Upgrade gh-aw-mcpg to v0.4.10

[Copilot]

The MCP Gateway (gh-aw-mcpg) image was pinned to v0.4.9. This upgrades it to v0.4.10, which brings GitHub guard coverage improvements, DIFC/guard hardening and diagnostics, remote schema $ref support, and tracing/workflow compatibility updates.

Version and pin updates

• Bumped DefaultMCPGatewayVersion in pkg/constants/version_constants.go from v0.4.9 to v0.4.10.
• Updated the gh-aw-mcpg entry in .github/aw/actions-lock.json to the v0.4.10 tag and its immutable digest, verified directly against the ghcr.io manifest API.
• Synced pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json from the updated lockfile.

Regenerated workflows

• Recompiled all .github/workflows/*.lock.yml files (two-pass compile, as required after an MCP Gateway version bump) so manifests, container download steps, MCP_GATEWAY_DOCKER_COMMAND, and CLI proxy references consistently point to v0.4.10.

Changeset

• Added a changeset entry documenting the version bump.

Historical references to v0.4.9 in ADR docs and prior changesets (describing when specific behaviors were introduced) were intentionally left as-is since they document past state, not the current pin.

• Fixes Upgrade gh-aw-mcpg to v0.4.10 #54067

---

Run: https://github.com/github/gh-aw/actions/runs/32326521694> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.9 AIC · ⌖ 8.15 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.85 AIC · ⌖ 9.55 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[github-actions]

Hey @Copilot 👋 — thanks for working on the gh-aw-mcpg upgrade! This looks focused and well-documented. Heres one thing that would strengthen the PR:

• Add test coverage — this PR regenerates 291 workflow lock files and updates the MCP Gateway version constant. While the changes appear to be mostly mechanical (re-pins and recompilation), adding a test or validation step that confirms:

  • The MCP Gateway version constant matches the pinned image version
  • Generated workflow files reference the correct digest for v0.4.10
  • No stale v0.4.9 references remain in generated output

  would help catch any inconsistencies during review and future maintenance.

Otherwise, this is a solid, systematic upgrade. Once tests are added or validation is documented, this should be ready for merge.

Generated by ✅ Contribution Check · auto · 52.7 AIC · ⌖ 5 AIC · ⊞ 9.2K · ◷

[lpcox]

@copilot run the pr-finisher skill

[Copilot]

@copilot run the pr-finisher skill

Ran pr-finisher: merged main to resolve the BEHIND mergeable state (resolved 8 generated lock.yml conflicts by regenerating via make recompile), reverted an unrelated sandbox-only aw.json GHES-detection artifact, and re-validated with make fmt, full make test-unit, and make test-integration — all green. No unresolved review threads exist. Pushed in ccdf525. CI on this head is stale after the push and needs a maintainer re-trigger before merge.

[github-actions]

📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing...

[github-actions]

✂️ Ponytail Reviewer has started processing this pull request

[github-actions]

🔬 Test Quality Sentinel is analyzing test quality on this pull request...

[github-actions]

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

[github-actions]

🥧 Pi initializing... Smoke Pi begins on this pull request...

[github-actions]

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

[github-actions]

🌸 Smoke Copilot Auto has started processing this pull request

[github-actions]

PR Triage

• Category: chore
• Risk: medium
• Priority score: 45 / 100 (impact 25 + urgency 15 + quality 5)
• Recommended action: defer

Merge conflict (dirty state) across 291 files, mostly lockfile churn from dependency upgrade. Needs rebase before further review.

Automated triage by PR Triage Agent.

Generated by 🔧 PR Triage Agent · auto · 57.1 AIC · ⌖ 2.88 AIC · ⊞ 8.3K · ◷

[gh-aw-bot]

@copilot This PR has merge conflicts and still needs a conflict-resolution pass before maintainer pickup.

Please run make merge-main to resolve conflicts, then run the pr-finisher skill and leave a concise maintainer-facing handoff with validation and any remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 29.9 AIC · ⌖ 8.24 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR has merge conflicts and still needs a conflict-resolution pass before maintainer pickup.

Please run make merge-main to resolve conflicts, then run the pr-finisher skill and leave...

Conflicts resolved and pr-finisher pass complete. Pushed in 72c60c8.

Conflict resolution: merged origin/main. All 46 conflicts were in generated .lock.yml files — resolved by taking main's side and regenerating from the merged sources with a two-pass compile, rather than hand-editing generated output. The result is a true merge commit with two parents. pkg/constants/version_constants.go auto-merged cleanly and retains v0.4.10.

Scope verified: the diff versus main under .github/workflows/ now contains zero lines that aren't the mcpg version/digest bump. The only other changed files are .changeset/upgrade-gh-aw-mcpg-v0-4-10.md, .github/aw/actions-lock.json, both action_pins.json data files, and version_constants.go.

Validation (local): make fmt, make lint (0 errors, warnings only), full TEST_UNIT_RUN_FULL=1 make test-unit (exit 0), and the lock-file sync gate — all green. Working tree clean.

Note on the earlier activation failures: those were caused by the agent sandbox's http://localhost:<port> git origin being misdetected as GHES during make recompile's init step, which downgraded artifact actions to the retired v3 pins. main now includes #54112 ("Skip GHES auto-detection during CI initialization"), which fixes that root cause upstream — and main has also dropped the ghes key from aw.json entirely. Confirmed 0 remaining v3 artifact pins on this branch.

Remaining risk / hand-off: none identified in the diff. CI on this HEAD is stale after the agent push and needs a maintainer re-trigger before merge, since agent pushes don't start workflows.

[gh-aw-bot]

@copilot This PR still needs a forward-progress pass.

• Please refresh the branch if GitHub offers one, address the remaining maintainer-visible blockers, and then run the pr-finisher skill with a concise maintainer-facing handoff.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.4 AIC · ⌖ 8.15 AIC · ⊞ 6.9K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still needs a forward-progress pass.

• Please refresh the branch if GitHub offers one, address the remaining maintainer-visible blockers, and then run the pr-finisher skill with a ...

Ran another pr-finisher pass. Pushed in 70b9307.

What changed: the branch had fallen 1 commit behind main (#54030, a pure Go refactor of add_package_manifest.go). Merged it — clean, zero conflicts. A full two-pass recompile afterwards produced zero lock-file drift, confirming the merge didn't perturb generated output.

Scope re-verified against the new main: the diff under .github/workflows/ still contains zero lines that aren't the mcpg version/digest bump. Non-lock changed files remain exactly: .changeset/upgrade-gh-aw-mcpg-v0-4-10.md, .github/aw/actions-lock.json, both action_pins.json data files, and version_constants.go. Zero retired v3 artifact pins.

Validation (local): make fmt, make lint (0 errors), full TEST_UNIT_RUN_FULL=1 make test-unit (exit 0), and the lock-file sync gate — all green. Working tree clean, nothing unpushed.

Reviews: no unresolved review threads (reviewThreads is empty). The only review on record is the Copilot reviewer's COMMENTED summary with 0 comments. The remaining bot comments on the PR are stale "workflow starting" reaction posts from the old head, not feedback.

Remaining blocker — not agent-actionable: mergeable_state is blocked because required checks have not run on this HEAD. Agent pushes don't trigger workflows, so CI is unverified here and needs a maintainer re-trigger (close/reopen, workflow_dispatch, or a maintainer push) plus approving review before merge. No code-level risks identified in the diff.

[gh-aw-bot]

@copilot Sous-chef triage: please investigate this PR and move it toward merge readiness. Refresh the branch if needed, review any unresolved feedback, and run the pr-finisher skill before your next update.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.9 AIC · ⌖ 8.15 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Sous-chef triage: please investigate this PR and move it toward merge readiness. Refresh the branch if needed, review any unresolved feedback, and run the pr-finisher skill before your next...

Investigated. The PR is not blocked on anything I can act on — it needs a maintainer to approve the workflow runs.

Root cause of the blocked state. I pulled the workflow-run history for this branch. On the current head 70b9307, the two required Go workflows are:

• CGO (.github/workflows/cgo.yml) — completed / action_required
• CWI (.github/workflows/CWI.yml) — completed / action_required

action_required means awaiting maintainer approval to run, not failing. Same on the previous head 72c60c8. So since the artifact-pin fix landed, CI has never actually executed on this branch — there are zero failing checks, just unapproved ones. Nothing in the code is causing this, and no amount of further agent pushes will clear it; each new push simply creates another unapproved run.

For contrast, the last head that did run CI was ccdf525, which showed the 13 activation failures. Those were the GHES/v3-artifact-pin bug, fixed in 12f8ee1.

Branch is current: 0 commits behind main; PR base sha already equals the main tip (9324c8b). Nothing to refresh.

Unresolved feedback: none. reviewThreads is empty; the only review is the Copilot reviewer's COMMENTED summary with 0 comments. Remaining bot comments are stale "workflow starting" reactions.

Since CI can't run, I locally reproduced the checks CGO/CWI would perform — all green:

• go mod verify → all modules verified
• make build / make build-wasm → OK
• make test-wasm-golden → PASS (worth calling out: a version-constant change is exactly the kind of thing that can shift wasm golden output; it did not)
• make test-impacted-go BASE_REF=origin/main → PASS
• make fmt, make lint (0 errors), full TEST_UNIT_RUN_FULL=1 make test-unit → PASS
• Two-pass recompile → zero lock-file drift

Scope re-verified: the .github/workflows/ diff versus main contains zero lines that aren't the mcpg version/digest bump; 0 retired v3 artifact pins. Non-lock changed files are exactly the changeset, .github/aw/actions-lock.json, both action_pins.json files, and version_constants.go. Note version_constants.go also shows DefaultThreatDetectVersion = v0.4.11 — that is a different constant that arrived from main via #54111, not part of this change; DefaultMCPGatewayVersion is v0.4.10 as intended.

No commit this pass: the tree is byte-identical to the already-pushed 70b9307, so pushing would only add an empty commit and invalidate CI again.

Action needed from a maintainer: approve the pending CGO / CWI workflow runs on 70b9307 (the "Approve and run" button on the PR checks tab), then review. This PR is otherwise merge-ready.

[gh-aw-bot]

@copilot quick triage for this PR:

Please refresh the branch if needed, address the items above, and then run the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.85 AIC · ⌖ 9.55 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot quick triage for this PR:

Please refresh the branch if needed, address the items above, and then run the pr-finisher skill....

Ran another triage/pr-finisher pass. No changes needed — and nothing left that I can act on.

Branch refresh: not needed. origin/main tip is 9324c8b, which is already merged into this branch (0 commits behind), and the PR base sha equals it.

Unresolved feedback: none. reviewThreads is empty; the only review on record is the Copilot reviewer's COMMENTED summary with 0 comments. Remaining bot comments are stale "workflow starting" posts.

Why mergeable_state is blocked: the two required Go workflows on head 70b9307 are both completed / action_required — i.e. awaiting maintainer approval to run, not failing:

• CGO — action_required
• CWI — action_required

The only checks that have actually executed on this head are the Copilot agent runs (success). No further agent push can clear this; each push just creates another unapproved run.

Scope re-verified this pass:

• .github/workflows/ diff versus main contains zero lines that aren't the mcpg version/digest bump.
• 0 retired upload-artifact@v3 / download-artifact@v3 pins.
• Non-lock changed files are exactly: .changeset/upgrade-gh-aw-mcpg-v0-4-10.md, .github/aw/actions-lock.json, pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json, pkg/constants/version_constants.go.

Working tree is byte-identical to the pushed 70b9307, so no commit this pass (an empty commit would only add noise).

Action needed from a maintainer: click "Approve and run" for the pending CGO / CWI runs on 70b9307, then review. The PR is otherwise merge-ready; no code-level risks identified in the diff.

[github-actions]

PR Triage

Category: chore | Risk: low | Priority: medium (score 53/100)
Score breakdown: impact 20 + urgency 15 + quality 18
Recommended action: auto_merge
Dependency pin bump for gh-aw-mcpg (v0.4.9 -> v0.4.10) bringing guard/tracing improvements. CI green (27 success, 3 skipped). Good auto-merge candidate.

Generated by 🔧 PR Triage Agent · auto · 62.9 AIC · ⌖ 7.05 AIC · ⊞ 8.3K · ◷