Recreate AWF firewall v0.27.26 integration and artifact refresh#43957
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot merge main and recompile |
🤖 PR Triage — §28848998303
📝 DRAFT — Recreates #43915 (AWF firewall v0.27.26 pin + artifact refresh). Large diff is generated output only (+4585/-4585, 100 files). Await draft completion before review.
|
There was a problem hiding this comment.
Pull request overview
This PR bumps the default gh-aw-firewall (AWF) integration to v0.27.26 and refreshes all derived pin datasets and generated artifacts so compiled workflow outputs consistently reference the new default firewall version.
Changes:
- Updated
DefaultFirewallVersiontov0.27.26. - Refreshed the firewall image pin sources and mirrored pin datasets to
0.27.26. - Regenerated compiled workflow lockfiles and wasm golden fixtures so emitted metadata/image references reflect the new default.
Show a summary per file
| File | Description |
|---|---|
pkg/constants/version_constants.go |
Bumps the canonical default AWF version to v0.27.26. |
.github/aw/actions-lock.json |
Updates the firewall image pin source entries to the 0.27.26 tags. |
pkg/actionpins/data/action_pins.json |
Syncs embedded pin data for firewall images to 0.27.26. |
pkg/workflow/data/action_pins.json |
Syncs workflow-layer mirrored pin data for firewall images to 0.27.26. |
.github/workflows/test-workflow.lock.yml |
Regenerated lockfile manifest and steps to use v0.27.26 / 0.27.26 references. |
.github/workflows/example-permissions-warning.lock.yml |
Regenerated lockfile to align emitted AWF version and image pins to 0.27.26. |
.github/workflows/codex-github-remote-mcp-test.lock.yml |
Regenerated lockfile to align emitted AWF version and image pins to 0.27.26. |
.github/workflows/bot-detection.lock.yml |
Regenerated lockfile to align emitted AWF version and image pins to 0.27.26. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden |
Updated golden output to reflect v0.27.26 / 0.27.26 references. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 35/271 changed files
- Comments generated: 0
- Review effort level: Low
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done in |
|
🌑 The shadows whisper... Smoke Codex failed to deliver outputs. The oracle requires further meditation... |
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Smoke Test Results
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke test FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "proxy.golang.org"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
|
Smoke tests summary: Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
💥 [THE END] — Illustrated by Smoke Claude · 111.5 AIC · ⌖ 30.9 AIC · ⊞ 8.4K
Comment /smoke-claude to run again
| @@ -73,7 +73,7 @@ const DefaultGitHubMCPServerVersion Version = "v1.5.0" | |||
| // | |||
| // The first recompile regenerates all lock files using the new version; the second recompile | |||
| // refreshes the container SHA pins that were resolved during the first pass. | |||
| const DefaultFirewallVersion Version = "v0.27.24" | |||
| const DefaultFirewallVersion Version = "v0.27.26" | |||
There was a problem hiding this comment.
Smoke test: confirm this firewall version bump is intentional and matches the actions-lock pin.
| }, | ||
| "ghcr.io/github/gh-aw-firewall/agent:0.27.24": { | ||
| "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.24", | ||
| "ghcr.io/github/gh-aw-firewall/agent:0.27.26": { |
There was a problem hiding this comment.
Smoke test: verify the pinned image SHA corresponds to the 0.27.26 tag.
There was a problem hiding this comment.
Smoke validation completed.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 73.8 AIC · ⌖ 5.11 AIC · ⊞ 19K
Comment /smoke-copilot to run again
Add label smoke to run again
|
🎉 This pull request is included in a new release. Release: |
This PR recreates the prior AWF integration update by moving
gh-awtogh-aw-firewallv0.27.26and regenerating derived artifacts so versioned image references stay consistent across compiler outputs.Scope is limited to version/pin propagation and generated output refresh.
Version pin update
DefaultFirewallVersiontov0.27.26inpkg/constants/version_constants.go.AWF*MinVersiongates unchanged.Firewall image pin source refresh
.github/aw/actions-lock.jsonfrom0.27.24to0.27.26.pkg/actionpins/data/action_pins.jsonpkg/workflow/data/action_pins.jsonGenerated artifact regeneration
.github/workflows/*.lock.ymlso emitted firewall image references and pinned metadata reflect the new default.pkg/workflow/testdata/wasm_golden/to match current compiler output after the version/pin change.✨ PR Review Safe Output Test - Run 28850819020
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.comSee Network Configuration for more information.