chore: bump Agent Workflow Firewall from v0.25.18 to v0.25.20

[lpcox]

Bumps the default Agent Workflow Firewall (AWF) version from v0.25.18 to v0.25.20.

Changes

• Updated DefaultFirewallVersion constant in pkg/constants/version_constants.go
• Rebuilt binary and recompiled all 187 workflow lock files

Closes #25925

[Copilot]

Pull request overview

This PR bumps the default Agent Workflow Firewall (AWF) version from v0.25.18 to v0.25.20, and regenerates workflow lock files to reference the updated AWF version.

Changes:

• Updated DefaultFirewallVersion to v0.25.20.
• Regenerated workflow *.lock.yml files to use AWF 0.25.20 for container images and v0.25.20 for AWF binary installation.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates the default AWF version constant to v0.25.20.
.github/workflows/workflow-generator.lock.yml	Regenerated lock file to reference AWF 0.25.20 across install/pull/run steps.
.github/workflows/test-workflow.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/schema-feature-coverage.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/refiner.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/pr-triage-agent.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/plan.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/metrics-collector.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/issue-triage-agent.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/gpclean.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/firewall.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/example-permissions-warning.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/dev.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/contribution-check.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/code-simplifier.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/changeset.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/bot-detection.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/ai-moderator.lock.yml	Regenerated lock file to reference AWF 0.25.20.
.github/workflows/ace-editor.lock.yml	Regenerated lock file to reference AWF 0.25.20.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 65/188 changed files
• Comments generated: 1

[Copilot]

The lock manifest no longer pins the AWF container images to immutable digests (the gh-aw-firewall entries only include a tag, while other containers still include digest/pinned_image). This weakens supply-chain guarantees and makes runs non-reproducible. Please restore digest + pinned_image fields for the AWF images (agent/api-proxy/squid) for this lock file (and other regenerated locks).

This issue also appears in the following locations of the same file:

• line 44
• line 417

[github-actions]

Hey @lpcox 👋 — thanks for keeping the Agent Workflow Firewall up to date! Bumping DefaultFirewallVersion and regenerating all 187 lock files in one shot is exactly the kind of housekeeping that keeps the fleet consistent.

A few things worth tidying up before this lands:

• Version mismatch with the linked issue — Issue chore: bump Agent Workflow Firewall (AWF) from v0.25.18 to v0.25.19 #25925 requested a bump from v0.25.18 → v0.25.19, but this PR lands on v0.25.20 (skipping .19 entirely). If v0.25.19 was intentionally bypassed, a brief note in the PR body would keep the audit trail clean.
• Pin the constant in TestConstantValues — pkg/constants/constants_test.go already pins specific constant values in a table (e.g., DefaultActivationJobRunnerImage). DefaultFirewallVersion isn't there, so a reviewer can't tell at a glance what the "correct" value is. Adding it would also make accidental double-bumps visible in test failures.
• Missing changeset file — Every prior AWF bump has a corresponding .changeset/patch-bump-awf-vX-Y-Z.md entry (there are 19 of them). A file like .changeset/patch-bump-awf-v0-25-20.md is expected for this PR.

Fix three small gaps in PR #25975 (AWF bump to v0.25.20):

1. Add a note to the PR body explaining why v0.25.19 was skipped (or open/close a separate issue for it).

2. In pkg/constants/constants_test.go, add DefaultFirewallVersion to the TestConstantValues pin table:
   {"DefaultFirewallVersion", constants.DefaultFirewallVersion, "v0.25.20"},

3. Add .changeset/patch-bump-awf-v0-25-20.md with content:
   ---
   "`@github/gh-aw`": patch
   ---
   chore: bump Agent Workflow Firewall from v0.25.18 to v0.25.20

Run `make agent-finish` to validate.

Generated by Contribution Check · ● 3.2M · ◷