Upgrade workflows with latest gh-aw pre-release

[lpcox]

Summary

• ran gh aw upgrade --pre-releases with gh-aw v0.89.21
• recompiled all 36 agentic workflows successfully
• updated ruby/setup-ruby from v1.326.0 to v1.327.0 in the actions lock

Validation

• gh aw compile (36 succeeded; existing warnings remain)
• make agent-finished

[Copilot]

Copilot review overview

🟢 Approval recommended

The lock entry is valid, internally consistent, and its SHA matches the upstream v1.327.0 tag.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the agentic workflow actions lock after upgrading to gh-aw v0.89.21.

Changes:

• Bumps ruby/setup-ruby from v1.326.0 to v1.327.0 with the correct commit SHA.

File	Description
.github/​aw/​actions-lock.json	Updates the pinned setup-ruby action version and SHA.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from 23-tool catalog (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request all unknown commands)	BLOCKED	⚠️
C	CLI	reads	data returned (github CLI proxy)	ALLOWED	✅
D	CLI	REST writes	not attempted — gh CLI unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations	not attempted — gh CLI unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

(⚠️ = a targeted tool was absent from the catalog, so gateway-level enforcement could not be independently confirmed beyond backend read-only config; and gh was unauthenticated in this environment, so Parts D/E could not exercise the token-scope boundary. No write leaked on any surface.)

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads	data	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part A/C: all reads (list_issues, list_pull_requests, get_file_contents, list_commits) returned data on both the MCP and proxied-CLI surfaces.
• Part B: none of add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request appear in the exposed tool catalog (only 23 read-only tools registered). This confirms gh-aw's GITHUB_READ_ONLY=1 backend config but does not independently exercise mcpg's own gateway-level write-blocking layer for this run.
• Part D/E: gh auth status shows no authenticated host (GH_TOKEN not set in this job), so REST/GraphQL write attempts could not be issued to test the token-scope boundary.
• No write of any kind leaked through either surface in this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime