Upgrade workflows to gh-aw v0.87.10 by lpcox · Pull Request #7885 · github/gh-aw-firewall

lpcox · 2026-08-31T12:07:57Z

Summary

Upgrades the gh-aw extension from v0.87.9 to the latest pre-release, v0.87.10.
Recompiles all 66 agentic workflows and refreshes action/container pins.
Runs the repository workflow post-processor over regenerated lock files.
Preserves the enclave gateway API key for AWF readiness while excluding it from the primary agent.
Updates the enclave smoke test for gh-aw-mcpg v0.4.14.

Testing

npm test -- --runInBand (329 suites, 5,274 tests passed)
Commit hooks: ESLint and TypeScript build passed

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Both enclave smoke workflows lack a valid legacy gateway key mapping after the v0.87.10 authentication migration.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	`scripts/ci/apply-general-workflow-patches.ts` — gh-aw v0.87.10 emits `gateway-agent-id`, not `gateway-api-key`. This block therefore excludes a…
	`.github/workflows/smoke-enclave-issues-read.lock.yml` — After the v0.87.10 authentication migration, this enclave workflow gives the host AWF process…

What changed in this PR

Upgrades all agentic workflows to gh-aw v0.87.10 and updates gateway authentication and dependency pins.

Changes:

Recompiles 66 workflow locks with refreshed action/container pins.
Migrates MCP gateway authentication to agent IDs.
Updates enclave post-processing and regression tests.

File	Description
`.github/aw/actions-lock.json`	Adds v0.87.10 action and container pins.
`scripts/ci/apply-general-workflow-patches.ts`	Adapts enclave environment filtering.
`scripts/ci/smoke-enclave-workflow.test.ts`	Updates enclave post-processing assertions.
`.github/workflows/auth-doctor-updater.lock.yml`	Recompiled workflow.
`.github/workflows/build-test-network-isolation.lock.yml`	Recompiled workflow.
`.github/workflows/build-test.lock.yml`	Recompiled workflow.
`.github/workflows/ci-cd-gaps-assessment.lock.yml`	Recompiled workflow.
`.github/workflows/ci-doctor.lock.yml`	Recompiled workflow.
`.github/workflows/claude-token-optimizer.lock.yml`	Recompiled workflow.
`.github/workflows/claude-token-usage-analyzer.lock.yml`	Recompiled workflow.
`.github/workflows/cli-flag-consistency-checker.lock.yml`	Recompiled workflow.
`.github/workflows/config-consistency-auditor.lock.yml`	Recompiled workflow.
`.github/workflows/contribution-check.lock.yml`	Refreshes compiler, AWF, and gateway pins.
`.github/workflows/copilot-token-optimizer.lock.yml`	Recompiled workflow.
`.github/workflows/copilot-token-usage-analyzer.lock.yml`	Recompiled workflow.
`.github/workflows/dependency-security-monitor.lock.yml`	Recompiled workflow.
`.github/workflows/doc-maintainer.lock.yml`	Recompiled workflow.
`.github/workflows/duplicate-code-detector.lock.yml`	Recompiled workflow.
`.github/workflows/export-audit.lock.yml`	Recompiled workflow.
`.github/workflows/firewall-issue-dispatcher.lock.yml`	Recompiled workflow.
`.github/workflows/issue-duplication-detector.lock.yml`	Recompiled workflow.
`.github/workflows/issue-monster.lock.yml`	Recompiled workflow.
`.github/workflows/model-api-mapping-updater.lock.yml`	Recompiled workflow.
`.github/workflows/network-isolation-test.lock.yml`	Recompiled workflow.
`.github/workflows/pelis-agent-factory-advisor.lock.yml`	Recompiled workflow.
`.github/workflows/plan.lock.yml`	Recompiled workflow.
`.github/workflows/red-team-benchmark.lock.yml`	Recompiled workflow.
`.github/workflows/refactoring-scanner.lock.yml`	Recompiled workflow.
`.github/workflows/sbx-gvisor-doc-updater.lock.yml`	Recompiled workflow.
`.github/workflows/sbx-rollout-monitor.lock.yml`	Recompiled workflow.
`.github/workflows/schema-sync.lock.yml`	Recompiled workflow.
`.github/workflows/secret-digger-claude.lock.yml`	Recompiled workflow.
`.github/workflows/secret-digger-codex.lock.yml`	Recompiled workflow.
`.github/workflows/secret-digger-copilot.lock.yml`	Recompiled workflow.
`.github/workflows/security-guard.lock.yml`	Recompiled workflow.
`.github/workflows/security-review.lock.yml`	Recompiled workflow.
`.github/workflows/self-hosted-runner-doctor-updater.lock.yml`	Recompiled workflow.
`.github/workflows/self-hosted-runner-doctor.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-chroot.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-claude.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-cloud-hypervisor-build-test.lock.yml`	Updates Cloud Hypervisor smoke pins and gateway auth.
`.github/workflows/smoke-cloud-hypervisor-claude.lock.yml`	Updates Claude Cloud Hypervisor smoke workflow.
`.github/workflows/smoke-cloud-hypervisor-codex.lock.yml`	Updates Codex Cloud Hypervisor smoke workflow.
`.github/workflows/smoke-cloud-hypervisor.lock.yml`	Updates Copilot Cloud Hypervisor smoke workflow.
`.github/workflows/smoke-codex.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-copilot-byok-aoai-apikey.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-copilot-byok-aoai-entra.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-copilot-byok.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-copilot-network-isolation.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-copilot.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-docker-sbx-build-test.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-docker-sbx-claude.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-docker-sbx-codex.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-docker-sbx.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-enclave-build-test.lock.yml`	Updates mcpg and enclave gateway handling.
`.github/workflows/smoke-enclave-issues-read.lock.yml`	Migrates enclave gateway authentication.
`.github/workflows/smoke-gemini.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-gvisor-build-test.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-gvisor-claude.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-gvisor-codex.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-gvisor.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-otel-tracing.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-services.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-sink-visibility-allowed.lock.yml`	Recompiled workflow.
`.github/workflows/smoke-sink-visibility-blocked.lock.yml`	Recompiled workflow.
`.github/workflows/test-coverage-improver.lock.yml`	Recompiled workflow.
`.github/workflows/test-coverage-reporter.lock.yml`	Recompiled workflow.
`.github/workflows/test-hard-cap-ai-credits.lock.yml`	Recompiled workflow.
`.github/workflows/update-release-notes.lock.yml`	Recompiled workflow.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@@ -126,6 +126,20 @@ export function applyGeneralWorkflowPatches(
      );
      log.push(`  Exposed gateway API key to AWF readiness checks`);
    }
+
+    const gatewayKeyExclusion = '--exclude-env MCP_GATEWAY_API_KEY';


@@ -933,7 +933,7 @@ jobs:
          GH_AW_AWF_LOG_FILE=/tmp/gh-aw/agent-stdio.log \
          GH_AW_AWF_ATTEMPT_LOG_NAME=copilot \
          bash "${RUNNER_TEMP}/gh-aw/actions/run_awf_with_startup_retries.sh" -- \
-            awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env AWF_ENCLAVE_GITHUB_PROXY_CA_CERT --exclude-env AWF_ENCLAVE_GITHUB_PROXY_CONTAINER --exclude-env AWF_ENCLAVE_GITHUB_PROXY_IDENTITY --exclude-env AWF_ENCLAVE_MCP_CAPABILITY --exclude-env AWF_ENCLAVE_MCP_GATEWAY_CONTAINER --exclude-env AWF_ENCLAVE_MCP_GATEWAY_ENDPOINT --exclude-env AWF_ENCLAVE_MCP_GATEWAY_IDENTITY --exclude-env AWF_ENCLAVE_MCP_READINESS_TIMEOUT_MS --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env MCP_GATEWAY_ENCLAVE_CAPABILITY_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --build-local \
+            awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env AWF_ENCLAVE_GITHUB_PROXY_CA_CERT --exclude-env AWF_ENCLAVE_GITHUB_PROXY_CONTAINER --exclude-env AWF_ENCLAVE_GITHUB_PROXY_IDENTITY --exclude-env AWF_ENCLAVE_MCP_CAPABILITY --exclude-env AWF_ENCLAVE_MCP_GATEWAY_CONTAINER --exclude-env AWF_ENCLAVE_MCP_GATEWAY_ENDPOINT --exclude-env AWF_ENCLAVE_MCP_GATEWAY_IDENTITY --exclude-env AWF_ENCLAVE_MCP_READINESS_TIMEOUT_MS --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_AGENT_ID --exclude-env MCP_GATEWAY_ENCLAVE_CAPABILITY_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --build-local \


github-actions · 2026-08-31T12:12:50Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.86%	93.88%	📈 +0.02%
Statements	92.67%	92.69%	📈 +0.02%
Functions	93.24%	93.24%	➡️ +0.00%
Branches	86.14%	86.16%	📈 +0.02%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

chore: upgrade gh-aw workflows

7cac0d6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings August 31, 2026 12:07

Copilot started reviewing on behalf of lpcox August 31, 2026 12:08 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

This was referenced Aug 31, 2026

Extract shared tokenAuthHeaders helper to deduplicate auth-prefix header assembly in copilot.js #7875

Merged

fix: stabilize post-merge KVM checks #7922

Merged

lpcox merged commit 9dc9cf1 into main Aug 31, 2026
24 of 25 checks passed

lpcox deleted the lpcox-upgrade-firewall-aws branch August 31, 2026 20:39

github-actions Bot mentioned this pull request Aug 31, 2026

fix(ci): match staged KVM processes #7929

Merged

Navigation Menu

Uh oh!

Upgrade workflows to gh-aw v0.87.10 - #7885

Upgrade workflows to gh-aw v0.87.10#7885
lpcox merged 1 commit into
mainfrom
lpcox-upgrade-firewall-aws

lpcox commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

lpcox commented Aug 31, 2026

Summary

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

github-actions Bot commented Aug 31, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants