Bump default AWF and MCP Gateway versions to v0.27.42 / v0.4.6 and refresh pinned artifacts

[Copilot]

This updates gh-aw’s default pinned runtime versions to the latest AWF and MCP Gateway releases and regenerates pinned workflow artifacts to match those defaults.

• Version pins

  • Updated /pkg/constants/version_constants.go:
    • DefaultFirewallVersion: v0.27.41 → v0.27.42
    • DefaultMCPGatewayVersion: v0.4.5 → v0.4.6

• Container digest pin set

  • Added container pin entries for the new default tags in /.github/aw/actions-lock.json:
    • ghcr.io/github/gh-aw-firewall/{agent,agent-act,api-proxy,cli-proxy,squid}:0.27.42
    • ghcr.io/github/gh-aw-mcpg:v0.4.6
  • Synced generated pin tables:
    • /pkg/actionpins/data/action_pins.json
    • /pkg/workflow/data/action_pins.json

• Recompiled generated workflow locks

  • Regenerated .github/workflows/*.lock.yml so compiled outputs use the updated defaults and refreshed digest pins.

• Changeset

  • Added /.changeset/patch-bump-awf-v0-27-42-mcpg-v0-4-6.md.

// pkg/constants/version_constants.go
const DefaultFirewallVersion Version = "v0.27.42"
const DefaultMCPGatewayVersion Version = "v0.4.6"

• Fixes Bump firewall to v0.27.42 and mcpg to v0.4.6 #48234

---

Run: https://github.com/github/gh-aw/actions/runs/30233154470

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 7.3 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

---

---

✨ PR Review Safe Output Test - Run 30236132659

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 68.1 AIC · ⌖ 20.2 AIC · ⊞ 6.1K · ◷
_{Comment /smoke-claude to run again}

[github-actions]

🤖 PR Triage

Field	Value
Category	chore
Risk	🟢 low
Priority Score	32 / 100
Score Breakdown	Impact: 15 · Urgency: 7 · Quality: 10
Recommended Action	⏸ defer (DRAFT)

Summary: Version bump for default AWF (v0.27.41 → v0.27.42) and MCP Gateway (v0.4.5 → v0.4.6) with pinned artifact refresh. Draft, no reviews, no CI data yet. Routine maintenance chore.

Next action: Defer — author undraft when ready; low-risk merge once CI passes.

Generated by 🔧 PR Triage Agent · sonnet46 · 49 AIC · ⌖ 8.25 AIC · ⊞ 5.7K · ◷

[Copilot]

Pull request overview

Bumps default AWF/MCP Gateway versions and refreshes corresponding generated artifacts. Review found that AWF v0.27.42’s runtime schema still rejects apiProxy.providers, which this bump enables.

Changes:

• Updated runtime version defaults.
• Added synchronized container digest pins.
• Recompiled workflow locks and added a patch changeset.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates default versions.
.github/aw/actions-lock.json	Adds new image pins.
pkg/actionpins/data/action_pins.json	Syncs embedded pins.
pkg/workflow/data/action_pins.json	Syncs workflow pins.
.github/workflows/smoke-ci.lock.yml	Refreshes generated runtime pins.
.github/workflows/release.lock.yml	Refreshes generated runtime pins.
.github/workflows/firewall.lock.yml	Refreshes generated runtime pins.
.github/workflows/example-permissions-warning.lock.yml	Refreshes generated runtime pins.
.github/workflows/daily-max-ai-credits-test.lock.yml	Refreshes generated runtime pins.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Refreshes generated runtime pins.
.github/workflows/ai-moderator.lock.yml	Refreshes generated runtime pins.
.changeset/patch-bump-awf-v0-27-42-mcpg-v0-4-6.md	Records the patch release change.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 23/267 changed files
• Comments generated: 1
• Review effort level: Medium

[Copilot]

Addressed in commits b4363ec and e4d45be:

1. Bumped AWFAPIProxyProvidersMinVersion to v0.27.43 so awfSupportsAPIProxyProviders returns false for the default v0.27.42 — apiProxy.providers is no longer emitted
2. Recompiled the two affected lock files (daily-model-inventory, smoke-copilot) to remove the previously emitted apiProxy.providers field

[lpcox]

@copilot address review feedback

[gh-aw-bot]

@copilot please run the pr-finisher skill, update the branch if GitHub allows it, and move this PR toward merge readiness.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 7.3 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot address review feedback

Fixed in commit fix: bump AWFAPIProxyProvidersMinVersion to v0.27.43. AWFAPIProxyProvidersMinVersion is now v0.27.43, so awfSupportsAPIProxyProviders returns false for the default v0.27.42 — keeping apiProxy.providers gated off until a future AWF release that actually ships the schema support. Updated the TestAWFSupportsAPIProxyProviders tests accordingly (v0.27.42 is now a must-fail case, v0.27.43 is the new minimum-passing case).

[Copilot]

@copilot run the pr-finisher skill

PR finisher complete. Here's the state:

• ✅ Reviews — The one unresolved thread (apiProxy.providers gating) was addressed in b4363ec/5df3fd3 and the reply is on record. Additionally found and fixed wasm golden files that were out of sync with the version bump (commit cc278ce).
• ✅ Checks (local) — make fmt, make lint, make test-unit (full suite) all pass. Two pre-existing CLI test failures (TestCheckedInAgenticWorkflowsSkillMatchesGeneratedContent, TestFallbackAWFilesMatchesLocalAWDirectory) fail on the base branch too and are unrelated to this PR.
• ❓ Checks (CI) — Stale after agent push; needs human re-trigger. Prior CI runs were in-progress when checked.
• ✅ Mergeable — PR is open, not draft.

Actions taken: Regenerated wasm golden files (pkg/workflow/testdata/) to match container.imageTag: 0.27.42; no apiProxy.providers field is emitted, confirming the gate is working correctly.

Hand-off: CI must be re-triggered by a maintainer (close/reopen PR or push) before merge.

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Done. Merged main into the branch and recompiled all 263 workflow lock files (0 errors). make fmt, make lint, and make test-unit all pass.

[github-actions]

🤖 PR Triage

Field	Value
Category	chore
Risk	🟡 medium
Priority Score	52 / 100
Recommended Action	📦 batch_review
CI Status	⚪ unknown (no check runs found)
Batch	version-bump-batch

Score breakdown: Impact 22/50 · Urgency 14/30 · Quality 16/20

Rationale: Routine version bump (AWF v0.27.42, MCP Gateway v0.4.6) with regenerated pinned artifacts. Large diff (5948+/5846−, 278 files) but mostly auto-generated artifacts. Smoke test results mixed (partly failing). No CI check runs found — needs CI to run before merging. Can be reviewed together with similar future version bumps.

Run §30246015734

Generated by 🔧 PR Triage Agent · sonnet46 · 36.5 AIC · ⌖ 5.31 AIC · ⊞ 5.7K · ◷

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Done. Merged main (resolved conflicts in generated lock files and wasm goldens), recompiled all 263 workflows (0 errors), regenerated wasm golden files, and validated with make fmt, make lint, and full make test-unit — all pass.