Bump gh-aw-mcpg to v0.4.9

[Copilot]

Bumps the pinned gh-aw-mcpg container image from v0.4.8 to v0.4.9 and refreshes the associated digest pins and generated artifacts.

Version bump

• Updated DefaultMCPGatewayVersion constant in pkg/constants/version_constants.go to v0.4.9

Digest pin refresh

• Resolved the new image digest via skopeo inspect and updated ghcr.io/github/gh-aw-mcpg:v0.4.9 entries in:
  • .github/aw/actions-lock.json
  • pkg/actionpins/data/action_pins.json
  • pkg/workflow/data/action_pins.json

Regenerated artifacts

• Recompiled all workflow .lock.yml files (make recompile) so the new pinned image reference propagates through generated workflows

Changeset

• Added a patch changeset documenting the version bump

• Fixes Bump gh-aw-mcpg to v0.4.9 #51687

[Copilot]

Pull request overview

Updates the bundled MCP gateway to v0.4.9 and propagates its refreshed digest through compiled workflows.

Changes:

• Bumps DefaultMCPGatewayVersion to v0.4.9.
• Refreshes all embedded image pins.
• Regenerates affected workflows and adds a patch changeset.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates the default MCP gateway version.
pkg/actionpins/data/action_pins.json	Refreshes the action-pin digest.
pkg/workflow/data/action_pins.json	Refreshes the workflow pin data.
.github/aw/actions-lock.json	Updates the repository action lock.
.changeset/patch-bump-mcpg-v0-4-9.md	Documents the patch release.
.github/workflows/smoke-copilot-sub-agents.lock.yml	Regenerates the workflow with v0.4.9.
.github/workflows/smoke-copilot-small.lock.yml	Regenerates the workflow with v0.4.9.
.github/workflows/smoke-copilot-sdk.lock.yml	Regenerates the workflow with v0.4.9.
.github/workflows/notion-issue-summary.lock.yml	Regenerates the workflow with v0.4.9.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Updates the remote MCP test workflow.
.github/workflows/github-mcp-tools-report.lock.yml	Updates the MCP tools report workflow.
.github/workflows/example-permissions-warning.lock.yml	Refreshes the example workflow.
.github/workflows/example-failure-category-filter.lock.yml	Refreshes the example workflow.
.github/workflows/daily-team-status.lock.yml	Refreshes the daily workflow.
.github/workflows/daily-squid-image-scan.lock.yml	Refreshes the daily workflow.
.github/workflows/daily-max-ai-credits-test.lock.yml	Refreshes the daily test workflow.
.github/workflows/daily-go-test-parallelizer.lock.yml	Refreshes the daily workflow.
.github/workflows/daily-github-docs-seo-optimizer.lock.yml	Refreshes the daily workflow.
.github/workflows/daily-credit-limit-test.lock.yml	Refreshes the daily test workflow.
.github/workflows/daily-byok-ollama-test.lock.yml	Refreshes the daily test workflow.
.github/workflows/copilot-pr-merged-report.lock.yml	Refreshes the report workflow.
.github/workflows/copilot-centralization-optimizer.lock.yml	Refreshes the optimizer workflow.
.github/workflows/copilot-centralization-drilldown.lock.yml	Refreshes the drilldown workflow.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Refreshes the Codex MCP test workflow.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 79/289 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

❌ Design Decision Gate 🏗️ failed during design decision gate check.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

❌ Test Quality Sentinel failed during test quality analysis.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

🧠 Matt Pocock Skills Reviewer failed during the skills-based review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

❌ Ponytail Reviewer failed. Please review the logs for details.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by Ponytail Reviewer for #51796

[pelikhan]

Duplicate of #51754

[Copilot]

Review details

• Files reviewed: 79/289 changed files
• Comments generated: 0 new
• Review effort level: Balanced