[lpcox]

Summary

Upgraded the repository with the latest available gh-aw pre-release (v1.0.1) and recompiled all agentic workflows.

Changes

• Ran gh aw upgrade --pre-releases
• Updated astral-sh/setup-uv from v10.3.2 to v10.3.3 in .github/aw/actions-lock.json
• Recompiled all 34 workflows successfully
• No workflow source or generated lockfile changes were required

Relevant upstream changes

The current gh-aw changelog includes stricter pull_request_target fork admission, checksum-manifest pinning for downloaded runtimes, grader isolation changes, and work-queue configuration migration. The repository workflows compiled without migration errors.

Validation

• gh aw upgrade --pre-releases — 34/34 workflows compiled successfully
• make agent-finished — passed (format, build, lint, Go tests, and Rust guard tests)

[Copilot]

🟢 Approval recommended

No active review issues remain for the setup-uv version and commit-pin update.

No open issues 🎉

What changed in this PR

Refreshes the action dependency lock used by the repository’s gh-aw workflows following the pre-release upgrade.

Changes:

• Updates astral-sh/setup-uv from v10.3.2 to v10.3.3, including its pinned commit SHA.
• Leaves workflow sources and generated workflow lockfiles unchanged after recompilation.

File	Description
.github/​aw/​actions-lock.json	Updates the setup-uv version and commit pin.

_{Review effort: Max (auto)}

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request)	all 7 targets absent from the 23-tool catalog (unknown tool -32602)	BLOCKED	⚠️
C	CLI	reads via proxied github CLI	data returned	ALLOWED	✅
D	CLI	REST writes	gh CLI not authenticated (gh auth status: not logged in)	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh CLI not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part B: none of the 7 targeted write tools appear in the backend catalog at all (gh-aw always launches the GitHub MCP backend with GITHUB_READ_ONLY=1), so refusals only prove backend/toolset configuration, not mcpg's own gateway-level DIFC/guard enforcement. No write leaked.
• Part D/E: gh is unauthenticated in this environment, so the token-scope write-boundary could not be exercised. No write leaked.
• No issue created — overall result is INCONCLUSIVE, not FAIL, so per spec the pass-label is withheld and no regression issue is filed.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime