Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9

[Copilot]

Routine dependency check found the MCP Gateway container image is one version behind. v0.4.9 includes secret-sanitization in log lines and a trusted host-path mount policy for container MCP servers, along with several reliability fixes (circuit breaker, HTTP backend registration, secrecy label handling).

Changes

• Bumped DefaultMCPGatewayVersion in pkg/constants/version_constants.go from v0.4.8 to v0.4.9.
• Resolved the new immutable digest for ghcr.io/github/gh-aw-mcpg:v0.4.9 (sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f) and updated the pin entries in .github/aw/actions-lock.json, pkg/actionpins/data/action_pins.json, and pkg/workflow/data/action_pins.json.
• Recompiled all 284 workflow .lock.yml files so every generated workflow now references the digest-pinned gh-aw-mcpg:v0.4.9@sha256:... image instead of the prior v0.4.8 pin.
• Scoped the pin update to only the mcpg image — other container pins (e.g. gh-aw-node) were intentionally left untouched to keep the diff minimal.

• Fixes [ca] CLI/Dependency version check: MCP Gateway v0.4.8 → v0.4.9 (digest pin needs re-resolution) #51702

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.76 AIC · ⌖ 5.55 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/31386523734> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.8 AIC · ⌖ 7.79 AIC · ⊞ 6.1K · ◷

_{Comment /souschef to run again}

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

Pull request overview

Updates gh-aw’s default MCP Gateway from v0.4.8 to v0.4.9.

Changes:

• Bumps the gateway version constant.
• Updates all three digest pin registries consistently.
• Recompiles 284 generated workflow lock files with the new image.

The implementation matches the stated scope, but the branch currently has merge conflicts.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates the default gateway version.
.github/aw/actions-lock.json	Updates the repository image pin.
pkg/actionpins/data/action_pins.json	Updates action-pin data.
pkg/workflow/data/action_pins.json	Updates compiler pin data.
.github/workflows/*.lock.yml (284 files)	Regenerates workflows with v0.4.9 and its digest.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 78/288 changed files
• Comments generated: 0
• Review effort level: Balanced

[Copilot]

@copilot resolve the merge conflicts on this branch.

Merge conflicts resolved in 4f1070e. The three conflicting files (mcp-inspector.lock.yml, portfolio-analyst.lock.yml, smoke-otel-backends.lock.yml) were regenerated from main's content via make build && make recompile rather than hand-merged, so the only remaining delta on those files is the mcpg v0.4.8 → v0.4.9 pin. Verified: no gh-aw-mcpg:v0.4.8 references remain, 284/284 workflows compile, and all lock files are in sync with their markdown sources.

[gh-aw-bot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly, and run the pr-finisher skill before handing this back to maintainers.

No failed checks were listed in the compact candidate snapshot.
Run details: https://github.com/github/gh-aw/actions/runs/31384398611

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.76 AIC · ⌖ 5.55 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly...

Ran pr-finisher on the latest head (4f1070ec04). No code changes were needed — nothing to push this pass.

• ✅ Reviews — Zero unresolved review threads (reviewThreads is empty). The earlier reviewer note about merge conflicts was already addressed by the merge commit 4f1070ec04.
• ✅ Mergeable — Not CONFLICTING and not BEHIND: the PR base (52a7223df2) is identical to current origin/main and is the second parent of my merge commit, so GitHub has nothing to update. mergeable_state is blocked, which reflects the pending review approval, not a branch problem.
• ✅ Checks (local) — make fmt clean, make lint passed (0 errors; the 184 warnings are pre-existing repo-wide), make recompile produced zero diff so all 284 lock files are in sync.
• ❌ Pre-existing unrelated failure — TestEmbeddedContainerPins_DoNotIncludeVulnerableAstGrepImage in pkg/actionpins fails. I verified this reproduces on a clean origin/main worktree, so it is not caused by this PR. The test asserts mcp/ast-grep:latest is absent from the embedded pins, but that pin is still present in action_pins.json on main with a byte-identical entry. Fixing it means removing the ast-grep pin, which is out of scope here, so I left it alone rather than bundling an unrelated change.
• ❓ Checks (CI) — No check runs exist on this head SHA; agent pushes don't trigger workflows.

Hand-off: a maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or a push) and approve. The ast-grep pin failure should be tracked separately since it blocks make test-unit on main today.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in 0473188. main had advanced by two commits since the last merge (df6442f runner-guard hardening, ad411fd python:alpine pin removal), which re-conflicted .github/workflows/mcp-inspector.lock.yml.

Resolved the same way as before: took main's version of the generated lock file and regenerated it with make build && make recompile instead of hand-merging, so the only remaining delta is the mcpg v0.4.8 → v0.4.9 pin (5 occurrences). The python:alpine removal and runner-guard changes from main came through untouched.

Verified: no gh-aw-mcpg:v0.4.8 references remain anywhere, 284/284 workflows compile, and all lock files are in sync with their markdown sources. PR base is now ad411fd and the branch is no longer conflicting.

[gh-aw-bot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly, and run the pr-finisher skill before handing this back to maintainers.

No failed checks were listed in the compact candidate snapshot.
Branch refresh was requested.
Run details: https://github.com/github/gh-aw/actions/runs/31386523734

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.8 AIC · ⌖ 7.79 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, resolve any addressed unresolved review threads, refresh the branch if GitHub can update it cleanly...

Ran pr-finisher on head 0473188e86. No code changes were needed — nothing to push this pass.

• ✅ Mergeable — Branch refresh was requested but is a no-op: origin/main is still ad411fd66, which is already the PR base and the second parent of merge commit 0473188. git merge-base --is-ancestor origin/main HEAD confirms the branch is not BEHIND and not conflicting. mergeable_state: blocked reflects the pending review approval, not a branch problem.
• ✅ Reviews — Zero unresolved review threads (reviewThreads is empty); nothing to reply to or resolve.
• ✅ Checks (local) — make fmt clean, make lint passed, make recompile produced a zero-byte diff so all 284 lock files remain in sync.
• ❌ Pre-existing unrelated failure (unchanged) — TestEmbeddedContainerPins_DoNotIncludeVulnerableAstGrepImage still fails. Re-confirmed it is not from this PR: diffing all three pin files against origin/main shows the only delta is the mcpg v0.4.8 → v0.4.9 entry; the mcp/ast-grep:latest pin the test objects to is byte-identical to main. Still out of scope to fix here.
• ❓ Checks (CI) — No CI check runs on this head SHA; agent pushes don't trigger workflows.

Hand-off: unchanged from the last pass — a maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or a push) and approve. The ast-grep pin failure is worth a separate issue since it blocks make test-unit on main today.

[github-actions]

Triage: Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9

• Category: chore (dependency bump) | Risk: low | Score: 60/100 (impact 25, urgency 20, quality 15)
• Recommended action: fast_track (batch: security-container-mitigation)
• Notes: Includes security fix (secret-sanitization in logs) + reliability fixes. Near-duplicate of Bump gh-aw-mcpg image to v0.4.9 #51770 — recommend merging this one (non-draft, has AI reviewer comment) and closing Bump gh-aw-mcpg image to v0.4.9 #51770. mergeable_state: blocked, check branch protection/required reviews.

Generated by 🔧 PR Triage Agent · auto · 49.6 AIC · ⌖ 2.51 AIC · ⊞ 7.8K · ◷

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in 9e9e85b. main had advanced to 6850cfc, which re-conflicted five generated lock files (glossary-maintainer, mcp-inspector, portfolio-analyst, scout, smoke-otel-backends).

Resolved the same way as before: took main's version of each conflicted lock file and regenerated with make build && make recompile instead of hand-merging. git diff origin/main now shows only the mcpg v0.4.8 → v0.4.9 version constant and digest pin changes — no other content differs from main.

Verified: no gh-aw-mcpg:v0.4.8 references remain, 284/284 workflows compile, all lock files in sync, and make agent-report-progress (fmt + lint + impacted tests) passed.