Integrate gh-aw-firewall v0.28.12 attested Cloud Hypervisor artifacts by Copilot · Pull Request #57514 · github/gh-aw

Copilot · 2026-08-31T21:23:52Z

Upgrade Cloud Hypervisor workflows to AWF v0.28.12’s attested release-artifact contract and KVM lifecycle fixes. Production workflows now supply an attested manifest, Sigstore bundle, and exact release tag instead of caller-provided artifact hashes.

Attested artifact setup
- Download manifest and Sigstore bundle alongside the guest archive.
- Validate release identity, artifact names, digest shape, and bundle structure.
- Export immutable manifest, bundle, and normalized release-tag outputs.

Production AWF contract

Replace five legacy SHA-256 flags with:

--cloud-hypervisor-artifact-manifest "$GH_AW_CLOUD_HYPERVISOR_ARTIFACT_MANIFEST"
--cloud-hypervisor-artifact-manifest-bundle "$GH_AW_CLOUD_HYPERVISOR_ARTIFACT_MANIFEST_BUNDLE"
--cloud-hypervisor-artifact-release-tag "$GH_AW_CLOUD_HYPERVISOR_ARTIFACT_RELEASE_TAG"

Do not emit the unattested-artifact development bypass.
Include v0.28.12 fixes for self-matching KVM process probes and device ACL lifetime.

Configuration and pins
- Add the cloudHypervisor AWF configuration model, including attestation, mount policy, resources, and development-only legacy fields.
- Use the explicit workspace-and-tool-cache mount policy.
- Refresh the embedded schema while retaining gh-aw-local schema extensions.
- Keep the Cloud Hypervisor minimum at v0.28.11 and bump the default AWF version to v0.28.12.
- Add v0.28.12 firewall image digest pins and regenerate workflow locks.
Regression coverage
- Assert generated Cloud Hypervisor commands include attestation inputs and exclude legacy hashes/bypasses.
- Reject Cloud Hypervisor pins below v0.28.11.

Fixes Integrate gh-aw-firewall v0.28.11 attested artifact contract atomically #57513

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 11.2 AIC · ⌖ 8.61 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Branch refresh requested by PR Sous Chef run https://github.com/github/gh-aw/actions/runs/33474625529

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.74 AIC · ⌖ 8.62 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Generated by PR Sous Chef run https://github.com/github/gh-aw/actions/runs/33494763462

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 27.2 AIC · ⌖ 8.72 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

gh-aw-bot · 2026-08-31T22:03:02Z

@copilot This PR is blocked and ready for the next step. Please run the pr-finisher skill, refresh the branch if needed, and continue driving it toward merge readiness.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 7.58 AIC · ⌖ 8.55 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot

🟡 Changes recommended

The latest version path is broken, and required negative tests and prerequisite documentation remain incomplete.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Upgrades AWF from v0.28.10 to v0.28.11 and adopts the attested Cloud Hypervisor artifact contract.

Changes:

Adds manifest and Sigstore bundle provisioning and AWF arguments.
Adds Cloud Hypervisor schema/configuration and v0.28.11 version gates.
Refreshes image pins, generated workflows, tests, and changeset.

File summaries

File	Description
`actions/setup/sh/cloud_hypervisor_setup_bundle.sh`	Provisions attested artifacts.
`pkg/workflow/awf_command_builder.go`	Emits attestation arguments.
`pkg/workflow/awf_config.go`	Models Cloud Hypervisor configuration.
`pkg/workflow/awf_config_build.go`	Generates runtime defaults.
`pkg/workflow/schemas/awf-config.schema.json`	Adds upstream schema fields.
`pkg/workflow/cloud_hypervisor_test.go`	Updates regression coverage.
`pkg/constants/version_constants.go`	Raises AWF version pins.
`pkg/workflow/data/action_pins.json`	Adds workflow image pins.
`pkg/actionpins/data/action_pins.json`	Adds action-pin records.
`.github/aw/actions-lock.json`	Refreshes locked image digests.
`.github/workflows/smoke-ci.lock.yml`	Regenerates Smoke CI.
`.github/workflows/notion-issue-summary.lock.yml`	Regenerates Notion workflow.
`.github/workflows/hippo-embed.lock.yml`	Regenerates Hippo workflow.
`.github/workflows/firewall.lock.yml`	Regenerates firewall workflow.
`.github/workflows/example-permissions-warning.lock.yml`	Regenerates permissions example.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Regenerates MCP test workflow.
`.changeset/bump-firewall-v0-28-11-attested-cloud-hypervisor.md`	Records the patch release.

Review details

Files reviewed: 21/308 changed files
Comments generated: 2
Review effort level: Balanced

gh-aw-bot · 2026-08-31T22:27:25Z

@copilot This PR is blocked and ready for the next step. Please refresh the branch if needed, review any unresolved feedback and failing checks, and then run the pr-finisher skill to continue driving it toward merge readiness.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 11.2 AIC · ⌖ 8.61 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

…isor Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lpcox · 2026-09-01T03:33:34Z

@copilot address review feedback and run the pr-finisher skill

…ypervisor setup Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-09-01T06:49:46Z

Category: chore | Risk: high | Score: 66/100 (impact 40/50, urgency 18/30, quality 8/20) | Action: batch_review | Batch: workflow-automation | Note: large workflow/dependency update with several successful checks, but the review thread requested follow-up changes.

Generated by 🔧 PR Triage Agent · copilot · mai10 · 15.5 AIC · ⌖ 2.7 AIC · ⊞ 16.2K · ◷

github-actions · 2026-09-01T09:00:15Z

✅ Great work on the firewall upgrade! This PR integrates gh-aw-firewall v0.28.12's attested Cloud Hypervisor artifact contract with comprehensive infrastructure updates.

What looks solid:

Clear focus on a single infrastructure objective
Excellent description covering attested artifact setup and regression coverage
Proper lock file regeneration across 308 workflows for consistency

This PR is ready for review and aligns well with the project's agentic development process.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 61 AIC · ⌖ 5.83 AIC · ⊞ 9.3K · ◷

gh-aw-bot · 2026-09-01T10:09:06Z

@copilot This PR appears blocked on review/approval rather than code changes. Please confirm there is no remaining implementation work, refresh the branch only if needed, and run the pr-finisher skill to summarize the current state for maintainers.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33494763462

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 27.2 AIC · ⌖ 8.72 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-01T10:13:47Z

@copilot This PR appears blocked on review/approval rather than code changes. Please confirm there is no remaining implementation work, refresh the branch only if needed, and run the pr-finisher ski...

Confirmed: no remaining implementation work. Branch is unchanged since the last pass (HEAD 7eb3f72), working tree is clean, CI on that commit is green, and both review threads are resolved. mergeable_state: blocked is solely due to the pending required-approval gate (no approving review yet), which requires maintainer action.

gh-aw-bot · 2026-09-01T12:03:49Z

@copilot This PR looks ready for a forward-progress pass. Please review the current status checks, refresh the branch if needed, and run the pr-finisher skill to move it toward merge readiness.

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 14.9 AIC · ⌖ 8.73 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-01T12:08:53Z

@copilot This PR looks ready for a forward-progress pass. Please review the current status checks, refresh the branch if needed, and run the pr-finisher skill to move it toward merge readiness.

G...

No change since the last pass: HEAD is still 7eb3f72, base is still current, working tree is clean, and CI on this commit remains green. mergeable_state: blocked is still solely due to the pending required-approval gate — no code action is available from this environment.

gh-aw-bot · 2026-09-01T12:58:07Z

@copilot This PR appears blocked on review/approval rather than code changes. Please confirm there is no remaining implementation work, refresh the branch only if needed, and run the pr-finisher skill to summarize the current state for maintainers.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33509763563

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.7 AIC · ⌖ 8.72 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

…aw-firewall-v02811 # Conflicts: # .github/workflows/smoke-service-ports.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-01T13:07:27Z

@copilot This PR appears blocked on review/approval rather than code changes. Please confirm there is no remaining implementation work, refresh the branch only if needed, and run the pr-finisher ski...

Merged latest main (10 new commits) in commit 102fec8 — this resolves the mergeable_state: dirty conflict that had appeared since the last pass. Only one file conflicted (smoke-service-ports.lock.yml, generated), regenerated via make recompile. Validated locally: go build, make fmt, targeted TestCloudHypervisor*/TestCompileEnclaveGitHubProxyLifecycle, and make test-impacted-go all pass. Both review threads remain resolved with substantive replies. CI on this new HEAD needs a maintainer re-trigger.

lpcox · 2026-09-01T13:51:12Z

@copilot fix failing ci checks https://github.com/github/gh-aw/actions/runs/33511514567/job/99881477190?pr=57514 https://github.com/github/gh-aw/actions/runs/33511514567/job/99881477207?pr=57514

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-01T14:02:05Z

@copilot fix failing ci checks https://github.com/github/gh-aw/actions/runs/33511514567/job/99881477190?pr=57514 https://github.com/github/gh-aw/actions/runs/33511514567/job/99881477207?pr=57514

Fixed in f1f1f18: both failures were caused by the main merge (102fec8) adding .github/aw/playwright.md without regenerating the two checked-in derived files that mirror that directory. Regenerated pkg/cli/data/agentic_workflows_fallback_aw_files.json and .github/skills/agentic-workflows/SKILL.md via the tests' own auto-update mechanism. Verified go build ./... and the full go test ./pkg/cli/... suite pass locally.

Initial plan

055c427

Copilot AI assigned Copilot and lpcox Aug 31, 2026

Copilot started work on behalf of lpcox August 31, 2026 21:24 View session

Copilot AI linked an issue Aug 31, 2026 that may be closed by this pull request

Integrate gh-aw-firewall v0.28.11 attested artifact contract atomically #57513

Closed

13 tasks

Integrate attested AWF Cloud Hypervisor artifacts

49972f5

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Integrate gh-aw-firewall v0.28.11 attested artifact contract~~ Integrate gh-aw-firewall v0.28.11 attested Cloud Hypervisor artifacts Aug 31, 2026

Copilot finished work on behalf of lpcox August 31, 2026 21:49

Copilot AI requested a review from lpcox August 31, 2026 21:49

lpcox marked this pull request as ready for review August 31, 2026 21:55

Copilot AI balanced review requested due to automatic review settings August 31, 2026 21:55

Copilot started reviewing on behalf of lpcox August 31, 2026 21:56 View session

github-actions Bot mentioned this pull request Aug 31, 2026

[pr-sous-chef] pr-sous-chef run report #57262

Closed

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread pkg/workflow/cloud_hypervisor_test.go

Comment thread pkg/constants/version_constants.go Outdated

Copilot started work on behalf of gh-aw-bot August 31, 2026 22:17 View session

Add negative fixture tests and host preflight checks for cloud-hyperv…

d072646

…isor Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 31, 2026 22:32

Copilot AI requested a review from gh-aw-bot August 31, 2026 22:32

Copilot started work on behalf of gh-aw-bot August 31, 2026 22:32 View session

Apply remaining changes

4920a78

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 31, 2026 22:42

lpcox marked this pull request as draft August 31, 2026 23:25

github-actions Bot mentioned this pull request Sep 1, 2026

[Outcome Report] Workflow Health — 2026-09-01 #57535

Open

Upgrade gh-aw-firewall to v0.28.12

ed1cec3

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lpcox changed the title ~~Integrate gh-aw-firewall v0.28.11 attested Cloud Hypervisor artifacts~~ Integrate gh-aw-firewall v0.28.12 attested Cloud Hypervisor artifacts Sep 1, 2026

Copilot started work on behalf of lpcox September 1, 2026 03:33 View session

Add executable test coverage for latest-version resolution in cloud-h…

d30fa96

…ypervisor setup Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions Bot added pr-action:batch_review pr-agent:copilot pr-batch:workflow-automation pr-priority:high pr-risk:high pr-type:chore labels Sep 1, 2026

github-actions Bot mentioned this pull request Sep 1, 2026

[PR Triage Report] PR triage report for Copilot-authored PRs #57633

Closed

Copilot started work on behalf of gh-aw-bot September 1, 2026 10:09 View session

Copilot finished work on behalf of gh-aw-bot September 1, 2026 10:14

Copilot started work on behalf of gh-aw-bot September 1, 2026 12:04 View session

Copilot finished work on behalf of gh-aw-bot September 1, 2026 12:09

github-actions Bot mentioned this pull request Sep 1, 2026

[pr-sous-chef] PR Sous Chef run report #57694

Open

Copilot started work on behalf of gh-aw-bot September 1, 2026 12:58 View session

Merge remote-tracking branch 'origin/main' into copilot/integrate-gh-…

102fec8

…aw-firewall-v02811 # Conflicts: # .github/workflows/smoke-service-ports.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 1, 2026 13:07

Copilot started work on behalf of lpcox September 1, 2026 13:51 View session

Sync embedded aw fallback list and SKILL.md after playwright.md merge

f1f1f18

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 1, 2026 14:03

lpcox merged commit 9a9eaa1 into main Sep 1, 2026
34 checks passed

lpcox deleted the copilot/integrate-gh-aw-firewall-v02811 branch September 1, 2026 14:38

Uh oh!

Conversation

Copilot AI commented Aug 31, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

gh-aw-bot commented Aug 31, 2026

Uh oh!

lpcox commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

gh-aw-bot commented Sep 1, 2026

Uh oh!

Copilot AI commented Sep 1, 2026

Uh oh!

gh-aw-bot commented Sep 1, 2026

Uh oh!

Copilot AI commented Sep 1, 2026

Uh oh!

gh-aw-bot commented Sep 1, 2026

Uh oh!

Copilot AI commented Sep 1, 2026

Uh oh!

lpcox commented Sep 1, 2026

Uh oh!

Copilot AI commented Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 31, 2026 •

edited by github-actions Bot

Loading