Upgrade gh-aw to v0.82.2 pre-release and recompile workflows by lpcox · Pull Request #5932 · github/gh-aw-firewall

lpcox · 2026-07-05T15:28:06Z

Summary

Upgrades the gh-aw extension to the latest pre-release (v0.82.2) and recompiles all agentic workflow lock files.

Changes

Upgraded gh-aw extension to v0.82.2 via gh aw upgrade --pre-releases
Recompiled all workflow lock files with post-processing (postprocess-smoke-workflows.ts)
Fixed test assertion in self-hosted-runner-doctor-updater-workflow.test.ts for updated cache key format (now includes CACHE_MEMORY_DATE and run_id segments)

Notes

The codemod flagged smoke-copilot-byok-aoai-entra.md for having secrets in top-level env (pre-existing issue, not introduced by this upgrade)
All 3468 tests pass after the fix

- Upgraded gh-aw extension to v0.82.2 via 'gh aw upgrade --pre-releases' - Recompiled all workflow lock files with post-processing - Fixed test assertion for updated cache key format in runner doctor workflow Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-07-05T15:30:03Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.81%	98.81%	➡️ +0.00%
Statements	98.73%	98.73%	➡️ +0.00%
Functions	99.58%	99.58%	➡️ +0.00%
Branches	95.14%	95.10%	📉 -0.04%

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Upgrades the repository’s agentic workflow toolchain to gh-aw v0.82.2 (pre-release) and regenerates workflow lock files to reflect the new compiler/runtime behavior, with an accompanying test adjustment for the updated cache-key format.

Changes:

Updated gh-aw to v0.82.2 (pre-release) and regenerated workflow .lock.yml files.
Updated runner-doctor workflow cache keying to include CACHE_MEMORY_DATE and github.run_id (and adjusted restore key behavior accordingly).
Relaxed a unit test assertion for the new cache key format (but it should be made more specific again; see comments).

Show a summary per file

File	Description
scripts/ci/self-hosted-runner-doctor-updater-workflow.test.ts	Updates the lock-workflow assertion for the runner-doctor updater’s cache key format.
.github/workflows/test-coverage-reporter.lock.yml	Regenerated lock workflow; notably drops an explicit `shell: bash` on the coverage step.
.github/workflows/self-hosted-runner-doctor-updater.lock.yml	Regenerated lock workflow; cache key/restore-keys now incorporate `CACHE_MEMORY_DATE` (and key includes `run_id`).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 2
Review effort level: Low

      - id: coverage
        name: Run coverage
-        shell: bash
        run: "set +e\nset -o pipefail\nnpm run test:coverage 2>&1 | tee /tmp/coverage-full.log | tail -20\nCOVERAGE_EXIT=${PIPESTATUS[0]}\nif [ \"${COVERAGE_EXIT}\" -ne 0 ]; then\n  echo \"::warning::test:coverage exited with code ${COVERAGE_EXIT} (some tests may have failed); continuing with available coverage data\"\nfi\n# Continue even if tests fail — this is a reporter, not a gate\nexit 0\n"


    expect(lock).toContain('shared/self-hosted-failure-modes.md');
    expect(lock).toContain('Compute scan window');
-    expect(lock).toMatch(/memory-none-nopolicy-\$\{\{ env\.GH_AW_WORKFLOW_ID_SANITIZED \}\}-\n/);
+    expect(lock).toMatch(/memory-none-nopolicy-\$\{\{ env\.GH_AW_WORKFLOW_ID_SANITIZED \}\}-/);


github-actions · 2026-07-05T19:35:08Z

✅ Smoke Gemini completed. All facets verified. 💎

Smoke test check

github-actions · 2026-07-05T19:35:09Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-05T19:35:09Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-05T19:35:10Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-05T19:35:10Z

Chroot tests failed Smoke Chroot failed - See logs for details.

github-actions · 2026-07-05T19:35:11Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-05T19:35:11Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-05T19:35:12Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-05T19:35:12Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-05T19:35:13Z

✅ Contribution Check completed successfully!

PR #5932 follows the applicable CONTRIBUTING.md guidelines based on the provided metadata, diffs, and contributing guide; no review comment needed.

github-actions · 2026-07-05T19:35:14Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-05T19:35:17Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-05T19:35:20Z

✅ Smoke Claude passed

github-actions · 2026-07-05T19:35:34Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-05T19:39:35Z

Copilot BYOK Smoke Test Results

✅ GitHub.com Connectivity (HTTP 200)
✅ File Write/Read Operations
✅ BYOK Inference Path (api-proxy → api.githubcopilot.com)

Status: PASS — Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:39:42Z

Smoke Test: Claude Engine Validation

Overall Result: ✅ PASS

Check	Status
API	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #5932 · 55.6 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:39:56Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
github.com HTTP	✅ (200)
File write/read	⚠️ (template vars unexpanded in workflow)

Overall: PASS — core connectivity verified.

CC @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:40:31Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is not reachable from this runner.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:40:45Z

@lpcox

GitHub MCP Testing: ✅
GitHub.com Connectivity: ✅
File I/O Test: ✅
BYOK Inference Test: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:40:52Z

Gemini Engine Smoke Test Results

GitHub MCP Testing: ❌ (Tool mcpscripts missing)
GitHub.com Connectivity: ❌ (Network unreachable)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall Status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:40:55Z

MCP connectivity: ✅
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:41:21Z

PRs: refactor(api-proxy): extract shared Google API-key adapter factory for Gemini and Vertex
PRs: chore: update model-to-API mapping (2026-07-05)
GitHub MCP: ✅
Safe Inputs GH CLI: ❌
Playwright: ✅
File write/read: ✅
Discussion comment: ✅
Build: ✅
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:41:54Z

📡 OTel Tracing Smoke Test Results

Scenario	Status	Notes
S1: Module Loading	✅	`otel.js` loaded; `isEnabled: true`; exports 7 public functions (`startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`)
S2: Test Suite	✅	OTEL test files present (`otel.test.js`, `otel-fanout.test.js`); step ran successfully
S3: Env Var Forwarding	✅	5 OTEL env vars forwarded via `src/services/api-proxy-env-config.ts` (`GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`) + `OTEL_SERVICE_NAME`
S4: Token Tracker Integration	✅	`token-tracker-http.js` has `onUsage` callback (4 references — OTEL integration hook confirmed)
S5: OTEL Diagnostics	⏳	Post-step pending; no api-proxy spans exported in this run (no active api-proxy container during static validation)

Note on S3: Forwarding is implemented in api-proxy-env-config.ts, not api-proxy-service.ts directly. The workflow grep targets api-proxy-service.ts and emits a ⚠️ warning, but the implementation is correct.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:41:56Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #5932 · 40.8 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T19:45:54Z

🔬 Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	⚠️ pre-step outputs not substituted
File write/read	⚠️ pre-step outputs not substituted

Overall: PARTIAL — MCP ✅, pre-step template vars were not substituted in workflow

Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

Copilot AI review requested due to automatic review settings July 5, 2026 15:28

Copilot started reviewing on behalf of lpcox July 5, 2026 15:28 View session

Copilot AI reviewed Jul 5, 2026

View reviewed changes

lpcox added the ready-for-aw label Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 19:35 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 5, 2026

[aw] No-Op Runs #5883

Closed

github-actions Bot added the smoke-copilot-byok label Jul 5, 2026

github-actions Bot added the smoke-claude label Jul 5, 2026

github-actions Bot added the smoke-copilot label Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 19:40 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 5, 2026

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 19:41 — with GitHub Actions Inactive

github-actions Bot added the build-test label Jul 5, 2026

lpcox merged commit 35e9ba9 into main Jul 5, 2026
87 of 90 checks passed

lpcox deleted the upgrade-gh-aw-pre-release branch July 5, 2026 19:48

github-actions Bot mentioned this pull request Jul 6, 2026

[Test Coverage] coverage-gaps.test.ts #5941

Merged

Uh oh!

Conversation

lpcox commented Jul 5, 2026

Summary

Changes

Notes

Uh oh!

github-actions Bot commented Jul 5, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026

Copilot BYOK Smoke Test Results

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 5, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Gemini Engine Smoke Test Results

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

📡 OTel Tracing Smoke Test Results

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading