Merge remote-tracking branch 'origin/main' into copilot/awf-fix-credential-hiding-overlays

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot

.github/aw/actions-lock.json

@@ -272,20 +272,20 @@
       "digest": "sha256:3d5dba0b0a139bbb11b5d5b8b44f277d2b18f69cf43090e3c283d750cf864baa",
       "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.28.9@sha256:3d5dba0b0a139bbb11b5d5b8b44f277d2b18f69cf43090e3c283d750cf864baa"
     },
-    "ghcr.io/github/gh-aw-mcpg:v0.4.13": {
-      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.13",
-      "digest": "sha256:ec4008521c610e1113ed557ecec0ff64a2c2111e4cfa817bab54d9b7da24c7cc",
-      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.13@sha256:ec4008521c610e1113ed557ecec0ff64a2c2111e4cfa817bab54d9b7da24c7cc"
-    },
     "ghcr.io/github/gh-aw-mcpg:v0.4.14": {
       "image": "ghcr.io/github/gh-aw-mcpg:v0.4.14",
       "digest": "sha256:b2f0c2b2f17b5fbe809e5bb99dc185b6ddd70df25295dc63a6d526350334eff5",
       "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.14@sha256:b2f0c2b2f17b5fbe809e5bb99dc185b6ddd70df25295dc63a6d526350334eff5"
     },
+    "ghcr.io/github/gh-aw-mcpg:v0.4.15": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.15",
+      "digest": "sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e"
+    },
     "ghcr.io/github/gh-aw-node": {
       "image": "ghcr.io/github/gh-aw-node",
-      "digest": "sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b",
-      "pinned_image": "ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"
+      "digest": "sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23",
+      "pinned_image": "ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"
     },
     "ghcr.io/github/github-mcp-server:v1.11.0": {
       "image": "ghcr.io/github/github-mcp-server:v1.11.0",
@@ -294,8 +294,8 @@
     },
     "mcr.microsoft.com/playwright/mcp": {
       "image": "mcr.microsoft.com/playwright/mcp",
-      "digest": "sha256:3d871c22ea2d4cca0966e2cfb1860e1cb03eb7353725a3d6cffd133296fb04eb",
-      "pinned_image": "mcr.microsoft.com/playwright/mcp@sha256:3d871c22ea2d4cca0966e2cfb1860e1cb03eb7353725a3d6cffd133296fb04eb"
+      "digest": "sha256:dda1f7f9b812e22946635c8af7df9288b96d3b9e3f0f1b8576d6823e2031c1de",
+      "pinned_image": "mcr.microsoft.com/playwright/mcp@sha256:dda1f7f9b812e22946635c8af7df9288b96d3b9e3f0f1b8576d6823e2031c1de"
     }
   }
 }

.github/workflows/smoke-enclave-issues-read.lock.yml

@@ -43,7 +43,7 @@ sandbox:
     id: awf
     version: v0.28.9
   mcp:
-    version: v0.4.13
+    version: v0.4.15
 strict: false
 concurrency:
   group: smoke-enclave-issues-read
@@ -124,18 +124,18 @@ Pass this exact finite-disclosure schema:
 Give the enclave agent this task:
 
 ```text
-Use only the narrow gh wrapper and run each command exactly once:
+Use only the `github` MCP server and call each tool exactly once:
 
-1. gh api --method GET 'repos/github/gh-aw/issues?per_page=1'
-2. gh api --method GET 'repos/github/gh-aw/issues/50920'
-3. gh api --method GET 'repos/github/gh-aw/issues/50920/comments?per_page=1'
+1. `list_issues` with `owner: "github"`, `repo: "gh-aw"`, and `perPage: 1`
+2. `issue_read` with `owner: "github"`, `repo: "gh-aw"`, `method: "get"`, and `issue_number: 50920`
+3. `issue_read` with `owner: "github"`, `repo: "gh-aw"`, `method: "get_comments"`, `issue_number: 50920`, and `perPage: 1`
 
 Return exactly:
 {"list_read":true,"issue_read":true,"comments_read":true}
 
-Set a value to false if its command fails, the list or comments response is not
+Set a value to false if its tool call fails, the list or comments response is not
 a JSON array, or the issue response does not contain number 50920. Do not use
-stock gh issue commands, GraphQL, search, writes, or any other GitHub endpoint.
+GitHub CLI, GraphQL, search, writes, or any other GitHub tool.
 ```
 
 The test passes only when all three returned booleans are `true`.

.github/workflows/smoke-enclave-issues-read.md

@@ -12,12 +12,16 @@ FROM golang:1.26.6-alpine@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea0
 ARG GH_VERSION=2.97.0
 ARG GH_SOURCE_SHA256=18cd1280f70911c9c16dd5965cdac0b9e6b16e54466f0c892ce2829ecdd339a6
 ARG GH_SOURCE_DATE_EPOCH=1785488640
+ARG GH_GRPC_VERSION=1.83.1
 RUN wget -q "https://github.com/cli/cli/archive/refs/tags/v${GH_VERSION}.tar.gz" -O /tmp/gh.tar.gz \
     && echo "${GH_SOURCE_SHA256}  /tmp/gh.tar.gz" | sha256sum -c - \
     && tar -xzf /tmp/gh.tar.gz -C /tmp \
     && cd "/tmp/cli-${GH_VERSION}" \
+    && go get "google.golang.org/grpc@v${GH_GRPC_VERSION}" \
     && CGO_ENABLED=0 GH_VERSION="${GH_VERSION}" SOURCE_DATE_EPOCH="${GH_SOURCE_DATE_EPOCH}" \
          go run ./script/build.go bin/gh \
+    && go version -m bin/gh | awk -v version="v${GH_GRPC_VERSION}" \
+         '$1 == "dep" && $2 == "google.golang.org/grpc" && $3 == version { found=1 } END { exit !found }' \
     && /tmp/cli-${GH_VERSION}/bin/gh --version
 
 FROM ${BASE_IMAGE} AS one-shot-token-build