chore: upgrade gh-aw to v0.81.0 and recompile workflows by lpcox · Pull Request #5447 · github/gh-aw-firewall

lpcox · 2026-06-23T18:25:15Z

Summary

Upgrades the gh aw extension to the latest pre-release v0.81.0 and recompiles all agentic workflow lock files, including the required smoke/build-test post-processing.

Changes

Pinned gh aw extension to v0.81.0 (pre-release) and ran gh aw upgrade (refreshes agents, actions pins, codemods, then recompiles).
Ran scripts/ci/postprocess-smoke-workflows.ts to restore local build+install for smoke/build-test workflows (build-test, smoke-copilot, smoke-claude, smoke-chroot, etc.).

Notable version bumps

github/gh-aw-actions/setup + setup-cli: v0.80.6 → v0.81.0
actions/cache (restore/save): v5.0.5 → v6.0.0
ghcr.io/github/github-mcp-server: v1.3.0 → v1.4.0
Refreshed .github/agents/agentic-workflows.md

All firewall/mcpg image digests remain pinned (the local gh-aw-mcpg:latest digest-resolution warning during compile was harmless — Docker daemon unavailable locally; existing pinned digests retained).

Verification

Pre-commit lint: 0 errors (warnings only); tsc build passed.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

Upgrade gh aw extension to pre-release v0.81.0, run gh aw upgrade to refresh agents/actions/codemods, recompile all workflow lock files, and re-run scripts/ci/postprocess-smoke-workflows.ts for smoke/build-test workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Upgrades the repository’s generated agentic workflow lock files to align with the gh-aw v0.81.0 pre-release toolchain and its updated pinned dependencies, keeping the workflow fleet in sync with upstream action/container revisions.

Changes:

Bumped github/gh-aw-actions/* pins to v0.81.0 and refreshed generated workflow lock content (including new runtime-features plumbing and usage artifacts).
Updated cache action pins in the repo lock to actions/cache v6.0.0 and propagated related workflow updates.
Refreshed agent documentation for agentic workflow prompts/references.

Show a summary per file

File	Description
.github/workflows/test-coverage-reporter.lock.yml	Regenerated lock workflow for coverage reporting; updates gh-aw pins and adds runtime-features plumbing (but currently includes an unpinned `gh-aw-mcpg:latest` download).
.github/workflows/firewall-issue-dispatcher.lock.yml	Regenerated lock workflow; updates gh-aw pins and bumps GitHub MCP server container to v1.4.0 with runtime-features logging.
.github/workflows/export-audit.lock.yml	Regenerated lock workflow; updates gh-aw pins and bumps GitHub MCP server container to v1.4.0 with runtime-features logging.
.github/workflows/duplicate-code-detector.lock.yml	Regenerated lock workflow; updates gh-aw pins and bumps GitHub MCP server container to v1.4.0 with runtime-features logging.
.github/workflows/doc-maintainer.lock.yml	Regenerated lock workflow; updates gh-aw pins, adds runtime-features logging, and adjusts checkout credential persistence behavior.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Regenerated lock workflow; updates gh-aw pins (including setup-cli) and bumps GitHub MCP server container to v1.4.0 with runtime-features logging.
.github/aw/actions-lock.json	Updates the repo action lock entries (notably `actions/cache/*`) to v6.0.0.
.github/agents/agentic-workflows.md	Updates documentation references for agentic workflow prompt/reference files (now pointing to upstream URLs).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 27/44 changed files
Comments generated: 4

@@ -504,15 +524,15 @@ jobs:
          GH_AW_SKILL_DIR: ".github/skills"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
      - name: Download container images
-        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.7@sha256:aae231e4635c8999d039c132f1602d3df850fe9b84a00aa2b5ac981179b5661c ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7@sha256:009caf2e3d88fa77b64e9a03a95a228fc58db0f1701c6d324b29ba5a3c7c79b6 ghcr.io/github/gh-aw-firewall/squid:0.27.7@sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96 ghcr.io/github/gh-aw-mcpg:latest@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.7@sha256:aae231e4635c8999d039c132f1602d3df850fe9b84a00aa2b5ac981179b5661c ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7@sha256:009caf2e3d88fa77b64e9a03a95a228fc58db0f1701c6d324b29ba5a3c7c79b6 ghcr.io/github/gh-aw-firewall/squid:0.27.7@sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96 ghcr.io/github/gh-aw-mcpg:latest ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b


-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c20f9e750acfb2da7ce8698626ebeb65efb33300","version":"v0.80.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.7","digest":"sha256:aae231e4635c8999d039c132f1602d3df850fe9b84a00aa2b5ac981179b5661c","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.7@sha256:aae231e4635c8999d039c132f1602d3df850fe9b84a00aa2b5ac981179b5661c"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7","digest":"sha256:009caf2e3d88fa77b64e9a03a95a228fc58db0f1701c6d324b29ba5a3c7c79b6","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7@sha256:009caf2e3d88fa77b64e9a03a95a228fc58db0f1701c6d324b29ba5a3c7c79b6"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.7","digest":"sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.7@sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96"},{"image":"ghcr.io/github/gh-aw-mcpg:latest","digest":"sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa","pinned_image":"ghcr.io/github/gh-aw-mcpg:latest@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"}]}
-# This file was automatically generated by gh-aw (v0.80.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"28e67879e38edce31ae7ba59538ee81eea15b82acd2e01d6ce090fa2bd6b277a","body_hash":"27b283d7d496b7d95fb456b86287c2d192d7894c1e4cee77afcfbbbd8ca9169b","compiler_version":"v0.81.0","agent_id":"copilot","engine_versions":{"copilot":"1.0.63"}}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/restore","sha":"2c8a9bd7457de244a408f35966fab2fb45fda9c8","version":"v6.0.0"},{"repo":"actions/cache/save","sha":"2c8a9bd7457de244a408f35966fab2fb45fda9c8","version":"v6.0.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"3c7f3b6f423dd721e2f115b7c8fda65287e1f137","version":"v0.81.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.7","digest":"sha256:aae231e4635c8999d039c132f1602d3df850fe9b84a00aa2b5ac981179b5661c","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.7@sha256:aae231e4635c8999d039c132f1602d3df850fe9b84a00aa2b5ac981179b5661c"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7","digest":"sha256:009caf2e3d88fa77b64e9a03a95a228fc58db0f1701c6d324b29ba5a3c7c79b6","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.7@sha256:009caf2e3d88fa77b64e9a03a95a228fc58db0f1701c6d324b29ba5a3c7c79b6"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.7","digest":"sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.7@sha256:deb1d4e19de62d51cee0508057a596a19315c3423ada4d675cad136dc8037c96"},{"image":"ghcr.io/github/gh-aw-mcpg:latest"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"}]}


+> **Note**: The prompt and reference files listed below are located in the [`github/gh-aw`](https://github.com/github/gh-aw) repository and are **not available locally** in this repository. Load them from their public URLs.
+


+    "actions/cache/restore@v6.0.0": {
      "repo": "actions/cache/restore",
-      "version": "v5.0.5",
-      "sha": "27d5ce7f107fe9357f9df03efb73ab90386fccae"
+      "version": "v6.0.0",
+      "sha": "2c8a9bd7457de244a408f35966fab2fb45fda9c8"
    },
-    "actions/cache/save@v5.0.5": {
+    "actions/cache/save@v6.0.0": {
      "repo": "actions/cache/save",
-      "version": "v5.0.5",
-      "sha": "27d5ce7f107fe9357f9df03efb73ab90386fccae"
+      "version": "v6.0.0",
+      "sha": "2c8a9bd7457de244a408f35966fab2fb45fda9c8"
    },
-    "actions/cache@v5.0.5": {
+    "actions/cache@v6.0.0": {
      "repo": "actions/cache",
-      "version": "v5.0.5",
-      "sha": "27d5ce7f107fe9357f9df03efb73ab90386fccae"
+      "version": "v6.0.0",
+      "sha": "2c8a9bd7457de244a408f35966fab2fb45fda9c8"


The v0.81.0 recompile (#5447) bumped the setup action to v0.81.0 (SHA 3c7f3b6f), github-mcp-server to v1.4.0, and changed the offline COPILOT_DUMMY_BYOK placeholder to 'dummy-byok-key-for-offline-mode'. Update the stale assertions in the security-guard, export-audit, and test-coverage-improver workflow tests to match. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 23, 2026 18:25

Copilot started reviewing on behalf of lpcox June 23, 2026 18:26 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

lpcox merged commit c052887 into main Jun 23, 2026
24 of 25 checks passed

lpcox deleted the chore/upgrade-gh-aw-v0.81.0 branch June 23, 2026 18:31

lpcox mentioned this pull request Jun 23, 2026

test: fix failing npm test after gh-aw v0.81.0 recompile #5450

Merged

github-actions Bot mentioned this pull request Jun 23, 2026

Refactor host-access validation tests to remove duplicated exit/assert scaffolding #5462

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: upgrade gh-aw to v0.81.0 and recompile workflows#5447

chore: upgrade gh-aw to v0.81.0 and recompile workflows#5447
lpcox merged 1 commit into
mainfrom
chore/upgrade-gh-aw-v0.81.0

lpcox commented Jun 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		> Note: The prompt and reference files listed below are located in the [`github/gh-aw`](https://github.com/github/gh-aw) repository and are not available locally in this repository. Load them from their public URLs.

Uh oh!

Conversation

lpcox commented Jun 23, 2026

Summary

Changes

Notable version bumps

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants