Update gh-aw-threat-detection to v0.3.0

[Copilot]

Bump the pinned gh-aw-threat-detection binary from v0.2.2 to v0.3.0. The version is a single source constant that flows into all detection workflow lock files at compile time.

Changes

• pkg/constants/version_constants.go — updated DefaultThreatDetectVersion from v0.2.2 to v0.3.0:

  const DefaultThreatDetectVersion Version = "v0.3.0"

• Recompiled workflows — make recompile propagated the new pin (install_threat_detect_binary.sh v0.3.0) into 89 .lock.yml files. No lock files were hand-edited.

Notes

• Verified the v0.3.0 release and its runtime assets (checksums.txt, threat-detect-linux-amd64, threat-detect-linux-arm64) exist in github/gh-aw-threat-detection before pinning, since the install script fetches them from GitHub Releases at runtime.
• The isolation test (threat_detection_isolation_test.go) reads the constant dynamically, so it validates the new pin without edits.
• One incidental change: smoke-call-workflow.lock.yml had stale imported permissions (actions: write); recompile synchronized it to actions: read to match its source workflow smoke-workflow-call.lock.yml.

• Fixes Update gh-aw-threat-detection to v0.3.0 #47148

---

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 20.4 AIC · ⌖ 8.66 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

---

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 12.8 AIC · ⌖ 6.96 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

---

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 11.8 AIC · ⌖ 10.8 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/29883079375

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 8.98 AIC · ⌖ 8.2 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel analysis skipped. PR #47149 only updates gh-aw-threat-detection version constraints in lock.yml files and version constants.

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #47149 does not have the 'implementation' label and has only 1 new line of code in business logic directories (threshold: 100).

[Copilot]

Pull request overview

Updates the default gh-aw-threat-detection binary from v0.2.2 to v0.3.0 and propagates the pin through generated workflows. The v0.3.0 release and required assets exist.

Changes:

• Updates the single source version constant.
• Recompiles 89 threat-detection workflow lock files.
• Synchronizes a reusable workflow permission from actions: write to actions: read.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Pins threat detection to v0.3.0.
.github/workflows/typist.lock.yml	Propagates v0.3.0.
.github/workflows/test-quality-sentinel.lock.yml	Propagates v0.3.0.
.github/workflows/smoke-call-workflow.lock.yml	Synchronizes imported permissions.
.github/workflows/prompt-clustering-analysis.lock.yml	Propagates v0.3.0.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Propagates v0.3.0.
.github/workflows/github-mcp-structural-analysis.lock.yml	Propagates v0.3.0.
.github/workflows/example-workflow-analyzer.lock.yml	Propagates v0.3.0.
.github/workflows/duplicate-code-detector.lock.yml	Propagates v0.3.0.
.github/workflows/docs-noob-tester.lock.yml	Propagates v0.3.0.
.github/workflows/detection-analysis-report.lock.yml	Propagates v0.3.0.
.github/workflows/daily-token-consumption-report.lock.yml	Propagates v0.3.0.
.github/workflows/daily-testify-uber-super-expert.lock.yml	Propagates v0.3.0.
.github/workflows/daily-repo-chronicle.lock.yml	Propagates v0.3.0.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Propagates v0.3.0.
.github/workflows/daily-reliability-review.lock.yml	Propagates v0.3.0.
.github/workflows/daily-performance-summary.lock.yml	Propagates v0.3.0.
.github/workflows/daily-observability-report.lock.yml	Propagates v0.3.0.
.github/workflows/daily-news.lock.yml	Propagates v0.3.0.
.github/workflows/daily-multi-device-docs-tester.lock.yml	Propagates v0.3.0.
.github/workflows/daily-model-resolution.lock.yml	Propagates v0.3.0.
.github/workflows/daily-model-inventory.lock.yml	Propagates v0.3.0.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Propagates v0.3.0.
.github/workflows/daily-max-ai-credits-test.lock.yml	Propagates v0.3.0.
.github/workflows/daily-issues-report.lock.yml	Propagates v0.3.0.
.github/workflows/daily-hippo-learn.lock.yml	Propagates v0.3.0.
.github/workflows/daily-geo-optimizer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-function-namer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-formal-spec-verifier.lock.yml	Propagates v0.3.0.
.github/workflows/daily-file-diet.lock.yml	Propagates v0.3.0.
.github/workflows/daily-fact.lock.yml	Propagates v0.3.0.
.github/workflows/daily-experiment-report.lock.yml	Propagates v0.3.0.
.github/workflows/daily-evals-report.lock.yml	Propagates v0.3.0.
.github/workflows/daily-elixir-credo-snippet-audit.lock.yml	Propagates v0.3.0.
.github/workflows/daily-doc-updater.lock.yml	Propagates v0.3.0.
.github/workflows/daily-doc-healer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-credit-limit-test.lock.yml	Propagates v0.3.0.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-compiler-quality.lock.yml	Propagates v0.3.0.
.github/workflows/daily-community-attribution.lock.yml	Propagates v0.3.0.
.github/workflows/daily-code-metrics.lock.yml	Propagates v0.3.0.
.github/workflows/daily-cli-tools-tester.lock.yml	Propagates v0.3.0.
.github/workflows/daily-cli-performance.lock.yml	Propagates v0.3.0.
.github/workflows/daily-choice-test.lock.yml	Propagates v0.3.0.
.github/workflows/daily-caveman-optimizer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-byok-ollama-test.lock.yml	Propagates v0.3.0.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml	Propagates v0.3.0.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml	Propagates v0.3.0.
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml	Propagates v0.3.0.
.github/workflows/daily-assign-issue-to-user.lock.yml	Propagates v0.3.0.
.github/workflows/daily-architecture-diagram.lock.yml	Propagates v0.3.0.
.github/workflows/daily-ambient-context-optimizer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml	Propagates v0.3.0.
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml	Propagates v0.3.0.
.github/workflows/craft.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-session-insights.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-pr-merged-report.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-opt.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-cli-deep-research.lock.yml	Propagates v0.3.0.
.github/workflows/copilot-agent-analysis.lock.yml	Propagates v0.3.0.
.github/workflows/contribution-check.lock.yml	Propagates v0.3.0.
.github/workflows/constraint-solving-potd.lock.yml	Propagates v0.3.0.
.github/workflows/commit-changes-analyzer.lock.yml	Propagates v0.3.0.
.github/workflows/code-scanning-fixer.lock.yml	Propagates v0.3.0.
.github/workflows/cloclo.lock.yml	Propagates v0.3.0.
.github/workflows/cli-version-checker.lock.yml	Propagates v0.3.0.
.github/workflows/cli-consistency-checker.lock.yml	Propagates v0.3.0.
.github/workflows/claude-code-user-docs-review.lock.yml	Propagates v0.3.0.
.github/workflows/ci-doctor.lock.yml	Propagates v0.3.0.
.github/workflows/ci-coach.lock.yml	Propagates v0.3.0.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Propagates v0.3.0.
.github/workflows/changeset.lock.yml	Propagates v0.3.0.
.github/workflows/breaking-change-checker.lock.yml	Propagates v0.3.0.
.github/workflows/brave.lock.yml	Propagates v0.3.0.
.github/workflows/blog-auditor.lock.yml	Propagates v0.3.0.
.github/workflows/aw-failure-investigator.lock.yml	Propagates v0.3.0.
.github/workflows/avenger.lock.yml	Propagates v0.3.0.
.github/workflows/auto-triage-issues.lock.yml	Propagates v0.3.0.
.github/workflows/audit-workflows.lock.yml	Propagates v0.3.0.
.github/workflows/artifacts-summary.lock.yml	Propagates v0.3.0.
.github/workflows/architecture-guardian.lock.yml	Propagates v0.3.0.
.github/workflows/archie.lock.yml	Propagates v0.3.0.
.github/workflows/approach-validator.lock.yml	Propagates v0.3.0.
.github/workflows/api-consumption-report.lock.yml	Propagates v0.3.0.
.github/workflows/agentic-token-trend-audit.lock.yml	Propagates v0.3.0.
.github/workflows/agent-persona-explorer.lock.yml	Propagates v0.3.0.
.github/workflows/agent-performance-analyzer.lock.yml	Propagates v0.3.0.
.github/workflows/ab-testing-advisor.lock.yml	Propagates v0.3.0.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 91/91 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

Clean version bump from v0.2.2 to v0.3.0 for gh-aw-threat-detection. The single source constant in pkg/constants/version_constants.go is the right place for this pin, and the lock files are uniformly updated via make recompile. No issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 16.7 AIC · ⌖ 7.25 AIC · ⊞ 5K

[github-actions]

Skills-Based Review 🧠

Applied /codebase-design — this is a clean, mechanical version bump with no issues to flag.

📋 Review Summary

What was reviewed

• pkg/constants/version_constants.go — single constant update v0.2.2 → v0.3.0
• 89 .lock.yml files — all mechanically recompiled; no hand-edits
• smoke-call-workflow.lock.yml — incidental actions: write → actions: read correction

Positive Highlights

• ✅ Single source of truth: one constant drives all 89 lock file pins
• ✅ Recompile confirms no hand-edits; fully reproducible
• ✅ Pre-merge asset verification noted in PR description
• ✅ actions: write → actions: read is a least-privilege improvement
• ✅ Isolation test dynamically reads the constant — no test edits needed

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 19.9 AIC · ⌖ 4.51 AIC · ⊞ 6.7K
_{Comment /matt to run again}

[github-actions]

No blocking issues

The version bump is mechanical and consistent: all 89 lock files updated to v0.3.0 via make recompile, and DefaultThreatDetectVersion is the single source of truth.

Incidental permissions fix in smoke-call-workflow

The actions: write → actions: read change in smoke-call-workflow.lock.yml is correct. It applies to the call-smoke-workflow-call job, which calls a reusable workflow that only requires actions: read (confirmed in smoke-workflow-call.lock.yml). The conclusion job that legitimately needs actions: write is unchanged. Since the source .md declares no explicit actions permission, make recompile will continue to derive actions: read from the called workflow — this fix will not regress.

🔎 Code quality review by PR Code Quality Reviewer · sonnet46 44.1 AIC · ⌖ 4.49 AIC · ⊞ 5.6K
_{Comment /review to run again}

[gh-aw-bot]

@copilot please run the pr-finisher skill, confirm the branch is still current, and summarize the exact maintainer action needed. Current signals show no unresolved review threads and recent checks completed successfully; identify any remaining blocker, if any, before handoff.

Run: https://github.com/github/gh-aw/actions/runs/29873842709

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 20.4 AIC · ⌖ 8.66 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, confirm the branch is still current, and summarize the exact maintainer action needed. Current signals show no unresolved review threads and recent checks ...

Ran pr-finisher triage.

• ✅ Reviews: no unresolved review threads (review_threads count is 0).
• ✅ Branch currency: branch is current with main (PR base SHA 2a7ac3d34e2d1795112b2e8d6703b17cc42dfe73 matches latest main).
• ✅ Recent checks: latest completed checks on the PR head are successful.
• ❓ Remaining blocker: PR is still mergeable_state=blocked while a new copilot run from this comment-handling workflow is in_progress (run 29874489566).

Exact maintainer action: once that in-progress run finishes (or is confirmed non-required by branch protection), merge PR #47149.

[gh-aw-bot]

@copilot please run the pr-finisher skill, confirm the branch is still current, and summarize the exact maintainer action needed to merge. Current signals show no unresolved review blockers or failed checks, so focus on final merge-readiness validation.

Run: https://github.com/github/gh-aw/actions/runs/29877220652

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 12.8 AIC · ⌖ 6.96 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, confirm the branch is still current, and summarize the exact maintainer action needed to merge. Current signals show no unresolved review blockers or faile...

Ran pr-finisher final merge-readiness validation.

• ✅ Reviews: no unresolved review threads.
• ✅ Branch currency: PR base SHA 2a7ac3d34e2d1795112b2e8d6703b17cc42dfe73 matches latest main.
• ✅ Checks snapshot: no failed jobs on the current PR-head run; latest completed PR runs are successful.
• ❓ Remaining blocker: PR is still mergeable_state=blocked while the current copilot run is still in progress (run 29877723015, job 88791803236).

Exact maintainer action to merge: after that in-progress run completes (or if branch protection confirms it is non-required), merge PR #47149.

[github-actions]

🤖 PR Triage

Field	Value
Category	chore
Risk	medium
Score	68/100
Breakdown	impact: 30 · urgency: 25 · quality: 13
Action	fast_track

Rationale: Dependency version bump propagated to 91 lock files via make recompile. CI ✅ (all checks pass), 3 APPROVED reviews. Upstream binary verified before pinning. Large file count but purely mechanical. Expedited human review recommended — security-sensitive as it updates a threat-detection binary.

Generated by 🔧 PR Triage Agent · sonnet46 29.6 AIC · ⌖ 7.43 AIC · ⊞ 5.6K · ◷

[gh-aw-bot]

@copilot please run the pr-finisher skill, confirm the branch is still current, and summarize the exact maintainer action needed to merge. Current signals show no unresolved review blockers or failed checks.

Run: https://github.com/github/gh-aw/actions/runs/29881378283

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 11.8 AIC · ⌖ 10.8 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, confirm the branch is still current, and summarize the exact maintainer action needed to merge. Current signals show no unresolved review blockers or faile...

Ran pr-finisher merge-readiness validation.

• ✅ Reviews: no unresolved review threads (reviewThreads = 0).
• ✅ Branch currency: PR base SHA 2a7ac3d34e2d1795112b2e8d6703b17cc42dfe73 matches latest main SHA.
• ✅ Checks: no failed checks on the current PR head snapshot.
• ❓ Remaining blocker: PR is still mergeable_state=blocked because a copilot check is currently in progress (run 29881754316, job 88803950045).

Exact maintainer action to merge: once that in-progress check completes successfully (or is confirmed non-required by branch protection), merge PR #47149.

[gh-aw-bot]

@copilot please run the pr-finisher skill, confirm whether the only remaining blocker is branch protection or a stale check state, and summarize the exact maintainer action needed to merge.

Run: https://github.com/github/gh-aw/actions/runs/29883079375

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 8.98 AIC · ⌖ 8.2 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, confirm whether the only remaining blocker is branch protection or a stale check state, and summarize the exact maintainer action needed to merge.

Run: ht...

Ran pr-finisher validation.

• Branch is still current: PR base SHA 2a7ac3d34e2d1795112b2e8d6703b17cc42dfe73 matches latest main.
• No unresolved review threads (reviewThreads unresolved count = 0).
• Prior PR checks on the current head SHA are successful.

The remaining blocker is branch protection waiting on an active required check, not a stale check state: copilot is currently in_progress on run 29883850415 (job 88810231294) for this PR head.

Exact maintainer action to merge: once that copilot check completes successfully, merge PR #47149.

[gh-aw-bot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the exact next maintainer action.

Run: https://github.com/github/gh-aw/actions/runs/29889445104

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 7.09 AIC · ⌖ 7.33 AIC · ⊞ 7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the exact next maintainer action.

Run: https://github.com/github/gh-a...

Ran pr-finisher validation.

• Unresolved review feedback: none (reviewThreads unresolved count = 0).
• Branch currency: current with main (latest main SHA 2a7ac3d34e2d1795112b2e8d6703b17cc42dfe73 matches the PR base SHA).
• Latest completed PR checks on the current head are successful.
• Remaining blocker: required copilot check is currently in progress (run 29889828790, job 88827841778), so the PR is still blocked by branch protection.

Exact next maintainer action: once that in-progress copilot check completes successfully, merge PR #47149.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.83.0