Bump default AWF firewall image set to v0.25.40#30406
Merged
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/66ce1e3f-9dcc-402e-bcd2-7c9b981c9a73 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Bump AWF container images to v0.25.40
Bump default AWF firewall image set to v0.25.40
May 5, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the default Agent Workflow Firewall (AWF) version and refreshes the embedded container pin datasets and compiler golden fixtures to align newly compiled workflows with AWF v0.25.40.
Changes:
- Bumps
DefaultFirewallVersiontov0.25.40. - Adds container digest pins for AWF
agent,api-proxy, andsquidat0.25.40and propagates them into embedded pin datasets. - Refreshes WASM compile fixture goldens to reflect the new default AWF version in emitted workflow YAML.
Show a summary per file
| File | Description |
|---|---|
pkg/constants/version_constants.go |
Bumps the default AWF version to v0.25.40. |
.github/aw/actions-lock.json |
Adds 0.25.40 digest pins for AWF images (source-of-truth pin set). |
pkg/actionpins/data/action_pins.json |
Syncs embedded pin dataset with the updated lock pins. |
pkg/workflow/data/action_pins.json |
Syncs workflow-embedded pin dataset with the updated lock pins. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden |
Updates expected compiled YAML output to v0.25.40. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden |
Updates expected compiled YAML output to v0.25.40. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden |
Updates expected compiled YAML output to v0.25.40. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden |
Updates expected compiled YAML output to v0.25.40. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 8/8 changed files
- Comments generated: 2
| "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.40", | ||
| "digest": "sha256:14ff567e8d9d4c2fbc5e55c973488381c71d7e0fdbe72d30ee7b8a738fd86504", | ||
| "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.40@sha256:14ff567e8d9d4c2fbc5e55c973488381c71d7e0fdbe72d30ee7b8a738fd86504" | ||
| }, |
Comment on lines
62
to
64
| // DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary | ||
| const DefaultFirewallVersion Version = "v0.25.39" | ||
| const DefaultFirewallVersion Version = "v0.25.40" | ||
|
|
Contributor
There was a problem hiding this comment.
🤖 Smoke test agent was also here! Replying to confirm the review comment chain is working correctly. All systems nominal! ✅
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · ● 1.7M
Collaborator
|
@copilot address review feedback |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/4b1ce42e-c25d-451f-b2ad-6b854d555450 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
This reverts commit 6670a99. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/4b1ce42e-c25d-451f-b2ad-6b854d555450 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
Author
Addressed review feedback in ac40289: added the missing Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
Contributor
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
Contributor
|
|
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
|
Commit pushed:
|
Contributor
Agent Container Tool Check
Result: 11/12 tools available — FAIL (dotnet missing)
|
Collaborator
|
@copilot merge main and recompile |
Contributor
|
Smoke Test Codex 25398480751: FAIL Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Contributor
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Copilot stopped work on behalf of
pelikhan due to an error
May 5, 2026 20:04
Contributor
|
Smoke Test Results — Run §25398480809
Overall: PARTIAL (test #19 skipped — no safe test PR to close) Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal! Run 25398480809 — Claude engine validated.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
💥 [THE END] — Illustrated by Smoke Claude · ● 266.1K
|
|
||
| // DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary | ||
| const DefaultFirewallVersion Version = "v0.25.39" | ||
| const DefaultFirewallVersion Version = "v0.25.40" |
Contributor
There was a problem hiding this comment.
✅ Smoke test review comment #1 — Run 25398480809: Version bump from v0.25.39 to v0.25.40 looks correct. Digest pins are consistent across all action_pins.json files.
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Bump the default AWF firewall image set to v0.25.40 with updated digest pins. |
Contributor
There was a problem hiding this comment.
✅ Smoke test review comment #2 — Run 25398480809: Changeset entry correctly categorizes this as a patch bump for the AWF firewall image update to v0.25.40.
Contributor
|
🤖 Beep boop! The smoke test agent has arrived at this discussion like a robot crashing a party. All tests running, circuits firing, and vibes: absolutely immaculate. This message was auto-generated by the Copilot smoke test for run 25398480813. 🎉 Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Contributor
|
Smoke Test 25398480813: ✅ PASS
Author: Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Contributor
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Contributor
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
This was referenced May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gh-aw was compiling workflows with default AWF
v0.25.39, and embedded container pin data still included older0.25.29entries for AWF images. This updates the default AWF version and container pin data so newly compiled lock files resolve to0.25.40with digest pins for all AWF sidecars used by default flows, includingcli-proxy.Default AWF version bump
DefaultFirewallVersionfromv0.25.39tov0.25.40inpkg/constants/version_constants.go.container.imageTag) and related schema/version wiring.Container pin source update
0.25.40entries (image + digest +pinned_image) for:ghcr.io/github/gh-aw-firewall/agentghcr.io/github/gh-aw-firewall/api-proxyghcr.io/github/gh-aw-firewall/squidghcr.io/github/gh-aw-firewall/cli-proxy.github/aw/actions-lock.jsonas the source-of-truth lock.Synced embedded pin datasets
pkg/actionpins/data/action_pins.jsonpkg/workflow/data/action_pins.json.github/aw/actions-lock.json.Golden output refresh for compiler fixtures
Changeset
✨ PR Review Safe Output Test - Run 25398480809
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.comSee Network Configuration for more information.