Bump gh-aw-firewall to v0.28.1

[lpcox]

Summary

• bump DefaultFirewallVersion from v0.27.44 to v0.28.1
• add the four v0.28.1 AWF container digests from the release manifest to the embedded pin caches
• regenerate all workflow lock files and add a patch changeset

Upstream review

v0.28.1 completes the Cloud Hypervisor preview runtime by adding virtiofsd support and otherwise contains refactoring and CI changes. The release adds cloudHypervisor.sha256.virtiofsd to the AWF config schema and CLI mapping; gh-aw already emits the corresponding --cloud-hypervisor-virtiofsd-sha256 argument. Existing AWF*MinVersion gates remain correct, including AWFCloudHypervisorMinVersion = v0.28.0, so no new gate is required.

The broader v0.27.44 → v0.28.x config transition to unified enclaves and the Cloud Hypervisor runtime was also reviewed. Both integrations are already present on main.

Validation

• make build
• make recompile
• make recompile
• focused AWF/firewall tests
• make agent-report-progress

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.2 AIC · ⌖ 6.86 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/31767348894> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.3 AIC · ⌖ 5.78 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

[Copilot]

Pull request overview

Bumps the default AWF release from v0.27.44 to v0.28.1 and regenerates dependent pins and workflows.

Changes:

• Updates DefaultFirewallVersion.
• Adds v0.28.1 container digests to pin caches.
• Regenerates workflow locks and adds a patch changeset.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates the default AWF version.
pkg/actionpins/data/action_pins.json	Adds v0.28.1 image pins.
pkg/workflow/data/action_pins.json	Adds embedded v0.28.1 pins.
.github/aw/actions-lock.json	Adds compiler action pins.
.github/workflows/smoke-crush.lock.yml	Regenerates Crush smoke workflow.
.github/workflows/smoke-ci.lock.yml	Regenerates CI smoke workflow.
.github/workflows/notion-issue-summary.lock.yml	Regenerates Notion workflow.
.github/workflows/hippo-embed.lock.yml	Regenerates Hippo workflow.
.github/workflows/firewall.lock.yml	Regenerates firewall test workflow.
.github/workflows/example-permissions-warning.lock.yml	Regenerates permissions example.
.github/workflows/daily-arxiv-researcher.lock.yml	Regenerates research workflow.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerates Codex MCP test.
.changeset/patch-bump-awf-v0-28-1.md	Records the patch release change.

Review details

• Files reviewed: 21/290 changed files
• Comments generated: 1
• Review effort level: Balanced

[gh-aw-bot]

@copilot Please resolve the blocking review feedback on this PR, refresh the branch if needed, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (newest first):

• copilot-pull-request-reviewer: Bump gh-aw-firewall to v0.28.1 #52607 (comment)

Failed checks from the compact candidate set:

• Unit tests (A-C): https://github.com/github/gh-aw/actions/runs/31762378695/job/94651895183

Branch update was requested automatically for this run.
Run: https://github.com/github/gh-aw/actions/runs/31764752441

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 16.2 AIC · ⌖ 6.86 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please resolve the blocking review feedback on this PR, refresh the branch if needed, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (ne...

Addressed the blocking review feedback in commit e12b6c95b7: raised AWFCloudHypervisorMinVersion to v0.28.1, updated associated cloud-hypervisor tests, and fixed sorted container key order in .github/aw/actions-lock.json (plus synced pin caches). I also investigated the failed Unit tests (A-C) log and fixed the root cause reported there (TestActionsLockJSONFieldsAreSorted).

[gh-aw-bot]

@copilot Please resolve the blocking review feedback on this PR, refresh the branch if needed, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (newest first):

• copilot-pull-request-reviewer: Bump gh-aw-firewall to v0.28.1 #52607 (comment)

Branch update was requested automatically for this run.
Run: https://github.com/github/gh-aw/actions/runs/31767348894

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.3 AIC · ⌖ 5.78 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please resolve the blocking review feedback on this PR, refresh the branch if needed, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (ne...

Blocking review feedback was addressed in e12b6c9 (raised AWFCloudHypervisorMinVersion to v0.28.1 and updated cloud-hypervisor tests). The branch was refreshed in 6510b18, and I revalidated locally (make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, make recompile) with passing results.

[lpcox]

@copilot resolve conflicts, merge main, and recompile workflows

[Copilot]

@copilot resolve conflicts, merge main, and recompile workflows

Done in 8f6dc0f: merged main into this branch, resolved the workflow lockfile conflicts, and recompiled workflows. I also made follow-up ADR wording cleanups in ce26027 to satisfy automated review.