Upgrade gh-aw-mcpg to v0.4.10

[Copilot]

The MCP Gateway (gh-aw-mcpg) image was pinned to v0.4.9. This upgrades it to v0.4.10, which brings GitHub guard coverage improvements, DIFC/guard hardening and diagnostics, remote schema $ref support, and tracing/workflow compatibility updates.

Version and pin updates

• Bumped DefaultMCPGatewayVersion in pkg/constants/version_constants.go from v0.4.9 to v0.4.10.
• Updated the gh-aw-mcpg entry in .github/aw/actions-lock.json to the v0.4.10 tag and its immutable digest, verified directly against the ghcr.io manifest API.
• Synced pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json from the updated lockfile.

Regenerated workflows

• Recompiled all .github/workflows/*.lock.yml files (two-pass compile, as required after an MCP Gateway version bump) so manifests, container download steps, MCP_GATEWAY_DOCKER_COMMAND, and CLI proxy references consistently point to v0.4.10.

Changeset

• Added a changeset entry documenting the version bump.

Historical references to v0.4.9 in ADR docs and prior changesets (describing when specific behaviors were introduced) were intentionally left as-is since they document past state, not the current pin.

• FixesUpgrade gh-aw-mcpg to v0.4.10 #54067

---

Run: https://github.com/github/gh-aw/actions/runs/32326521694> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.9 AIC · ⌖ 8.15 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.85 AIC · ⌖ 9.55 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

---

---

✨ PR Review Safe Output Test - Run 32336198643> [!WARNING]

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "www.google.com"
- "www.gstatic.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 62.9 AIC · ⌖ 18.3 AIC · ⊞ 6.7K · ◷
_{Comment /smoke-claude to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/32385519055> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.1 AIC · ⌖ 8.25 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

[github-actions]

Hey @Copilot 👋 — thanks for working on the gh-aw-mcpg upgrade! This looks focused and well-documented. Heres one thing that would strengthen the PR:

• Add test coverage — this PR regenerates 291 workflow lock files and updates the MCP Gateway version constant. While the changes appear to be mostly mechanical (re-pins and recompilation), adding a test or validation step that confirms:

  • The MCP Gateway version constant matches the pinned image version
  • Generated workflow files reference the correct digest for v0.4.10
  • No stale v0.4.9 references remain in generated output

  would help catch any inconsistencies during review and future maintenance.

Otherwise, this is a solid, systematic upgrade. Once tests are added or validation is documented, this should be ready for merge.

Generated by ✅ Contribution Check · auto · 52.7 AIC · ⌖ 5 AIC · ⊞ 9.2K · ◷

[lpcox]

@copilot run the pr-finisher skill

[Copilot]

@copilot run the pr-finisher skill

Ran pr-finisher: merged main to resolve the BEHIND mergeable state (resolved 8 generated lock.yml conflicts by regenerating via make recompile), reverted an unrelated sandbox-only aw.json GHES-detection artifact, and re-validated with make fmt, full make test-unit, and make test-integration — all green. No unresolved review threads exist. Pushed in ccdf525. CI on this head is stale after the push and needs a maintainer re-trigger before merge.

[github-actions]

📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing...

[github-actions]

✂️ Ponytail Reviewer has started processing this pull request

[github-actions]

🔬 Test Quality Sentinel is analyzing test quality on this pull request...

[github-actions]

💥 WHOOSH!Smoke Claude springs into action on this pull request! [Panel 1 begins...]

[github-actions]

🥧 Pi initializing... Smoke Pi begins on this pull request...

[github-actions]

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

[github-actions]

🌸 Smoke Copilot Auto has started processing this pull request

[github-actions]

Smoke test FAIL
✅ gh CLI
✅ web fetch
✅ file write
✅ bash verify
❌ build

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "proxy.golang.org"

See Network Configuration for more information.

🥧 Smoke Pi — Powered by Pi · gpt54 · 2.67 AIC · ⌖ 3.81 AIC · ⊞ 5.9K · ◷
_{Comment /smoke-pi to run again}

[github-actions]

🤖 Smoke Test Results — Run 32336198643

Core Tests: ✅ #1 GitHub MCP | ✅ #2 GH CLI | ✅ #3 Make Build | ✅ #4 Playwright | ✅ #5 Tavily | ✅ #6 File Write | ✅ #7 Bash | ✅ #8 Discussion | ✅ #9 AW MCP | ✅ #10 Slack | ✅ #11 Code Scan | ✅ #12 Check Run

PR Review Tests: ✅ #13 Update PR | ✅ #14 Review Comments | ✅ #15 Submit Review | ⚠️#16 Resolve Thread (no existing threads) | ✅ #17 Add Reviewer | ❌ #18 Push Branch (allowed-files policy) | ⚠️#19 Close PR (skipped)

Overall: PARTIAL — all non-skipped tests passed

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "www.google.com"
- "www.gstatic.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 62.9 AIC · ⌖ 18.3 AIC · ⊞ 6.7K · ◷
_{Comment /smoke-claude to run again}

[github-actions]

💥 Automated smoke test review - all systems nominal! Run 32336198643

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "www.google.com"
- "www.gstatic.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · sonnet46 · 62.9 AIC · ⌖ 18.3 AIC · ⊞ 6.7K
_{Comment /smoke-claude to run again}

[github-actions]

✅ Smoke test review comment — Run 32336198643: Good changeset entry documenting the v0.4.9 → v0.4.10 MCP Gateway upgrade. Clear and concise.

[github-actions]

✅ Smoke test review comment #2 — Run 32336198643: DefaultMCPGatewayVersion correctly updated from v0.4.9 to v0.4.10. Version bump looks good.

[gh-aw-bot]

@copilot Please take a maintainer-facing pass on this PR.

• Review the current failed checks from the latest head and address the forward-progress blockers directly.
• Failed checks: agent (https://github.com/github/gh-aw/actions/runs/32336198932/job/96445685738), agent (https://github.com/github/gh-aw/actions/runs/32336198768/job/96445948240), agent (https://github.com/github/gh-aw/actions/runs/32336198724/job/96445704967).
• Refresh the branch if GitHub offers it.
• Run the pr-finisher skill before handing back for maintainer review.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/32376962566

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 19.2 AIC · ⌖ 8.16 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot quick triage for this PR:

Please refresh the branch if needed, address the items above, and then run the pr-finisher skill....

Investigated the three failed agent checks — none are caused by this PR; all three are environmental. Branch refreshed and pushed in 68f5743.

Root cause of each failed check:

1. Changeset Generator (job) and Smoke Codex (job) — both codex-engine workflows. Every attempt (4/4, retries exhausted) failed with the same inference-endpoint auth error:

   401 Unauthorized: You do not have access to the project tied to the API key.
   auth error: 401, auth error code: invalid_project
   

   This is the Codex/OpenAI API key's project binding in repo secrets, not anything in the diff. The MCP gateway itself started and attached fine in these runs.

2. Smoke Gemini (job) — exit code 127, from:

   node runtime missing on this runner — check runtimes.node in workflow YAML
   

   A cloud-hypervisor runner provisioning issue. Note awmg-mcpg came up cleanly (Topology peer "awmg-mcpg" has IP 172.30.0.2) before the agent command failed.

Positive evidence that mcpg v0.4.10 is healthy: on the same head, Smoke OTEL, Smoke Copilot MAI, and Smoke Copilot Small all passed — agentic workflows using the new gateway do run successfully. activation also succeeded, confirming the earlier v3-artifact-pin bug is gone.

Required checks already passed on head 70b9307:CGO → success (run 32323873954) and CWI → success (run 32323874241), after your approval. Those were the checks blocking mergeable_state.

Branch refresh (the actionable item): the branch had fallen 2 commits behind main (#54144 t.Parallel test batch, #54131 Ubuntu image analysis). Merged — clean, zero conflicts. A two-pass recompile afterwards produced zero lock-file drift.

Scope re-verified against the new main: the .github/workflows/ diff contains zero lines that aren't the mcpg version/digest bump; 0 retired v3 artifact pins. Non-lock changed files remain exactly the changeset, .github/aw/actions-lock.json, both action_pins.json files, and version_constants.go.

Validation (local):make build, make fmt, lint, make agent-report-progress (impacted unit tests), and the lock-file sync gate — all green. Code review: 0 comments. Secret scan: clean.

Hand-off: the two codex failures need the invalid_project API-key/project mapping fixed at the repo/org secret level (not agent-actionable, and not a merge blocker for this change); the Gemini 127 is runner infra and should clear on re-run. Required CGO/CWI need re-approval on the new head 68f5743.

[gh-aw-bot]

@copilot Please take a maintainer-facing pass on this PR.

• CGO was approved for the current head 68f5743; please watch the refreshed required-check state for this head.
• Remaining failed checks on the latest completed run are maintainer-visible agent/workflow issues, not code regressions in this branch:
  • agent
  • agent
  • agent
• Refresh the branch if GitHub offers it, re-check merge readiness on the latest head, and run the pr-finisher skill before handing back for maintainer review.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 21 AIC · ⌖ 10.2 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please take a maintainer-facing pass on this PR.

• CGO was approved for the current head 68f5743; please watch the refreshed required-check state for this head....

Checked the refreshed required-check state on 68f5743. The CGO approval did not take effect — both required checks are still awaiting approval on this head.

Current required-check state on 68f5743:

Check	Run	Conclusion
CGO	32379299445	action_required
CWI	32379299429	action_required

Both were created at 14:18 UTC and never progressed past action_required (created_at == updated_at), so neither has executed. That is why mergeable_state is still blocked. Note CWI also needs approving — it wasn't mentioned in the request, but it's a required check in the same state.

The three linked agent failures are stale. I re-checked each one's head_sha: all three are on the previous head 70b9307, not 68f5743:

• Changeset Generator 32336198932 → head_sha: 70b9307
• Smoke Codex 32336198768 → head_sha: 70b9307
• Smoke Gemini 32336198724 → head_sha: 70b9307

As established last pass, their causes are environmental and outside this diff: the two codex workflows fail on 401 ... auth error code: invalid_project (API key project binding), and Smoke Gemini exits 127 on node runtime missing on this runner. Neither will be re-evaluated on the current head unless re-triggered.

Branch refresh: not needed — 0 commits behind main; the PR base sha already equals the main tip (0b8a771).

Merge readiness re-verified on 68f5743:

• Working tree clean and byte-identical to the pushed head — no commit this pass (an empty commit would only invalidate checks again).
• .github/workflows/ diff versus main: zero lines that aren't the mcpg version/digest bump.
• 0 retired v3 artifact pins; DefaultMCPGatewayVersion = "v0.4.10".
• Non-lock changed files remain exactly: the changeset, .github/aw/actions-lock.json, both action_pins.json files, and version_constants.go.
• Prior full validation on this exact tree (make build, make fmt, lint, impacted unit tests, two-pass recompile with zero drift, code review 0 comments, secret scan clean) all passed.

Action needed from a maintainer: approve both pending runs on 68f5743 — CGO (32379299445) and CWI (32379299429) — via "Approve and run" on the checks tab. Both previously passed on 70b9307, and the only delta since is a clean main merge with zero lock drift, so they're expected to pass. Nothing else is blocking.

[gh-aw-bot]

@copilot Please take another maintainer-facing pass on this PR.

• Refresh the branch if GitHub offers it.
• Review the unresolved feedback from github-actions on the PR review threads and address or resolve it directly on the latest head.
• Use the pr-finisher skill before handing back for maintainer review.

Unresolved review threads:

• github-actions: Upgrade gh-aw-mcpg to v0.4.10 #54068 (review)
• github-actions: Upgrade gh-aw-mcpg to v0.4.10 #54068 (review)

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/32385519055

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.1 AIC · ⌖ 8.25 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}