feat: bump AWF to v0.25.10 and use lightweight esbuild bundle by Mossaka · Pull Request #23993 · github/gh-aw

Mossaka · 2026-04-02T01:35:18Z

Summary

Bump AWF (Agentic Workflow Firewall) from v0.25.6 to v0.25.10
Switch install script to prefer the lightweight awf-bundle.js (~357KB) over platform-specific pkg binaries (~50MB) when Node.js >= 20 is available
Fall back to pkg binary for self-hosted runners without Node.js >= 20

Motivation

AWF v0.25.10 publishes awf-bundle.js as a release asset -- a single JavaScript file that runs on any system with Node.js >= 20. GitHub hosted runners already have Node.js 22, making the bundled Node.js 18 runtime in pkg binaries redundant. This reduces download size from ~50MB to ~357KB (140x smaller), speeding up workflow setup.

Node.js 18 (bundled in pkg binaries) reached EOL in April 2025.

Changes

pkg/constants/version_constants.go: Version bump v0.25.6 -> v0.25.10
actions/setup/sh/install_awf_binary.sh: Try awf-bundle.js first when Node >= 20 is available, fall back to platform binary otherwise. SHA256 checksum verification preserved for both paths.
Golden test files: Updated to reflect new version in compiled output

Test plan

make test-unit passes (wasm golden tests updated; pre-existing failures in lock file tests and CLI env tests are unrelated)
make fmt passes
make golint-incremental passes with 0 issues
Verify bundle install path works on GitHub hosted runner (CI smoke tests)
Verify fallback to pkg binary when Node < 20

🤖 Generated with Claude Code

✨ PR Review Safe Output Test - Run 23879967654

💥 [THE END] — Illustrated by Smoke Claude · ◷

✨ PR Review Safe Output Test - Run 23880126574

💥 [THE END] — Illustrated by Smoke Claude · ◷

Copilot

Pull request overview

This PR bumps the default gh-aw-firewall (AWF) version to v0.25.10 and updates the AWF installation script to prefer the new lightweight awf-bundle.js release asset when Node.js >= 20 is available, reducing download size on GitHub-hosted runners.

Changes:

Bump AWF default version from v0.25.6 to v0.25.10.
Update install_awf_binary.sh to install awf-bundle.js via a Node wrapper when Node >= 20, otherwise fall back to platform-specific pkg binaries.
Update wasm golden fixtures to reflect the new AWF version and image tags.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
`pkg/constants/version_constants.go`	Updates the default AWF version constant to v0.25.10.
`actions/setup/sh/install_awf_binary.sh`	Adds bundle-first install strategy with checksum verification and binary fallback.
`pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden`	Updates golden output to reference v0.25.10 and updated container image tags.
`pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden`	Updates golden output to reference v0.25.10 and updated container image tags.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-02T01:38:05Z

actions/setup/sh/install_awf_binary.sh

+if has_node_20; then
+  install_bundle
+else
+  echo "Node.js >= 20 not available, falling back to platform binary..."


Bundle install path is attempted solely based on Node.js availability. For versions that don’t publish awf-bundle.js (e.g., callers still passing v0.25.6), curl/checksum lookup will fail under set -e and the script will exit without falling back to the pkg binary. Please make install_bundle a best-effort attempt (e.g., return non-zero on 404/missing checksum) and only commit to bundle mode if download + checksum verification succeeds; otherwise fall back to the platform binary.

Suggested change

if has_node_20; then

install_bundle

else

echo "Node.js >= 20 not available, falling back to platform binary..."

if has_node_20 && install_bundle; then

echo "Bundle installation succeeded; skipping platform-specific binary install."

else

if ! has_node_20; then

echo "Node.js >= 20 not available, falling back to platform binary..."

else

echo "Bundle installation failed, falling back to platform binary..."

fi

Copilot · 2026-04-02T01:38:05Z

actions/setup/sh/install_awf_binary.sh

+  # Create wrapper script
+  sudo tee "${AWF_INSTALL_DIR}/${AWF_INSTALL_NAME}" > /dev/null <<'WRAPPER'
+#!/bin/bash
+exec node /usr/local/lib/awf/awf-bundle.js "$@"


The generated wrapper runs exec node ... via PATH. This is brittle under sudo (many environments enforce secure_path, so root may not be able to find the same node binary) and can also enable PATH hijacking if awf is later executed with elevated privileges. Consider resolving node to an absolute path at install time (and optionally validating it’s not from the workspace), then hardcoding that path in the wrapper and/or setting a minimal safe PATH inside the wrapper before exec.

Suggested change

# Create wrapper script

sudo tee "${AWF_INSTALL_DIR}/${AWF_INSTALL_NAME}" > /dev/null <<'WRAPPER'

#!/bin/bash

exec node /usr/local/lib/awf/awf-bundle.js "$@"

# Resolve absolute Node.js path for wrapper to avoid PATH-based exec

local node_path

node_path="$(command -v node || true)"

if [ -z "${node_path}" ]; then

echo "ERROR: Failed to resolve Node.js path during bundle installation"

exit 1

fi

# Create wrapper script

sudo tee "${AWF_INSTALL_DIR}/${AWF_INSTALL_NAME}" > /dev/null <<WRAPPER

#!/bin/bash

# Use a minimal, safe PATH and invoke Node.js via its absolute path

PATH="/usr/local/bin:/usr/bin"

export PATH

exec ${node_path} /usr/local/lib/awf/awf-bundle.js "\$@"

Copilot · 2026-04-02T01:38:05Z

actions/setup/sh/install_awf_binary.sh

+install_bundle() {
+  local bundle_name="awf-bundle.js"
+  local bundle_url="${BASE_URL}/${bundle_name}"
+
+  echo "Node.js >= 20 detected ($(node --version)), using lightweight bundle..."
+  echo "Downloading bundle from ${bundle_url@Q}..."
+  curl -fsSL --retry 3 --retry-delay 5 -o "${TEMP_DIR}/${bundle_name}" "${bundle_url}"
+


When running on macOS with Node.js >= 20, the script will choose the bundle path and skip the existing Darwin warning about iptables/container firewalling not working natively. Please emit the same warning when OS=Darwin and install_bundle is used so behavior/messages stay consistent.

Good catch! The Darwin warning should definitely be emitted consistently regardless of the install path taken. Adding it to the bundle path ensures users on macOS are aware of the iptables/container firewall limitation. 🍎

📰 BREAKING: Report filed by Smoke Copilot

Switch from ~50MB pkg binaries to ~357KB esbuild single-file bundle (awf-bundle.js) when Node.js >= 20 is available. GitHub hosted runners always have Node.js 22, so the bundle path is always taken. Falls back to platform-specific pkg binary for self-hosted runners without Node.js. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pelikhan · 2026-04-02T01:44:47Z

@copilot Merge main build wasm recompile

The smoke test lock files still referenced v0.25.8, causing install_awf_binary.sh to attempt downloading awf-bundle.js from a release that doesn't have it. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

github-actions · 2026-04-02T01:51:51Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-04-02T01:51:53Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-04-02T01:51:55Z

❌ Tool validation failed! Agent Container Smoke Test detected missing tools: failed

github-actions · 2026-04-02T01:52:17Z

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

github-actions · 2026-04-02T01:53:31Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

If the bundle asset doesn't exist for a given AWF version (e.g., older releases before v0.25.10), gracefully fall back to downloading the platform-specific pkg binary instead of hard-failing. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

github-actions · 2026-04-02T01:58:39Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-04-02T01:58:46Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-04-02T01:58:47Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-04-02T01:58:53Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-04-02T02:01:56Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	4.52.4
curl	✅	8.5.0
gh	✅	2.88.1
node	✅	20.20.1
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.201

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · ◷

github-actions · 2026-04-02T02:05:21Z

Smoke test results for @Mossaka's PR:

Test	Status
GitHub MCP	✅
MCP Scripts GH CLI	✅
Serena MCP	❌
Playwright	❌
Web Fetch	✅
File Writing + Bash	✅
Discussion Interaction	✅
Build gh-aw	✅
Discussion Creation	✅
Workflow Dispatch	✅
PR Review	✅

Overall: ⚠️ PARTIAL PASS (10/12)

📰 BREAKING: Report filed by Smoke Copilot · ◷

github-actions

Smoke test review: PR bumps AWF to v0.25.10 and introduces a lightweight bundle install path. The bundle approach is a great improvement (~140x smaller). Main concern: the wrapper script uses exec node without an absolute path — consider resolving node at install time for robustness. Otherwise the changes look solid.

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-04-02T02:05:26Z

actions/setup/sh/install_awf_binary.sh

+  # Create wrapper script
+  sudo tee "${AWF_INSTALL_DIR}/${AWF_INSTALL_NAME}" > /dev/null <<'WRAPPER'
+#!/bin/bash
+exec node /usr/local/lib/awf/awf-bundle.js "$@"


The wrapper script uses exec node without an absolute path, which relies on PATH being correctly set. Consider resolving node to an absolute path at install time for better robustness, especially in environments with restricted PATH.

github-actions · 2026-04-02T02:05:52Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-04-02T02:09:46Z

Warning

The push_to_pull_request_branch operation failed: Cannot push to pull request branch: patch modifies protected files (.github/smoke-claude-push-test.md). Add them to the allowed-files configuration field or set protected-files: fallback-to-issue to create a review issue instead.. The code changes were not applied.

Smoke Test Results — Run §23879967654

Core: ✅1 ✅2 ✅3 ✅4 ❌5 ✅6 ✅7 ✅8 ✅9 ✅10 ✅11
PR Review: ✅12 ✅13 ✅14 ⚠️15 ✅16 ✅17 ⚠️18

Status: PARTIAL (Playwright ❌, threads/close ⚠️ skipped)

💥 [THE END] — Illustrated by Smoke Claude · ◷

github-actions

💥 Automated smoke test review - all systems nominal! This is an automated review comment from the Claude smoke test run §23879967654.

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-02T02:09:47Z

.github/workflows/ace-editor.lock.yml

          GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
          GH_AW_INFO_FIREWALL_ENABLED: "true"
-          GH_AW_INFO_AWF_VERSION: "v0.25.8"
+          GH_AW_INFO_AWF_VERSION: "v0.25.10"


✅ Version bump from v0.25.8 → v0.25.10 looks correct here. The AWF version env var is consistently updated across all lock files in this PR.

github-actions · 2026-04-02T02:09:47Z

.github/workflows/ace-editor.lock.yml

        run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest
      - name: Install AWF binary
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.8
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.10


✅ Install AWF binary step updated to v0.25.10 — consistent with the esbuild bundle approach introduced in this PR.

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-02T02:15:12Z

.github/workflows/ace-editor.lock.yml

          GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
          GH_AW_INFO_FIREWALL_ENABLED: "true"
-          GH_AW_INFO_AWF_VERSION: "v0.25.8"
+          GH_AW_INFO_AWF_VERSION: "v0.25.10"


Smoke test review comment #1: Version bump from v0.25.8 → v0.25.10 looks correct. Consider adding a changelog entry or release notes reference for traceability.

github-actions · 2026-04-02T02:15:13Z

.github/workflows/ace-editor.lock.yml

        run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest
      - name: Install AWF binary
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.8
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.10


Smoke test review comment #2: AWF binary install step updated to v0.25.10. Consistent with the version env var above — good alignment across install and runtime config.

albokynk · 2026-04-02T02:23:48Z

[email protected]

Copilot AI review requested due to automatic review settings April 2, 2026 01:35

Copilot started reviewing on behalf of Mossaka April 2, 2026 01:36 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Mossaka force-pushed the feat/awf-v0.25.10-bundle branch from 5e05fe1 to 06702ce Compare April 2, 2026 01:44

Copilot started work on behalf of pelikhan April 2, 2026 01:44 View session

This was referenced Apr 2, 2026

[aw] Smoke Copilot failed #23994

Open

[aw] Smoke Claude failed #23995

Open

Mossaka added the smoke label Apr 2, 2026

fix: recompile smoke workflow lock files for AWF v0.25.10

ee601b8

The smoke test lock files still referenced v0.25.8, causing install_awf_binary.sh to attempt downloading awf-bundle.js from a release that doesn't have it. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

github-actions bot removed the smoke label Apr 2, 2026

chore: recompile all workflows for AWF v0.25.10

e9f4cd1

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Mossaka added the smoke label Apr 2, 2026

github-actions bot removed the smoke label Apr 2, 2026

Copilot stopped work on behalf of pelikhan due to an error April 2, 2026 02:00
The job was not acquired by a runner even after multiple attempts.

Copilot AI requested a review from pelikhan April 2, 2026 02:00

github-actions bot mentioned this pull request Apr 2, 2026

Smoke Test: Copilot - 23879967631 #23997

Closed

github-actions bot added the smoke-copilot label Apr 2, 2026

github-actions bot reviewed Apr 2, 2026

View reviewed changes

github-actions bot mentioned this pull request Apr 2, 2026

Smoke Test: Claude - 23879967654 #23999

Closed

github-actions bot reviewed Apr 2, 2026

View reviewed changes

This was referenced Apr 2, 2026

Smoke Test: Copilot - 23880127286 #24000

Closed

Smoke Test: Claude - 23880126574 #24002

Closed

github-actions bot reviewed Apr 2, 2026

View reviewed changes

pelikhan merged commit a33929a into main Apr 2, 2026
244 of 249 checks passed

pelikhan deleted the feat/awf-v0.25.10-bundle branch April 2, 2026 02:43

-  # Create wrapper script
-  sudo tee "${AWF_INSTALL_DIR}/${AWF_INSTALL_NAME}" > /dev/null <<'WRAPPER'
-#!/bin/bash
-exec node /usr/local/lib/awf/awf-bundle.js "$@"
+  # Resolve absolute Node.js path for wrapper to avoid PATH-based exec
+  local node_path
+  node_path="$(command -v node || true)"
+  if [ -z "${node_path}" ]; then
+    echo "ERROR: Failed to resolve Node.js path during bundle installation"
+    exit 1
+  fi
+  # Create wrapper script
+  sudo tee "${AWF_INSTALL_DIR}/${AWF_INSTALL_NAME}" > /dev/null <<WRAPPER
+#!/bin/bash
+# Use a minimal, safe PATH and invoke Node.js via its absolute path
+PATH="/usr/local/bin:/usr/bin"
+export PATH
+exec ${node_path} /usr/local/lib/awf/awf-bundle.js "\$@"

Conversation

Mossaka commented Apr 2, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 2, 2026

Choose a reason for hiding this comment

Mossaka commented Apr 2, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading