Bump default CLI/tool versions (Claude, Copilot, Codex, GitHub MCP) and recompile lockfiles by Copilot · Pull Request #26810 · github/gh-aw

Copilot · 2026-04-17T04:54:26Z

This updates the default pinned versions for four CLI/tool dependencies and propagates them through generated workflow artifacts. It also advances GitHub MCP Server to v1.0.0 and refreshes generated outputs accordingly.

Core version constants
- Updated /pkg/constants/version_constants.go:
  - DefaultClaudeCodeVersion: 2.1.98 → 2.1.112
  - DefaultCopilotVersion: 1.0.21 → 1.0.31
  - DefaultCodexVersion: 0.118.0 → 0.121.0
  - DefaultGitHubMCPServerVersion: v0.32.0 → v1.0.0
Generated workflow artifacts
- Recompiled all workflow lockfiles under /.github/workflows/*.lock.yml so compiled workflows consume the new versions.
- This includes updated Docker image refs for GitHub MCP Server (ghcr.io/github/github-mcp-server:v1.0.0) and updated CLI install versions.
Golden fixtures aligned with compiler output
- Updated wasm golden fixtures impacted by version-string changes:
  - /pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden
  - /pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden
Release note entry
- Added changeset: /.changeset/patch-update-cli-tool-versions-20260417.md
Follow-up from PR feedback
- Merged latest origin/main into this branch.
- Resolved merge conflicts in regenerated workflow lockfiles.
- Re-ran build/recompile after merge to keep generated artifacts current.

const DefaultClaudeCodeVersion Version = "2.1.112"
const DefaultCopilotVersion Version = "1.0.31"
const DefaultCodexVersion Version = "0.121.0"
const DefaultGitHubMCPServerVersion Version = "v1.0.0"

> [!WARNING]
>
>

✨ PR Review Safe Output Test - Run 24572008825

💥 [THE END] — Illustrated by Smoke Claude · ● 178K · ◷

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fdedf6f6-4060-47ef-8b23-7fe24fa9d482 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR bumps the repo’s default pinned versions for several AI CLIs/tools (Claude Code, GitHub Copilot CLI, Codex) and the GitHub MCP Server image, then regenerates workflow lock artifacts and golden fixtures so generated outputs reflect the new version strings.

Changes:

Updated Go version constants for default tool versions (including GitHub MCP Server v1.0.0).
Regenerated /.github/workflows/*.lock.yml artifacts and updated wasm golden fixtures to match the compiler output.
Added a changeset documenting the patch release.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Bumps default pinned tool versions used by workflow compilation.
pkg/constants/README.md	Updates documented example Copilot CLI version value.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden	Updates golden fixture version strings and MCP server image tag.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden	Updates golden fixture version strings and MCP server image tag.
.github/workflows/workflow-health-manager.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/workflow-generator.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/video-analyzer.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/test-workflow.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/test-quality-sentinel.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/test-dispatcher.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/smoke-workflow-call.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/smoke-opencode.lock.yml	Regenerated locked workflow to consume updated MCP server tag.
.github/workflows/smoke-gemini.lock.yml	Regenerated locked workflow to consume updated MCP server tag.
.github/workflows/security-compliance.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/schema-feature-coverage.lock.yml	Regenerated locked workflow to consume updated Codex version.
.github/workflows/schema-consistency-checker.lock.yml	Regenerated locked workflow to consume updated Claude Code version.
.github/workflows/research.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/repo-tree-map.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/refiner.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/plan.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/metrics-collector.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/mergefest.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerated locked workflow to consume updated Copilot CLI version.
.github/workflows/github-mcp-tools-report.lock.yml	Regenerated locked workflow to consume updated Claude Code version.
.github/workflows/firewall.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/example-permissions-warning.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/draft-pr-cleanup.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/discussion-task-miner.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/dictation-prompt.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/dev.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/dependabot-go-checker.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/dependabot-burner.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/delight.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/craft.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerated locked workflow to consume updated Copilot CLI version.
.github/workflows/copilot-cli-deep-research.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/contribution-check.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerated locked workflow to consume updated Codex version.
.github/workflows/cli-consistency-checker.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/breaking-change-checker.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/bot-detection.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/auto-triage-issues.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/artifacts-summary.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/architecture-guardian.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.github/workflows/ace-editor.lock.yml	Regenerated locked workflow to consume updated CLI versions and MCP server tag.
.changeset/patch-update-cli-tool-versions-20260417.md	Adds release note entry describing the version bumps and regeneration.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 154/199 changed files
Comments generated: 0

pelikhan · 2026-04-17T14:43:37Z

@copilot merge main and recompile

…ol-versions # Conflicts: # .github/workflows/aw-failure-investigator.lock.yml # .github/workflows/daily-aw-cross-repo-compile-check.lock.yml # .github/workflows/smoke-crush.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-17T14:58:18Z

@copilot merge main and recompile

Merged origin/main, resolved the lockfile conflicts, and recompiled workflows (make build && make recompile). Addressed in commit efcd175.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/go/pkg/mod/charm.land/bubbletea/v2@v2.0.6/clipboard.go /home/REDACTED/go/pkg/mod/charm.land/bubbletea/v2@v2.0.6/color.go (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/go/pkg/mod/charm.land/bubbles/v2@v2.1.0/help/help.go (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-04-17T15:05:16Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-04-17T15:05:17Z

⚠️ Smoke Crush failed. Crush encountered unexpected challenges...

github-actions · 2026-04-17T15:05:18Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-04-17T15:05:18Z

⚠️ Smoke Gemini failed. Gemini encountered unexpected challenges...

github-actions · 2026-04-17T15:05:21Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-04-17T15:09:58Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	v4.52.5
curl	✅	8.5.0
gh	✅	2.89.0
node	✅	v20.20.2
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.201

Result: 12/12 tools available ✅ PASS

🔧 Tool validation by Agent Container Smoke Test · ● 721.4K · ◷

github-actions · 2026-04-17T15:13:11Z

Smoke Test Results — Run §24572008825

Status: PARTIAL (1 failed, 2 skipped)

Test	Result
1 GitHub MCP	✅
2 GH CLI Scripts	✅
3 Serena MCP	✅
4 Make Build	✅
5 Playwright	✅
6 Tavily Search	✅
7 File Writing	✅
8 Bash Tool	✅
9 Discussion Interaction	✅
10 Agentic Workflows MCP	❌ Tool error
11 Slack Safe Output	✅
12 Code Scanning Alert	✅
13 Update PR	✅
14 PR Review Comments	✅
15 Submit PR Review	✅
16 Resolve Review Thread	⚠️ No threads
17 Add Reviewer	✅
18 Push to PR Branch	✅
19 Close PR	⚠️ Skipped

💥 [THE END] — Illustrated by Smoke Claude · ● 178K · ◷

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude · ● 178K

github-actions · 2026-04-17T15:13:13Z

@@ -0,0 +1,5 @@
+---
+"gh-aw": patch


✅ The changeset type patch is appropriate here since these are dependency version bumps without API-breaking changes.

github-actions · 2026-04-17T15:13:13Z

+"gh-aw": patch
+---
+
+Update default CLI/tool versions: Claude Code `2.1.112`, Copilot CLI `1.0.31`, Codex `0.121.0`, and GitHub MCP Server `v1.0.0`; then recompile workflow lock files so generated workflows consume the new versions.


💡 Suggestion: The changeset description is clear and concise. Consider also noting that github-mcp-server jumped from v0.32.0 → v1.0.0, which is a major semver bump and may warrant extra attention from reviewers.

Agreed! The major semver jump from v0.32.0 → v1.0.0 is definitely worth highlighting. Reviewers should check the GitHub MCP Server changelog for any breaking changes before merging.

📰 BREAKING: Report filed by Smoke Copilot · ● 2M

github-actions · 2026-04-17T15:18:18Z

🤖 beep boop — The Copilot smoke test agent was here! Running diagnostics at 2026-04-17T15:14:37Z... all systems nominal. 🚀✨

📰 BREAKING: Report filed by Smoke Copilot · ● 2M · ◷

github-actions · 2026-04-17T15:18:31Z

✅ Smoke test run §24572008874 completed.

PR: Bump default CLI/tool versions (Claude, Copilot, Codex, GitHub MCP) and recompile lockfiles
Author: @Copilot | Assignees: @pelikhan, @Copilot

Test	Result
GitHub MCP Testing	✅
MCP Scripts GH CLI	❌
Serena CLI	✅ (partial)
Playwright	✅
Web Fetch	✅
File Writing	✅
Bash Tool	✅
Discussion Interaction	✅
Build gh-aw	✅
Upload Artifact	✅
Discussion Creation	✅
Workflow Dispatch	✅
PR Review	✅

Overall: PASS ⚠️ (1 tool unavailable, 1 partial)

📰 BREAKING: Report filed by Smoke Copilot · ● 2M · ◷

github-actions

Reviewed the version bump PR. Two inline observations: (1) the GitHub MCP Server major version bump deserves explicit reviewer attention, and (2) the new unpinned image tag may benefit from a digest pin for supply chain security. Overall this looks like a clean and well-organized version update.

📰 BREAKING: Report filed by Smoke Copilot · ● 2M

github-actions · 2026-04-17T15:18:31Z

+"gh-aw": patch
+---
+
+Update default CLI/tool versions: Claude Code `2.1.112`, Copilot CLI `1.0.31`, Codex `0.121.0`, and GitHub MCP Server `v1.0.0`; then recompile workflow lock files so generated workflows consume the new versions.


✅ Good changeset description! Note: the GitHub MCP Server jump from v0.32.0 → v1.0.0 is a major semver bump — worth calling out for reviewers since it may include breaking changes.

github-actions · 2026-04-17T15:18:31Z

@@ -1,5 +1,5 @@
 # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"8955ee270578c68e1b90ccda262a02f9b608013552d51884c06a20f9fdbd98ed","agent_id":"copilot"}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.23"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.23"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.23"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.22"},{"image":"ghcr.io/github/github-mcp-server:v0.32.0","digest":"sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28","pinned_image":"ghcr.io/github/github-mcp-server:v0.32.0@sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28"}]}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.23"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.23"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.23"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.22"},{"image":"ghcr.io/github/github-mcp-server:v1.0.0"}]}


The pinned digest for github-mcp-server:v0.32.0 has been removed in favor of an unpinned v1.0.0 tag. Consider pinning the new image to a specific digest for deterministic builds and supply chain security.

github-actions · 2026-04-17T15:18:49Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Initial plan

6480073

Copilot AI assigned Copilot and pelikhan Apr 17, 2026

Copilot started work on behalf of pelikhan April 17, 2026 04:54 View session

Copilot AI linked an issue Apr 17, 2026 that may be closed by this pull request

[ca] Update CLI tool versions: Claude Code, Copilot CLI, Codex, GitHub MCP Server #26803

Closed

Copilot AI and others added 2 commits April 17, 2026 04:58

chore: outline plan for CLI version bump issue

02375cd

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fdedf6f6-4060-47ef-8b23-7fe24fa9d482 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

chore: bump default CLI tool versions and recompile workflows

2932e4b

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fdedf6f6-4060-47ef-8b23-7fe24fa9d482 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update CLI tool versions for Claude Code, Copilot CLI, Codex, and GitHub MCP Server~~ Bump default CLI/tool versions (Claude, Copilot, Codex, GitHub MCP) and recompile lockfiles Apr 17, 2026

Copilot AI requested a review from pelikhan April 17, 2026 05:41

Copilot finished work on behalf of pelikhan April 17, 2026 05:41

github-actions bot mentioned this pull request Apr 17, 2026

[aw] No-Op Runs #26814

Open

pelikhan marked this pull request as ready for review April 17, 2026 14:23

Copilot AI review requested due to automatic review settings April 17, 2026 14:23

pelikhan added the smoke label Apr 17, 2026

Copilot started reviewing on behalf of pelikhan April 17, 2026 14:24 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 17, 2026 14:43 View session

Copilot finished work on behalf of pelikhan April 17, 2026 15:00

pelikhan added smoke and removed smoke labels Apr 17, 2026

github-actions bot removed the smoke label Apr 17, 2026

github-actions bot mentioned this pull request Apr 17, 2026

Smoke Test: Claude - 24572008825 #26899

Closed

github-actions bot reviewed Apr 17, 2026

View reviewed changes

pelikhan merged commit 40a6deb into main Apr 17, 2026
159 of 163 checks passed

pelikhan deleted the copilot/update-cli-tool-versions branch April 17, 2026 15:40

Conversation

Copilot AI commented Apr 17, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

pelikhan commented Apr 17, 2026

Uh oh!

Copilot AI commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

github-actions bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 17, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Apr 17, 2026

Smoke Test Results — Run §24572008825

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 17, 2026 •

edited by github-actions bot

Loading

Copilot AI commented Apr 17, 2026 •

edited

Loading

github-actions bot commented Apr 17, 2026 •

edited

Loading

github-actions bot commented Apr 17, 2026 •

edited

Loading

github-actions bot commented Apr 17, 2026 •

edited

Loading

github-actions bot commented Apr 17, 2026 •

edited

Loading