fix: recompile agentic workflows with gh-aw v0.68.1#70
Merged
Conversation
The 'Course Updater' agentic workflow was failing because both the 'github' and 'safeoutputs' MCP servers were blocked by a Copilot CLI policy change. The old lock file (compiled with gh-aw v0.64.4) used 'latest' for the Copilot CLI version, which pulled a newer CLI that introduced MCP policy enforcement breaking the MCP server connections. Key changes from recompilation: - Pin Copilot CLI to v1.0.21 (instead of floating 'latest') - Upgrade AWF firewall from v0.25.4 to v0.25.18 - Upgrade MCP Gateway from v0.2.9 to v0.2.17 - Update gh-aw-actions to v0.68.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Same MCP policy fix as course-updater - pin Copilot CLI version and upgrade firewall/gateway components to prevent MCP server blocking. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR recompiles the repository’s agentic GitHub Actions workflows using gh-aw v0.68.1 to avoid recent Copilot CLI MCP policy enforcement issues by pinning the Copilot CLI version and updating the supporting agentic workflow components.
Changes:
- Recompiled
course-updaterandtraffic-updaterlock workflows withgh-aw v0.68.1, pinning Copilot CLI to1.0.21. - Upgraded the AWF firewall and MCP Gateway versions used by the workflows.
- Updated the action lock file to include the new
gh-aw-actions/setuppin andactions/github-script@v9.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/traffic-updater.lock.yml | Recompiled workflow lock to gh-aw v0.68.1, pins Copilot CLI version, upgrades AWF/MCPG, and updates supporting steps. |
| .github/workflows/course-updater.lock.yml | Recompiled workflow lock to gh-aw v0.68.1, pins Copilot CLI version, upgrades AWF/MCPG, and updates supporting steps. |
| .github/aw/actions-lock.json | Updates action pin entries for the new gh-aw setup action and adds actions/github-script@v9. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 3
Comment on lines
100
to
+106
| GH_AW_INFO_FIREWALL_TYPE: "squid" | ||
| GH_AW_COMPILED_STRICT: "true" | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| setupGlobals(core, github, context, exec, io, getOctokit); |
Comment on lines
100
to
+106
| GH_AW_INFO_FIREWALL_TYPE: "squid" | ||
| GH_AW_COMPILED_STRICT: "true" | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| setupGlobals(core, github, context, exec, io, getOctokit); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Course Updater agentic workflow (run #24306045851) completed successfully but failed to create a PR because both the
githubandsafeoutputsMCP servers were blocked by policy:Root Cause
The lock files were compiled with
gh-aw v0.64.4, which usedlatestfor the Copilot CLI version. Between April 3–11, the Copilot CLI introduced MCP policy enforcement that blocked MCP servers in the sandbox environment.Fix
Recompiled both workflows with
gh-aw v0.68.1, which:latestSecurity Review
The
github/gh-aw-actions/setupaction SHA was updated from7cae8cd(v0.64.4) to2fe53ac(v0.68.1). This is the official gh-aw setup action maintained by GitHub — safe to use.Affected Workflows
course-updatertraffic-updater