feat: add GitHub Action for installing awf

[Copilot]

Poutine and similar security scanners flag curl | bash install scripts as risky. This adds a composite GitHub Action for secure installation in CI/CD workflows.

Changes

• action.yml - Composite action that:

  • Validates Linux x64 runner
  • Fetches latest version via GitHub API (jq preferred, grep/sed fallback)
  • Supports semver with pre-release suffixes (v1.0.0-beta.1)
  • Downloads binary and verifies SHA256 checksum
  • Validates ELF executable format
  • Adds to $GITHUB_PATH for subsequent steps
  • Optionally pre-pulls Docker images with pull-images: 'true' input
  • Outputs image-tag for use with --image-tag flag to pin container versions

• Documentation updates - README, docs/github_actions.md, docs/quickstart.md now reference the action as the recommended CI/CD installation method

• Test workflow - .github/workflows/test-action.yml verifies the action works by testing:

  • Latest version installation
  • Specific version installation (v0.7.0)
  • Invalid version format rejection
  • Docker image pulling

Usage

steps:
- name: Setup awfuses: githubnext/gh-aw-firewall@main# with:# version: 'v1.0.0' # Optional: defaults to latest# pull-images: 'true' # Optional: pre-pull Docker images
- name: Run command with firewallrun: sudo awf --allow-domains github.com -- curl https://api.github.com

Pinning Docker Image Versions

For reproducible builds, you can pin both the awf binary and Docker images:

steps:
- name: Setup awfid: setup-awfuses: githubnext/gh-aw-firewall@mainwith:
version: 'v0.7.0'pull-images: 'true'
- name: Run with pinned imagesrun: | sudo awf --allow-domains github.com \ --image-tag ${{ steps.setup-awf.outputs.image-tag }} \ -- curl https://api.github.com

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Support installation through action</issue_title>
<issue_description>Install scripts raise issues with Poutine.
Provide a way to install as custom action.</issue_description>

Comments on the Issue (you are @copilot in this section)

• FixesSupport installation through action #167

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Mossaka]

@copilot verify this works by adding a new workflow

[github-actions]

Test Coverage Report

Metric	Coverage	Covered/Total
Lines	81.02%	1230/1518
Statements	80.98%	1261/1557
Functions	78.16%	136/174
Branches	72.56%	410/565

Coverage Thresholds

The project has the following coverage thresholds configured:

• Lines: 38%
• Statements: 38%
• Functions: 35%
• Branches: 30%

---

Coverage report generated by `npm run test:coverage`

[Mossaka]

@copilot also the action should be able to pin the image versions

[Copilot]

@copilot verify this works by adding a new workflow

Added test workflow in commit 17923d5. The .github/workflows/test-action.yml workflow tests:

• Installing the latest version
• Installing a specific version (v0.7.0)
• Rejecting invalid version formats

The workflow uses uses: ./ to test the action from the current branch.

[Copilot]

@copilot also the action should be able to pin the image versions

Added image pinning support in commit 6e76041. The action now has:

• pull-images: 'true' input to pre-pull Docker images for the installed version
• image-tag output (version without 'v' prefix) for use with --image-tag flag

Example usage:

- name: Setup awfid: setup-awfuses: githubnext/gh-aw-firewall@mainwith:
version: 'v0.7.0'pull-images: 'true'
- name: Run with pinned imagesrun: | sudo awf --allow-domains github.com \ --image-tag ${{ steps.setup-awf.outputs.image-tag }} \ -- curl https://api.github.com

[Mossaka]

@copilot rebase to main

[Copilot]

@copilot rebase to main

I cannot perform git rebase operations because force push is not available in my environment, and I cannot pull the latest main branch from GitHub. You'll need to rebase this branch manually or use GitHub's "Update branch" button if available on the PR.

[github-actions]

💥 WHOOSH!Smoke Claude springs into action on this pull request! [Panel 1 begins...]

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

Smoke Test Results

✅ GitHub MCP: Last 2 merged PRs

• docs: add server connectivity guide for HTTP, HTTPS, and gRPC #179: docs: add server connectivity guide for HTTP, HTTPS, and gRPC
• docs: streamline README quickstart section #185: docs: streamline README quickstart section

✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20733461783.txt
✅ Bash Tool: File verified successfully

Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #184 🗺️

[github-actions]

Smoke Test Results (Claude)

Last 2 merged PRs:

• docs: add server connectivity guide for HTTP, HTTPS, and gRPC #179: docs: add server connectivity guide for HTTP, HTTPS, and gRPC
• docs: streamline README quickstart section #185: docs: streamline README quickstart section

Test Results:

• ✅ GitHub MCP: Successfully retrieved PR data
• ✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-20733461762.txt
• ✅ Bash Tool: Verified file contents
• ❌ Playwright MCP: Navigation succeeded but page loaded with errors (ERR_TUNNEL_CONNECTION_FAILED for assets)

Overall Status: PARTIAL PASS (3/4 tests passed, Playwright had connectivity issues)

💥 [THE END] — Illustrated by Smoke Claude fer issue #184 🗺️