Pin Serena MCP image to remediated SHA tag and propagate digest across workflow artifacts

[Copilot]

The security scan flagged ghcr.io/github/serena-mcp-server:latest as a high-risk image with concentrated Critical/High findings. This change removes the mutable/vulnerable latest reference from workflow sources and compiled artifacts, and pins Serena to a newer immutable image digest.

• Workflow source update

  • Updated shared Serena MCP definition to use ghcr.io/github/serena-mcp-server:sha-2491b68 instead of :latest.
  • File: .github/workflows/shared/mcp/serena.md

• Container pin cache refresh

  • Replaced Serena container entry in .github/aw/actions-lock.json with:
    • image: ghcr.io/github/serena-mcp-server:sha-2491b68
    • digest: sha256:2fc3fab11db8baca5b4fa760ec52f1010425c97edc8bf4c6437f0cdabd17fcb7
  • Synced embedded pin mirrors:
    • pkg/actionpins/data/action_pins.json
    • pkg/workflow/data/action_pins.json

• Compiled workflow + golden artifact alignment

  • Recompiled affected .lock.yml outputs so manifests/download steps now reference the new Serena tag+digest.
  • Updated impacted wasm golden fixtures that encode container references.

# before
container: "ghcr.io/github/serena-mcp-server:latest"

# after
container: "ghcr.io/github/serena-mcp-server:sha-2491b68"

• Fixes [container-image-scan] Container findings for serena-mcp-server:latest #49297

[github-actions]

🔍 Triage Summary

Field	Value
Category	chore
Risk	medium
Priority	high
Score	60/100 (impact 30 + urgency 25 + quality 5)
Recommended action	fast_track
Batch	container-security

Pins Serena MCP image to remediated SHA + propagates digest. Draft, no CI yet.

Automated triage — see the triage report for full context.

Generated by 🔧 PR Triage Agent · auto · 40.3 AIC · ⌖ 4.01 AIC · ⊞ 8K · ◷

[Copilot]

Pull request overview

Pins Serena MCP to the remediated SHA tag and propagates its digest through caches, compiled workflows, and golden fixtures.

Changes:

• Replaces Serena’s mutable latest tag with sha-2491b68.
• Synchronizes the new digest across pin caches and generated artifacts.
• Includes an unrelated timeout increase in smoke-checkout-pr-dispatch.lock.yml that requires reverting.

Show a summary per file

File	Description
pkg/workflow/testdata/wasm_golden/WasmBinary/smoke-copilot.golden	Updates WASM golden references.
pkg/workflow/testdata/wasm_golden/fixtures/shared/mcp/serena.md	Updates fixture source image.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Updates compiled golden references.
pkg/workflow/data/action_pins.json	Refreshes embedded workflow pin.
pkg/actionpins/data/action_pins.json	Refreshes action-pin data.
.github/workflows/typist.lock.yml	Propagates the Serena pin.
.github/workflows/terminal-stylist.lock.yml	Propagates the Serena pin.
.github/workflows/spec-librarian.lock.yml	Propagates the Serena pin.
.github/workflows/smoke-copilot.lock.yml	Propagates the Serena pin.
.github/workflows/smoke-copilot-arm.lock.yml	Propagates the Serena pin.
.github/workflows/smoke-copilot-aoai-apikey.lock.yml	Propagates the Serena pin.
.github/workflows/smoke-checkout-pr-dispatch.lock.yml	Unrelatedly doubles generated timeouts.
.github/workflows/shared/mcp/serena.md	Pins the shared Serena source.
.github/workflows/sergo.lock.yml	Propagates the Serena pin.
.github/workflows/semantic-function-refactor.lock.yml	Propagates the Serena pin.
.github/workflows/linter-miner.lock.yml	Propagates the Serena pin.
.github/workflows/go-fan.lock.yml	Propagates the Serena pin.
.github/workflows/glossary-maintainer.lock.yml	Propagates the Serena pin.
.github/workflows/developer-docs-consolidator.lock.yml	Propagates the Serena pin.
.github/workflows/daily-testify-uber-super-expert.lock.yml	Propagates the Serena pin.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Propagates the Serena pin.
.github/workflows/daily-file-diet.lock.yml	Propagates the Serena pin.
.github/workflows/daily-compiler-quality.lock.yml	Propagates the Serena pin.
.github/workflows/archie.lock.yml	Propagates the Serena pin.
.github/aw/actions-lock.json	Updates the canonical image digest cache.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 32/32 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.3