Upgrade workflows to gh-aw v0.91.5 pre-release

[lpcox]

Summary

Upgrades the gh-aw extension from v0.91.4 to the latest pre-release, v0.91.5, and recompiles all 34 agentic workflows.

Changes

• Ran gh aw upgrade --pre-releases
• Updated github/gh-aw-actions/setup-cli and github/gh-aw-actions/setup to v0.91.5
• Updated actions/setup-node to v7.1.0
• Updated gh-aw firewall container image pins to 0.28.44
• Recompiled every workflow lock file with gh aw compile

Validation

• gh aw compile: 34 workflows compiled successfully
• make agent-finished: all formatting, build, lint, Go tests, and Rust guard tests passed

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned (issues, PRs, README.md, commits)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 tools absent from catalog (Error -32602: unknown tool)	BLOCKED	⚠️
C	CLI	reads	data returned via github CLI proxy	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated — not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• No write leaked through any surface.
• Part B: all 6 targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the gh-aw tools.github: catalog entirely (backend launched with GITHUB_READ_ONLY=1). This confirms the gh-aw framework's defense-in-depth, but structurally cannot exercise mcpg's own independent DIFC/guard write-blocking layer, since the call never reaches a write-capable backend tool.
• Part D/E: gh auth status showed no authenticated GitHub host in this run, so the REST/GraphQL write-vs-token-scope boundary could not be independently exercised.
• Independent confirmation of mcpg's own write-blocking layer is covered separately by internal/guard/internal/difc unit tests, not by this probe.

References:

• https://github.com/github/gh-aw-mcpg/actions/runs/37788267391

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

🔵 Needs a closer look

The pre-release sandbox and privileged-output runtime upgrades warrant maintainer review and end-to-end Actions validation beyond the reported compilation and application tests.

0 open findings

What changed in this PR

Upgrades the repository’s agentic workflow infrastructure to gh-aw v0.91.5 pre-release without changing gateway application code.

Changes:

• Updates gh-aw action pins, setup-node, and default firewall images.
• Regenerates workflows with model-routing artifacts and job-result reporting.
• Adds token context for safe-output mention handling.

File	Description
.github/​workflows/​nightly-workflow-compiler.lock.yml	Updates runtime pins and generated reporting.
.github/​workflows/​nightly-schema-updater.lock.yml	Updates gh-aw and reporting; retains explicit firewall pins.
.github/​workflows/​integrity-filtering-audit.lock.yml	Refreshes audit workflow runtime and telemetry.
.github/​workflows/​ghcr-download-tracker.lock.yml	Refreshes tracker runtime and telemetry.
.github/​workflows/​gateway-issue-dispatcher.lock.yml	Updates dispatcher runtime and output context.
.github/​workflows/​duplicate-code-detector.lock.yml	Updates detector runtime and reporting.
.github/​workflows/​agentics-maintenance.yml	Upgrades maintenance setup actions and CLI.
.github/​aw/​actions-lock.json	Records updated action and firewall image pins.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.