chore: upgrade gh-aw-firewall to v0.27.24 by Copilot · Pull Request #43664 · github/gh-aw

Copilot · 2026-07-06T03:24:57Z

Bumps the bundled gh-aw-firewall dependency from v0.27.22 → v0.27.24.

Changes

pkg/constants/version_constants.go — DefaultFirewallVersion → "v0.27.24"
pkg/actionpins/data/action_pins.json + pkg/workflow/data/action_pins.json — Added containers entries with manifest-digest pins for all four v0.27.24 sidecar images (agent, api-proxy, cli-proxy, squid)
pkg/workflow/docker_firewall_pin_compile_test.go — Updated hardcoded digests in TestCompileWorkflow_FirewallImagesPinnedForDefaultVersion to v0.27.24 SHAs
Golden fixtures — Refreshed TestWasmGolden_CompileFixtures / TestWasmGolden_AllEngines via -update
258 workflow lock files — Recompiled twice to propagate new version tag and SHA pins

Release notes review

v0.27.24 introduces no new CLI flags, schema fields, or behavioral changes — no new AWF*MinVersion constants required.

✨ PR Review Safe Output Test - Run 28771384644

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · 105.3 AIC · ⌖ 31.2 AIC · ⊞ 8.7K · ◷
_{Comment /smoke-claude to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

pelikhan · 2026-07-06T05:24:59Z

@copilot update container shas

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-06T05:39:56Z

@copilot update container shas

Done — added SHA pins for all four v0.27.24 sidecar images (agent, api-proxy, cli-proxy, squid) to .github/aw/actions-lock.json (the canonical source file that syncs to the embedded action_pins.json data), then recompiled twice to propagate the digest+pinned_image fields into all 258 lock file manifests.

gh-aw-bot · 2026-07-06T05:40:28Z

@copilot this branch has merge conflicts. Please run make merge-main to merge the latest main branch and resolve any conflicts, then push the result.

Generated by 👨‍🍳 PR Sous Chef · 10.2 AIC · ⌖ 6.1 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-06T05:51:04Z

@copilot this branch has merge conflicts. Please run make merge-main to merge the latest main branch and resolve any conflicts, then push the result.

...

Done — ran make merge-main, resolved the .lock.yml conflicts (regenerated via make recompile), and pushed the merge commit.

github-actions · 2026-07-06T06:07:28Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-07-06T06:07:28Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-07-06T06:07:29Z

🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨

github-actions · 2026-07-06T06:07:31Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-06T06:07:41Z

🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧

Smoke test completed; issue created; unable to add PR comment/label due to missing event context.

github-actions · 2026-07-06T06:08:55Z

📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-07-06T06:09:03Z

📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-07-06T06:09:11Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-07-06T06:12:33Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.54.0
jq	✅	1.7
yq	✅	4.53.3
curl	✅	8.5.0
gh	✅	2.95.0
node	✅	22.23.1
python3	✅	3.11.15 (PyPy 7.3.23)
go	✅	1.24.13
java	✅	21.0.11
dotnet	✅	10.0.301

Result: 12/12 tools available ✅

Overall Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔧 Tool validation by Agent Container Smoke Test · 12.1 AIC · ⌖ 6.02 AIC · ⊞ 4.7K · ◷
_{Comment /smoke-test-tools to run again}

github-actions · 2026-07-06T06:12:58Z

✅ GitHub MCP Testing
✅ Web Fetch Testing
✅ File Writing Testing
✅ Bash Tool Testing
❌ Build gh-aw

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

✨ Smoke Gemini — Powered by Gemini · ◷
_{Comment /smoke-gemini to run again}

github-actions · 2026-07-06T06:15:45Z

Smoke test PASS
Merged PRs:

fix(code-simplifier): allow all bash commands #43679 fix(code-simplifier): allow all bash commands
[compiler-threat-spec] spec(threat-detection): add CTR-021 workflow_run trigger branch scope (v1.0.15) #43678 [compiler-threat-spec] spec(threat-detection): add CTR-021 workflow_run trigger branch scope (v1.0.15)
Checks: 1-9 ✅, 10 ⏭️ skipped (no editable issue fields)

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex · 4.36 AIC · ⊞ 15.9K · ◷
_{Comment /smoke-codex to run again}

github-actions · 2026-07-06T06:15:47Z

Comment Memory

Late July morning
GitHub pages and build logs hum
Smoke test holds steady

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex · 4.36 AIC · ⊞ 15.9K · ◷
_{Comment /smoke-codex to run again}

github-actions

💥 Automated smoke test review - all systems nominal!

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · 105.3 AIC · ⌖ 31.2 AIC · ⊞ 8.7K
_{Comment /smoke-claude to run again}

github-actions · 2026-07-06T06:19:54Z

@@ -73,7 +73,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.5.0"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultFirewallVersion Version = "v0.27.22"
+const DefaultFirewallVersion Version = "v0.27.24"


✅ Firewall version bump to v0.27.24 looks correct here. Consider verifying the two-pass recompile note above still matches current behavior.

github-actions · 2026-07-06T06:19:54Z

-		"ghcr.io/github/gh-aw-firewall/api-proxy:" + imageTag: "sha256:afb9ff9140b17d38871dfb9dbac5ff8689ea634c2f91c435da2825192d4881c1",
-		"ghcr.io/github/gh-aw-firewall/cli-proxy:" + imageTag: "sha256:e23e1604241f579b418e6522d938285b57ada31bc27742a65c90ee2250b1755c",
-		"ghcr.io/github/gh-aw-firewall/squid:" + imageTag:     "sha256:3cdcc1e2b4b4fe602ba69fd3e21aac7ac512d5c1fce24df4ce69dc4f98164b59",
+		"ghcr.io/github/gh-aw-firewall/agent:" + imageTag:     "sha256:b283b1f037d2e068532fe178a06f2944696c3933ba11604979134e7896ac6f8c",


The hardcoded agent digest is updated to match v0.27.24 — nice. Ensure these SHAs stay in sync with action_pins.json.

github-actions · 2026-07-06T06:20:20Z

Smoke tests: ✅ 2 passed, ❌ 13 failed. Overall: FAIL. cc @app/copilot-swe-agent @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot - AOAI (Entra) · 31.1 AIC · ⌖ 3.21 AIC · ⊞ 17.6K · ◷
_{Comment /smoke-copilot-aoai-entra to run again}
_{Add label smoke to run again}

github-actions · 2026-07-06T06:20:45Z

PR: chore: upgrade gh-aw-firewall to v0.27.24
1✅ 2✅ 3✅ 4❌ 5❌ 6✅ 7✅ 8✅
9✅ 10❌ 11✅ 12✅ 13❌ 14❌ 15✅ 16✅
Overall: FAIL
Author: app/copilot-swe-agent
Assignees: lpcox, Copilot

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 121.6 AIC · ⌖ 5.25 AIC · ⊞ 19.1K · ◷
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions

Smoke done. New firewall pins seen.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 121.6 AIC · ⌖ 5.25 AIC · ⊞ 19.1K
_{Comment /smoke-copilot to run again}
_{Add label smoke to run again}

github-actions · 2026-07-06T06:23:20Z

1-4: ✅
5,7,9,12: ❌
6,8: ✅
10-15: ✅
Overall: FAIL

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot - AOAI (apikey) · 36.1 AIC · ⌖ 3.18 AIC · ⊞ 17.9K · ◷
_{Comment /smoke-copilot-aoai-apikey to run again}
_{Add label smoke to run again}

github-actions · 2026-07-06T06:23:21Z

Comment Memory

Silent bot at work
Ticking tests away
All done or not

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot - AOAI (apikey) · 36.1 AIC · ⌖ 3.18 AIC · ⊞ 17.9K · ◷
_{Comment /smoke-copilot-aoai-apikey to run again}
_{Add label smoke to run again}

github-actions

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot - AOAI (apikey) · 36.1 AIC · ⌖ 3.18 AIC · ⊞ 17.9K
_{Comment /smoke-copilot-aoai-apikey to run again}
_{Add label smoke to run again}

Initial plan

79147b2

Copilot AI assigned Copilot and lpcox Jul 6, 2026

Copilot started work on behalf of lpcox July 6, 2026 03:25 View session

Copilot AI linked an issue Jul 6, 2026 that may be closed by this pull request

Upgrade gh-aw-firewall to v0.27.24 #43663

Closed

chore: upgrade gh-aw-firewall to v0.27.24

74a9edc

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Upgrade gh-aw-firewall to v0.27.24~~ chore: upgrade gh-aw-firewall to v0.27.24 Jul 6, 2026

Copilot finished work on behalf of lpcox July 6, 2026 03:47

Copilot AI requested a review from lpcox July 6, 2026 03:47

pelikhan marked this pull request as ready for review July 6, 2026 05:24

Copilot AI review requested due to automatic review settings July 6, 2026 05:24

Copilot AI reviewed Jul 6, 2026

Copilot started work on behalf of pelikhan July 6, 2026 05:25 View session

chore: add container SHA pins for gh-aw-firewall v0.27.24

8a9d4db

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 6, 2026 05:40

Copilot AI requested a review from pelikhan July 6, 2026 05:40

github-actions Bot mentioned this pull request Jul 6, 2026

[pr-sous-chef] Run report — 2 nudged, 1 skipped #43694

Closed

Copilot started work on behalf of gh-aw-bot July 6, 2026 05:40 View session

chore: merge main into copilot/upgrade-gh-aw-firewall-v02724

082bf44

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 6, 2026 05:51

Copilot AI requested a review from gh-aw-bot July 6, 2026 05:51

pelikhan added the smoke label Jul 6, 2026

github-actions Bot temporarily deployed to aoai-model July 6, 2026 06:08 Inactive

github-actions Bot temporarily deployed to aoai-model July 6, 2026 06:09 Inactive

github-actions Bot mentioned this pull request Jul 6, 2026

[aw] Smoke Antigravity produced no safe outputs #43702

Closed

github-actions Bot mentioned this pull request Jul 6, 2026

[aw] Smoke Pi reported incomplete result #43704

Closed

pelikhan merged commit 6efb219 into main Jul 6, 2026
193 of 195 checks passed

pelikhan deleted the copilot/upgrade-gh-aw-firewall-v02724 branch July 6, 2026 06:14

github-actions Bot added smoke-codex and removed smoke labels Jul 6, 2026

github-actions Bot added the smoked label Jul 6, 2026

github-actions Bot temporarily deployed to aoai-model July 6, 2026 06:18 Inactive

github-actions Bot mentioned this pull request Jul 6, 2026

Smoke Test: Claude - 28771384644 #43710

Closed

github-actions Bot temporarily deployed to aoai-model July 6, 2026 06:19 Inactive

github-actions Bot reviewed Jul 6, 2026

View reviewed changes

github-actions Bot deployed to aoai-model July 6, 2026 06:20 Active

github-actions Bot mentioned this pull request Jul 6, 2026

Smoke Test: Copilot - 28771442720 #43712

Closed

github-actions Bot reviewed Jul 6, 2026

View reviewed changes

Uh oh!

Conversation

Copilot AI commented Jul 6, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Release notes review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jul 6, 2026

Uh oh!

Copilot AI commented Jul 6, 2026

Uh oh!

gh-aw-bot commented Jul 6, 2026

Uh oh!

Copilot AI commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Agent Container Tool Check

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Copilot AI commented Jul 6, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 6, 2026 •

edited

Loading

github-actions Bot commented Jul 6, 2026 •

edited

Loading

github-actions Bot commented Jul 6, 2026 •

edited

Loading

github-actions Bot commented Jul 6, 2026 •

edited

Loading

github-actions Bot commented Jul 6, 2026 •

edited

Loading