Upgrade workflows to gh-aw v0.87.9 pre-release

[lpcox]

Summary

Upgrades the repository's agentic workflow support to the latest gh-aw pre-release, v0.87.9.

Changes

• Ran gh aw upgrade --pre-releases
• Updated github/gh-aw-actions setup actions from v0.87.4 to v0.87.9
• Refreshed CodeQL, setup-java, and SBOM action pins
• Updated MCP Gateway, GitHub MCP Server, and gh-aw firewall container pins
• Refreshed the agentic-workflows dispatcher skill with intent and skill/plugin guidance
• Recompiled all 36 workflows

Validation

• gh aw compile — all 36 workflows compiled successfully
• make agent-finished — formatting, build, lint, Go tests, integration tests, and 648 Rust guard tests passed

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from 23-tool catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps:

• Part B: The GitHub MCP backend is launched with GITHUB_READ_ONLY=1, so all 7 write tool targets were absent from the 23-tool catalog. No write tool reached the gateway enforcement layer. This confirms the backend defense-in-depth but cannot confirm mcpg's own DIFC/guard blocking independently.
• Parts D & E: gh CLI is unauthenticated in this environment (no GH_TOKEN). All REST and GraphQL write attempts returned "set GH_TOKEN" errors — these are pre-auth failures, not evidence of gateway enforcement.

No writes leaked. Zero FAIL results.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	file returned (SHA: 8cf8b518)	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 write tools ABSENT from 23-tool catalog (GITHUB_READ_ONLY=1)	BLOCKED	⚠️
C	CLI	list_issues	data returned	ALLOWED	✅
C	CLI	get_file_contents	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — GH_TOKEN not set	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — GH_TOKEN not set	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps (no write leaked — not a FAIL):

• Part B: All 7 targeted write tools are absent from the MCP tool catalog. The backend runs with GITHUB_READ_ONLY=1, which prevents write tool registration. This confirms gh-aw's defense-in-depth layer but does not independently confirm mcpg's own DIFC/guard enforcement layer (write calls never reach a write-capable backend). Structural gap — tracked as follow-up.
• Parts D/E: gh CLI is not authenticated in this workflow (GH_TOKEN not set). All REST/GraphQL write attempts were rejected at the CLI level with "set the GH_TOKEN environment variable", not by the gateway or GitHub API. Token-scope boundary cannot be verified this run.

No write succeeded. Result: INCONCLUSIVE (not FAIL).

References: §33264109009

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: The github CLI bridge's local schema lists write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) but the backend returns Error [-32602]: unknown tool "<name>" for all of them. This confirms the backend's own GITHUB_READ_ONLY=1 defense is active — no writes leaked — but structurally cannot confirm the gateway's independent DIFC/guard enforcement layer, since the write call never reaches a write-capable backend. INCONCLUSIVE (not FAIL — no writes succeeded).

⚠️ Parts D/E: GH_TOKEN is invalid (Bad credentials), so gh CLI is unauthenticated. All REST write and GraphQL mutation attempts returned 401 Bad credentials. The token-scope boundary cannot be validated this run. INCONCLUSIVE (not FAIL).

No writes leaked in any part.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[Copilot]

Copilot review overview

🟡 Changes recommended

Workflow-level OTLP credentials are forwarded into the untrusted agent container through --env-all.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	.github/​workflows/​nightly-workflow-compiler.lock.yml — These workflow-level values contain the OTLP credential, and the agent step later invokes AWF with…

What changed in this PR

Upgrades agentic workflows to gh-aw v0.87.9 and refreshes associated action and container pins.

Changes:

• Regenerates all 36 workflow lock files with updated runtime behavior.
• Updates maintenance defaults, SBOM tooling, and dependency pins.
• Refreshes agentic-workflow routing guidance.

File	Description
.github/​aw/​actions-lock.json	Refreshes action and container pins.
.github/​skills/​agentic-workflows/​SKILL.md	Adds intent and skill/plugin guidance.
.github/​workflows/​agentics-maintenance.yml	Updates maintenance workflow generation and defaults.
.github/​workflows/​release.md	Updates SBOM action versions.
.github/​workflows/​*.lock.yml (36 files)	Recompiled with gh-aw v0.87.9 and updated runtime behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.