feat: update agentic workflows to v0.47.0 and add smoke-gemini by Copilot · Pull Request #974 · github/gh-aw-firewall

Copilot · 2026-02-19T21:37:56Z

Upgrade all agentic workflows from v0.43.x to v0.47.0 and add a Gemini CLI smoke test.

v0.47.0 strict mode fix

v0.47.0 introduces a new strict mode validation that rejects secrets in the top-level env: section. All 8 build-test-*.md workflows were migrated:

# Before (rejected by v0.47.0 strict mode)
tools:
  github:
env:
  GH_TOKEN: "${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}"

# After
tools:
  github:
    github-token: "${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}"

Workflow upgrade

gh aw upgrade applied codemods (migrated deprecated roles: → on.roles in 14 workflows), updated action pins to v0.47.0, and recompiled all 29 lock files
Post-processing applied via postprocess-smoke-workflows.ts (local builds, --build-local, sparse-checkout removal)

New smoke-gemini workflow

smoke-gemini.md — mirrors smoke-codex.md structure with engine: gemini
Same test suite: GitHub MCP, Playwright, Tavily, file I/O, bash, discussion interaction, AWF build
Added to postprocess-smoke-workflows.ts for CI transformations

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/actions/checkout/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/releases --jq .[].tag_name (http block)
https://api.github.com/repos/actions/github-script/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/releases --jq .[].tag_name (http block)
https://api.github.com/repos/actions/setup-node/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/releases --jq .[].tag_name (http block)
https://api.github.com/repos/actions/upload-artifact/releases
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/releases --jq .[].tag_name (http block)
https://api.github.com/repos/docker/build-push-action/releases
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/releases --jq .[].tag_name (http block)
https://api.github.com/repos/docker/login-action/releases
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/releases --jq .[].tag_name (http block)
https://api.github.com/repos/docker/setup-buildx-action/releases
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/releases --jq .[].tag_name (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.0 --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw/releases
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/releases --jq .[].tag_name (http block)
https://api.github.com/repos/github/gh-aw/releases/latest
- Triggering command: /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw /home/REDACTED/.local/share/gh/extensions/gh-aw/gh-aw upgrade (http block)
https://api.github.com/repos/softprops/action-gh-release/releases
- Triggering command: /usr/bin/gh gh api /repos/softprops/action-gh-release/releases --jq .[].tag_name (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

github-actions · 2026-02-19T21:58:56Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.30%	82.45%	📈 +0.15%
Statements	82.23%	82.37%	📈 +0.14%
Functions	82.74%	82.74%	➡️ +0.00%
Branches	74.46%	74.55%	📈 +0.09%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	83.2% → 83.8% (+0.55%)	82.5% → 83.0% (+0.54%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Updates this repository’s GitHub Agentic Workflows (gh-aw) to v0.47.0, applies the v0.47.0 strict-mode secret handling changes, and adds a new Gemini engine smoke test workflow.

Changes:

Upgraded agentic workflow sources and regenerated lock files for gh-aw v0.47.0 (including newer prompt/safe-output plumbing).
Migrated build-test workflows off top-level env: GH_TOKEN secrets to tools.github.github-token.
Added smoke-gemini workflow and wired its lock file into the post-processing script.

Reviewed changes

Copilot reviewed 29 out of 47 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`scripts/ci/postprocess-smoke-workflows.ts`	Adds `smoke-gemini.lock.yml` to the set of lock files that get CI post-processing transforms.
`.github/workflows/smoke-gemini.md`	New Gemini engine smoke workflow definition (source).
`.github/workflows/smoke-copilot.md`	Moves deprecated `roles:` to `on.roles` and fixes trailing indentation/formatting.
`.github/workflows/smoke-codex.md`	Moves deprecated `roles:` to `on.roles` and fixes trailing indentation/formatting.
`.github/workflows/smoke-codex.lock.yml`	Regenerated lock file for v0.47.0; includes new prompt generation steps and runtime config changes.
`.github/workflows/smoke-claude.md`	Moves deprecated `roles:` to `on.roles` and fixes trailing indentation/formatting.
`.github/workflows/smoke-claude.lock.yml`	Regenerated lock file for v0.47.0; includes new prompt generation steps and runtime config changes.
`.github/workflows/smoke-chroot.md`	Moves deprecated `roles:` to `on.roles` and fixes trailing indentation/formatting.
`.github/workflows/security-guard.md`	Moves deprecated `roles:` to `on.roles` and fixes trailing indentation/formatting.
`.github/workflows/plan.md`	Updates comment-content templating expression to align with v0.47.0 compilation output.
`.github/workflows/cli-flag-consistency-checker.lock.yml`	Regenerated lock file for v0.47.0; includes updated engine/runtime plumbing.
`.github/workflows/ci-cd-gaps-assessment.lock.yml`	Regenerated lock file for v0.47.0; includes updated engine/runtime plumbing.
`.github/workflows/build-test-rust.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-rust.lock.yml`	Regenerated lock file for v0.47.0; incorporates strict-mode changes and new compiled structure.
`.github/workflows/build-test-node.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-java.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-go.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-dotnet.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-deno.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-cpp.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/build-test-bun.md`	Strict-mode secret migration to `tools.github.github-token` and `on.roles` migration.
`.github/workflows/agentics-maintenance.yml`	Regenerated maintenance workflow for v0.47.0 action pins/structure.
`.github/agents/agentic-workflows.agent.md`	Updates the custom agent file metadata and linked gh-aw docs to v0.47.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-19T22:02:51Z

.github/workflows/smoke-gemini.md

+on: 
+  schedule: every 12h
+  workflow_dispatch:
+  pull_request:
+    types: [opened, synchronize, reopened]


on.roles: all is missing from this workflow, while the other smoke workflows include it. Without it, the workflow will fall back to the default role allowlist, which may unintentionally prevent PR triggers (especially for contributors with only read access). Add roles: all under the on: block to match the other smoke workflows.

Copilot · 2026-02-19T22:02:52Z

.github/agents/agentic-workflows.agent.md

@@ -1,6 +1,6 @@
 ---
 description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing


The frontmatter field disable-model-invocation is not used anywhere else in this repo, so it’s unclear it will be recognized by the custom agent spec loader. Previously this file used infer: false (which is used throughout the repo’s gh-aw prompt files), so this change may be a no-op and could re-enable behavior you intended to disable. Consider reverting to infer: false (or keeping both keys) unless you can confirm disable-model-invocation is a supported field for .github/agents/*.md files.

Suggested change

description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

infer: false

Copilot · 2026-02-19T22:02:52Z

.github/workflows/smoke-codex.lock.yml

      - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@1c80b7ec8f557e1304e764069803d66a0092cebc # v0.43.20
+        uses: github/gh-aw/actions/setup@v0.47.0
        with:
          destination: /opt/gh-aw/actions


github/gh-aw/actions/setup is now referenced by a mutable tag (@v0.47.0) rather than a commit SHA. Tags can be retagged, which weakens supply-chain guarantees and may violate strict-mode expectations around action pinning. Prefer pinning this action to an immutable commit SHA (and keep the version comment if helpful).

Copilot · 2026-02-19T22:02:52Z

.github/workflows/smoke-codex.lock.yml

            "--network",
            "host",
+            "--security-opt",
+            "seccomp=unconfined",
+            "--ipc=host",


The Playwright MCP container is started with --security-opt seccomp=unconfined and --ipc=host, which significantly increases container privileges and expands the security boundary (especially relevant in this repo). If these flags are required for Playwright/Chromium stability, add an inline comment explaining why; otherwise, prefer a more restrictive configuration (e.g., avoid seccomp=unconfined).

Copilot · 2026-02-19T22:02:52Z

.github/workflows/smoke-claude.lock.yml

                  "--init",
                  "--network",
-                  "host"
+                  "host",
+                  "--security-opt",
+                  "seccomp=unconfined",
+                  "--ipc=host"
                ],


The Playwright MCP container is started with --security-opt seccomp=unconfined and --ipc=host, which significantly increases container privileges and expands the security boundary. If these flags are required for Playwright/Chromium stability, add an inline comment explaining why; otherwise, prefer a more restrictive configuration (e.g., avoid seccomp=unconfined).

Initial plan

107adc5

Copilot AI assigned Copilot and Mossaka Feb 19, 2026

Copilot started work on behalf of Mossaka February 19, 2026 21:38 View session

feat: update agentic workflows to v0.47.0 and add smoke-gemini workflow

cc616ec

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update agentic workflows to version 0.47.0 and regenerate~~ feat: update agentic workflows to v0.47.0 and add smoke-gemini Feb 19, 2026

Copilot AI requested a review from Mossaka February 19, 2026 21:49

Copilot finished work on behalf of Mossaka February 19, 2026 21:49

Mossaka marked this pull request as ready for review February 19, 2026 21:58

Copilot AI review requested due to automatic review settings February 19, 2026 21:58

Copilot started reviewing on behalf of Mossaka February 19, 2026 21:58 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

Mossaka merged commit 678c2fe into main Feb 19, 2026
91 of 104 checks passed

Mossaka deleted the copilot/update-agentic-workflows-v0-47-0 branch February 19, 2026 22:11

Mossaka mentioned this pull request Feb 19, 2026

fix: Gemini engine passes unsupported --mcp-config flag to Gemini CLI github/gh-aw#16933

Closed

Copilot AI mentioned this pull request Feb 19, 2026

fix: Gemini engine uses .gemini/settings.json instead of unsupported --mcp-config flag github/gh-aw#16938

Merged

This was referenced Feb 19, 2026

fix: add iptables bypass for container self-traffic #977

Merged

chore: remove _codeql_detected_source_root #975

Merged

fix: set JAVA_TOOL_OPTIONS and generate Maven settings.xml for JVM proxy #963

Open

docs: add releasing.md link to CLAUDE.md #981

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat: update agentic workflows to v0.47.0 and add smoke-gemini#974

feat: update agentic workflows to v0.47.0 and add smoke-gemini#974
Mossaka merged 2 commits intomainfrom
copilot/update-agentic-workflows-v0-47-0

Copilot AI commented Feb 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -1,6 +1,6 @@
		---
		description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

	description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing
	description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing
	infer: false

Comments

Conversation

Copilot AI commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.47.0 strict mode fix

Workflow upgrade

New smoke-gemini workflow

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Feb 19, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 19, 2026 •

edited

Loading