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.16%	98.20%	📈 +0.04%
Statements	98.10%	98.13%	📈 +0.03%
Functions	99.54%	99.54%	➡️ +0.00%
Branches	94.14%	94.14%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/workdir-setup.ts`	92.7% → 94.5% (+1.82%)	92.7% → 94.5% (+1.82%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Upgrades the repository’s generated gh-aw workflow artifacts to gh-aw v0.81.6 (pre-release), including refreshed .lock.yml workflows and updated lock metadata used by the workflow compiler.

Changes:

Updated gh-aw action pins to v0.81.6 in .github/aw/actions-lock.json and introduced a new containers lock section.
Regenerated multiple .github/workflows/*.lock.yml files with gh-aw v0.81.6, including updated embedded awf-config.json container imageTag strings (now including cli-proxy digest pins).
Expanded the agentic-workflows skill router’s upstream file list to include .github/aw/instructions.md.

Show a summary per file

File	Description
.github/workflows/update-release-notes.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/smoke-services.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/smoke-claude.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/security-review.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/secret-digger-copilot.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/secret-digger-claude.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/refactoring-scanner.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/plan.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/pelis-agent-factory-advisor.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/issue-monster.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/issue-duplication-detector.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/firewall-issue-dispatcher.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/export-audit.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/duplicate-code-detector.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/doc-maintainer.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/dependency-security-monitor.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/copilot-token-optimizer.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/cli-flag-consistency-checker.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/claude-token-usage-analyzer.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/claude-token-optimizer.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/workflows/ci-doctor.lock.yml	Regenerated lock; embedded AWF config now includes `cli-proxy` digest in `imageTag`.
.github/skills/agentic-workflows/SKILL.md	Adds `.github/aw/instructions.md` to the upstream file list used by the skill router.
.github/aw/actions-lock.json	Updates gh-aw action pins to `v0.81.6` and adds a `containers` lock section.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 48/48 changed files
Comments generated: 1
Review effort level: Low

+  "containers": {
+    "ghcr.io/github/gh-aw-firewall/agent:0.27.10": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.10",
+      "digest": "sha256:e47878fa4953f5b4d38b4ec12c155aa12ab9befea299ea2d21a8b104de8bcbc8",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.10@sha256:e47878fa4953f5b4d38b4ec12c155aa12ab9befea299ea2d21a8b104de8bcbc8"


lpcox · 2026-06-29T13:50:26Z

@copilot address review feedback

Copilot

Review details

Files reviewed: 48/48 changed files
Comments generated: 1
Review effort level: Low

Copilot · 2026-06-29T13:58:03Z

@copilot address review feedback

Added the missing agent:0.27.11, api-proxy:0.27.11, and squid:0.27.11 digest entries to the containers section in .github/aw/actions-lock.json. The 0.27.10 entries are retained since two lock files (build-test-network-isolation.lock.yml and network-isolation-test.lock.yml) still reference those images. Fixed in commit fix: add missing 0.27.11 container pins to actions-lock.json.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-06-29T13:58:46Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-06-29T13:59:14Z

✅ Build Test Suite completed successfully!

github-actions · 2026-06-29T13:59:15Z

✅ Smoke Claude passed

github-actions · 2026-06-29T13:59:18Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-06-29T13:59:22Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-06-29T13:59:24Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-06-29T13:59:32Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-06-29T13:59:34Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-06-29T13:59:37Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-06-29T13:59:43Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-06-29T13:59:53Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-06-29T13:59:55Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-06-29T14:00:00Z

❌ Contribution Check failed. Please review the logs for details.

github-actions · 2026-06-29T14:00:03Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-06-29T14:00:09Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-06-29T14:02:40Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
gh check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #5668 · 36.2 AIC · ⊞ 3.3K · ◷

github-actions · 2026-06-29T14:03:04Z

✅ Smoke Test: Copilot BYOK (Direct) Mode

Test Results:

✅ MCP: github-list_pull_requests returned 2 merged PRs (titles: fix concurrency groups, refactor BYOK test scaffolding)
✅ Connectivity: github.com HTTP 200
✅ File I/O: smoke-test-copilot-byok.txt exists and readable
✅ BYOK Inference: Direct BYOK mode active (COPILOT_PROVIDER_API_KEY → api-proxy → api.githubcopilot.com)

Status: PASS | Running in direct BYOK mode via api-proxy sidecar

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-06-29T14:04:08Z

🔥 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

PR: chore: upgrade gh-aw to v0.81.6 pre-release
Author: @lpcox

Overall: PASS ✅

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-06-29T14:04:20Z

@lpcox

GitHub MCP Testing: ✅
GitHub.com connectivity: ✅
File write/read test: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-06-29T14:04:49Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	`3.12.13`	`3.12.3`	❌ NO
Node.js	`v24.17.0`	`v22.23.0`	❌ NO
Go	`go1.22.12`	`go1.22.12`	✅ YES

Overall: FAILED — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-06-29T14:04:51Z

Smoke test results

fix: add concurrency groups to prevent engine rate limiting ✅
refactor: deduplicate BYOK COPILOT_MODEL test scaffolding ✅
GitHub page title contains GitHub ✅
npm ci && npm run build ✅
Overall status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-06-29T14:04:51Z

🔍 Smoke Test: Copilot PAT Auth

Test	Status
GitHub MCP connectivity	✅ (listed PR #5662)
GitHub.com HTTP	✅ (200)
File write/read	❌ (pre-step outputs not injected — template vars unresolved)

Overall: FAIL

Auth mode: PAT (COPILOT_GITHUB_TOKEN)
@lpcox — pre-step smoke-data outputs were not passed to the agent step; file path/content variables arrived unsubstituted.

🔑 PAT report filed by Smoke Copilot PAT

github-actions · 2026-06-29T14:05:03Z

Smoke OTel Tracing — Results

Scenario	Status	Notes
1. Module Loading	✅	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + test helpers
2. Test Suite	✅	59 tests passed, 0 failed across `otel.test.js` and `otel-fanout.test.js` (2 suites, 2.075s)
3. Env Var Forwarding	✅	`src/services/api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, and `OTEL_SERVICE_NAME` to the api-proxy container
4. Token Tracker Integration	✅	`onUsage` callback exists in `token-tracker-http.js` (lines 283, 324, 374) and is the OTEL hook point
5. OTEL Diagnostics	i️	No `/var/log/api-proxy/otel.jsonl` found — expected outside the container. When OTEL endpoint is not configured, spans fall back to file; with Sentry endpoint configured, spans export via OTLP through Squid

All scenarios pass. OTEL tracing integration is functioning correctly in the api-proxy sidecar.

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-06-29T14:05:59Z

@lpcox @Copilot
Test Results:

[WIP] Remove unused export buildProviderTargetEnv in api-proxy-env-config ✅
[WIP] Fix incorrect export of TypeScript keywords in api-proxy-env-constants ✅
GitHub.com connectivity ✅
File I/O ✅
BYOK inference ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-06-29T14:06:06Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for #5668 · 62.9 AIC · ⊞ 7.8K · ◷

github-actions · 2026-06-29T14:06:45Z

Smoke Test Results — GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ timeout (no response)
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ timeout

Overall: FAIL

host.docker.internal resolves to 172.17.0.1 but neither Redis (port 6379) nor PostgreSQL (port 5432) are reachable. The service containers do not appear to be running or are not accessible from this runner environment.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-06-29T14:07:10Z

Smoke Test Results (Gemini)

GitHub MCP Testing: Partially PASSED (Found refactor: deduplicate BYOK COPILOT_MODEL test scaffolding #5661: refactor: deduplicate BYOK COPILOT_MODEL test scaffolding)
GitHub.com Connectivity: ✅ (HTTP 301)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

chore: upgrade gh-aw to v0.81.6 pre-release

2726887

Ran `gh aw upgrade --pre-releases` and recompiled all workflow lock files with post-processing applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 29, 2026 10:03

Copilot started reviewing on behalf of lpcox June 29, 2026 10:04 View session

Copilot AI reviewed Jun 29, 2026

View reviewed changes

lpcox requested a review from Copilot June 29, 2026 13:49

Copilot started reviewing on behalf of lpcox June 29, 2026 13:49 View session

Copilot AI reviewed Jun 29, 2026

View reviewed changes

Comment thread .github/aw/actions-lock.json

Copilot started work on behalf of lpcox June 29, 2026 13:54 View session

fix: add missing 0.27.11 container pins to actions-lock.json

95eb093

Copilot finished work on behalf of lpcox June 29, 2026 13:58

Potential fix for pull request finding

ef5431e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Jun 29, 2026

lpcox temporarily deployed to aoai-model June 29, 2026 14:00 — with GitHub Actions Inactive

github-actions Bot added the smoke-claude label Jun 29, 2026

github-actions Bot added the smoke-copilot-byok label Jun 29, 2026

lpcox temporarily deployed to aoai-model June 29, 2026 14:03 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot label Jun 29, 2026

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jun 29, 2026

lpcox temporarily deployed to aoai-model June 29, 2026 14:04 — with GitHub Actions Inactive

github-actions Bot added the smoke-codex label Jun 29, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jun 29, 2026

github-actions Bot added the build-test label Jun 29, 2026

github-actions Bot added the smoke-gemini label Jun 29, 2026

github-actions Bot mentioned this pull request Jun 29, 2026

[aw] Contribution Check failed #5683

Closed

lpcox merged commit 91ff380 into main Jun 29, 2026
88 of 89 checks passed

lpcox deleted the upgrade-gh-aw-pre-release branch June 29, 2026 15:18

github-actions Bot mentioned this pull request Jun 29, 2026

Internalize unused provider session ID helper #5680

Merged

Uh oh!

Conversation

lpcox commented Jun 29, 2026

Summary

Changes

Notes

Uh oh!

github-actions Bot commented Jun 29, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jun 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Copilot AI commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026

🔥 Smoke Test Results

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026

Chroot Version Comparison Results

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading