Remove vulnerable cli-proxy:0.27.42 container pin from shared action lock data

[Copilot]

The daily container image scan reported high-severity findings for ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42. This change removes that vulnerable pinned image reference from the repository’s shared action/container pin data so workflows no longer resolve it from lock metadata.

• Lock-source update

  • Removed the ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42 container entry from .github/aw/actions-lock.json (source of truth).

• Mirror sync

  • Propagated the same removal to generated mirrors:
    • pkg/actionpins/data/action_pins.json
    • pkg/workflow/data/action_pins.json

• Resulting behavior

  • 0.27.42 remains available for other AWF images in lock data, but cli-proxy:0.27.42 is no longer pin-resolvable through these manifests.

// removed from containers map
"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42": {
  "image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42",
  "digest": "sha256:da006bf96d2d246dd269d57b233c1798d2ad63d6cd64ca02f7bf71045028781f",
  "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42@sha256:da006bf96d2d246dd269d57b233c1798d2ad63d6cd64ca02f7bf71045028781f"
}

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42 #49086

[github-actions]

🔍 Triage Summary

Field	Value
Category	chore
Risk	low
Priority	medium
Score	55/100 (impact 25 + urgency 25 + quality 5)
Recommended action	fast_track
Batch	container-security

Removes vulnerable cli-proxy:0.27.42 pin. Small, low-risk security fix. Draft, no CI yet.

Automated triage — see the triage report for full context.

Generated by 🔧 PR Triage Agent · auto · 40.3 AIC · ⌖ 4.01 AIC · ⊞ 8K · ◷

[Copilot]

Pull request overview

Removes the vulnerable cli-proxy:0.27.42 pin from shared lock metadata and embedded mirrors.

Changes:

• Removes the affected container pin from the source manifest.
• Synchronizes both embedded pin manifests.
• Includes unrelated generated workflow timeout changes that conflict with the source workflow.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Removes the vulnerable source pin.
pkg/actionpins/data/action_pins.json	Synchronizes embedded action-pin data.
pkg/workflow/data/action_pins.json	Synchronizes embedded workflow pin data.
.github/workflows/smoke-checkout-pr-dispatch.lock.yml	Contains unrelated timeout drift.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Suppressed comments (3)

.github/workflows/smoke-checkout-pr-dispatch.lock.yml:930

• This generated timeout environment value no longer matches the source workflow's 10-minute timeout. Keeping it at 20 makes the runtime receive a different limit and leaves the lock file out of sync with its .md source; restore the generated value.

          GH_AW_TIMEOUT_MINUTES: 20

.github/workflows/smoke-checkout-pr-dispatch.lock.yml:1536

• The detection execution timeout was also changed only in the generated lock file, while .github/workflows/smoke-checkout-pr-dispatch.md:43 remains at 10 minutes. This unrelated generated drift should be reverted so recompilation is stable.

        timeout-minutes: 20

.github/workflows/smoke-checkout-pr-dispatch.lock.yml:1583

• This detection-phase environment value is another generated 20-minute timeout that conflicts with the unchanged 10-minute source setting. Restore it to keep the compiled workflow internally consistent with its source.

          GH_AW_TIMEOUT_MINUTES: 20

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.3