Upgrade gh-aw to v0.85.0 pre-release and recompile workflows by lpcox · Pull Request #6957 · github/gh-aw-firewall

lpcox · 2026-08-05T12:05:02Z

Summary

Upgrades the gh-aw extension to the latest pre-release (v0.85.0) and recompiles all agentic workflows.

Changes

Upgraded gh-aw extension from v0.84.3 → v0.85.0
Updated github/gh-aw-actions/setup-cli from v0.84.3 → v0.85.0
Updated github/gh-aw-actions/setup from v0.84.3 → v0.85.0
Recompiled all 66 workflow lock files with the new compiler
Updated actions-lock.json

Notes

3 workflows have codemod warnings about top-level env secrets (smoke-bounded-agents-gvisor.md, smoke-bounded-agents.md, smoke-copilot-byok-aoai-entra.md) — these are pre-existing and emit warnings but still compile successfully
All unit tests pass (5393 tests, 308 suites)

- Upgraded gh-aw extension from v0.84.3 to v0.85.0 - Updated gh-aw-actions/setup-cli and gh-aw-actions/setup to v0.85.0 - Recompiled all workflow lock files - Updated actions-lock.json Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-05T12:07:30Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.87%	98.89%	📈 +0.02%
Statements	98.75%	98.78%	📈 +0.03%
Functions	99.10%	99.10%	➡️ +0.00%
Branches	94.97%	94.97%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Upgrades gh-aw and its setup actions to v0.85.0, then refreshes generated workflows to adopt the new compiler behavior.

Changes:

Updates pinned gh-aw actions and compiler metadata.
Recompiles workflows with new safety, reporting, and output-status handling.
Adds the new maintainer guidance resource.

Show a summary per file

File	Description
`.github/aw/actions-lock.json`	Pins v0.85.0 setup actions.
`.github/skills/agentic-workflows/SKILL.md`	Adds maintainer guidance.
`.github/workflows/test-hard-cap-ai-credits.lock.yml`	Recompiled with v0.85.0.
`.github/workflows/smoke-gemini.lock.yml`	Recompiled Gemini smoke workflow.
`.github/workflows/smoke-bounded-queries.lock.yml`	Recompiled bounded-query workflow.
`.github/workflows/smoke-bounded-queries-sbx.lock.yml`	Recompiled sbx variant.
`.github/workflows/smoke-bounded-queries-gvisor.lock.yml`	Recompiled gVisor variant.
`.github/workflows/security-review.lock.yml`	Recompiled security review workflow.
`.github/workflows/red-team-benchmark.lock.yml`	Recompiled red-team benchmark.
`.github/workflows/network-isolation-test.lock.yml`	Recompiled isolation test.
`.github/workflows/export-audit.lock.yml`	Recompiled export audit.
`.github/workflows/duplicate-code-detector.lock.yml`	Recompiled duplicate-code detector.
`.github/workflows/contribution-check.lock.yml`	Recompiled contribution check.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 48/66 changed files
Comments generated: 0
Review effort level: Balanced

github-actions · 2026-08-05T14:35:25Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-08-05T14:35:26Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-08-05T14:35:27Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-08-05T14:35:28Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-08-05T14:35:28Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-08-05T14:35:29Z

✅ Build Test Suite completed successfully!

github-actions · 2026-08-05T14:35:29Z

✅ Contribution Check completed successfully!

Contribution check complete for PR #6957: no actionable CONTRIBUTING.md violations found in the provided context, so no comment was needed.

github-actions · 2026-08-05T14:35:30Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-08-05T14:35:30Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-08-05T14:35:31Z

✅ Smoke Claude passed

github-actions · 2026-08-05T14:35:38Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-08-05T14:35:41Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-05T14:35:54Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

github-actions · 2026-08-05T14:35:58Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-08-05T14:36:04Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-08-05T14:37:11Z

Smoke Test: Copilot BYOK (Direct) Mode

Recent merged PRs: docs: Sync schemas and specs with source changes #6950 "docs: Sync schemas and specs with source changes", fix: demote benign rootless cleanup errors #6939 "fix: demote benign rootless cleanup errors"
GitHub MCP connectivity: ✅
GitHub.com connectivity (HTTP 200): ✅
File write/read test: ✅
BYOK inference test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall status: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:37:22Z

Copilot Smoke Test @lpcox

PR docs: Sync schemas and specs with source changes #6950: docs: Sync schemas and specs with source changes
PR fix: demote benign rootless cleanup errors #6939: fix: demote benign rootless cleanup errors

✅ GitHub MCP connectivity
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:37:23Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
GH check	✅ PASS
File status	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #6957 · haiku45 · 55.6 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:37:31Z

Smoke Test: Services Connectivity — FAIL

Redis: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal not resolvable from AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:38:23Z

EGRESS_RESULT allow=pass deny=pass

✅ allowed domain (api.github.com): HTTP 200
✅ blocked domain (example.com): denied (403 via proxy)

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:39:10Z

Smoke Test: API Proxy OTEL Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loaded successfully. isEnabled(): true. Exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, _provider, _ProxyAwareOtlpExporter, _FileSpanExporter, _FanOutSpanExporter, _parseEndpoints, _parseOtlpHeaders, _buildResourceSpans, _createOtlpWorkloadIdentity.
✅ Scenario 2 (Test Suite): 3 suites / 68 tests passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID to api-proxy.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook (4 references).
⚠️ Scenario 5 (OTEL Diagnostics): No /tmp/gh-aw/sandbox/firewall/logs/api-proxy/otel.jsonl file found — expected, since this run made no live LLM API traffic through the api-proxy sidecar with OTEL export configured (top-level /tmp/gh-aw/otel.jsonl contains gh-aw's own workflow-level tracing span, unrelated to api-proxy export).

Overall: PASS — all functional checks succeeded; no unexpected failures.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:39:11Z

Smoke Test Results (Gemini)

GitHub MCP: ❌ (docs: Sync schemas and specs with source changes #6950, fix: demote benign rootless cleanup errors #6939 - Filtered/Unauthorized)
Connectivity: ❌ (Status 000)
File Writing: ✅
Bash Tool: ✅

Overall Status: FAIL

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:39:43Z

Smoke Test

✅ docs: Sync schemas and specs with source changes
✅ fix: demote benign rootless cleanup errors
✅ GitHub title check passed
✅ smoke file written and verified
❌ npm ci && npm run build (registry 403 on yocto-queue)
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:40:29Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Java: ~/.m2 directory is owned by root in this environment and not writable by the runner user, so Maven's default local repository could not be created. Worked around this by pointing Maven at an alternate local repo (-Dmaven.repo.local=/tmp/gh-aw/agent/m2repo) while keeping the required proxy settings in ~/.m2/settings.xml. This is an environment/permissions quirk unrelated to the firewall itself, but may be worth fixing upstream (e.g., pre-creating ~/.m2 with correct ownership) so default Maven invocations work out of the box.
All other ecosystems (Bun, C++, Deno, .NET, Go, Node.js, Rust) built/installed and passed tests with no issues, confirming the firewall allowed all required domains for these package managers/registries.

Generated by Build Test Suite for #6957 · auto · 39.5 AIC · ⊞ 11.7K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:40:37Z

Smoke Test: Docker Sbx — Overall: PASS ✅

✅ GitHub MCP: connectivity confirmed (PR docs: Sync schemas and specs with source changes #6950, fix: demote benign rootless cleanup errors #6939)
✅ GitHub.com connectivity: HTTP 200
✅ File write/read: verified

cc @lpcox (author)

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-05T14:48:27Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. The smoke-chroot label was not applied since not all runtime versions matched.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

Copilot AI balanced review requested due to automatic review settings August 5, 2026 12:05

Copilot started reviewing on behalf of lpcox August 5, 2026 12:06 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

lpcox added the ready-for-aw label Aug 5, 2026

lpcox had a problem deploying to aoai-model August 5, 2026 14:36 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-byok label Aug 5, 2026

github-actions Bot added smoke-copilot smoke-claude labels Aug 5, 2026

lpcox temporarily deployed to aoai-model August 5, 2026 14:38 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Aug 5, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) failed #6964

Closed

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 5, 2026

lpcox temporarily deployed to aoai-model August 5, 2026 14:38 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Aug 5, 2026

[aw] Smoke Copilot BYOK AOAI (Entra) failed #6965

Closed

github-actions Bot mentioned this pull request Aug 5, 2026

[aw] Smoke Codex is missing required tool #6966

Closed

github-actions Bot added build-test smoke-docker-sbx labels Aug 5, 2026

lpcox merged commit 081cc9b into main Aug 5, 2026
135 of 139 checks passed

lpcox deleted the lpcox-upgrade-gh-aw-prerelease branch August 5, 2026 15:12

Uh oh!

Conversation

lpcox commented Aug 5, 2026

Summary

Changes

Notes

Uh oh!

github-actions Bot commented Aug 5, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Smoke Test: API Proxy OTEL Tracing — Results

Uh oh!

github-actions Bot commented Aug 5, 2026

Smoke Test Results (Gemini)

Uh oh!

github-actions Bot commented Aug 5, 2026

Smoke Test

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading

github-actions Bot commented Aug 5, 2026 •

edited

Loading