fix: recompile smoke-copilot-pat lock file

[lpcox]

The lock file hash doesn't match the .md frontmatter on main. Recompiled to fix.

Fixes: https://github.com/github/gh-aw-firewall/actions/runs/27239844538

[Copilot]

Pull request overview

This PR recompiles the smoke-copilot-pat locked workflow so its embedded gh-aw-metadata.frontmatter_hash matches the corresponding .md workflow source on main, addressing the reported workflow run failure.

Changes:

• Updated the gh-aw-metadata.frontmatter_hash in the generated lock workflow header.
• Regenerated the lock workflow content (including a minor here-doc delimiter change in the local awf wrapper install step) as part of the recompile.

Show a summary per file

File	Description
.github/workflows/smoke-copilot-pat.lock.yml	Recompiled lock workflow to sync metadata hash with the .md source and keep the generated workflow consistent.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.43%	96.47%	📈 +0.04%
Statements	96.35%	96.39%	📈 +0.04%
Functions	98.76%	98.76%	➡️ +0.00%
Branches	90.72%	90.75%	📈 +0.03%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/config-writer.ts	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

GitHub API: ✅ PASS
GitHub check: ✅ PASS
File verify: ✅ PASS

Total: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🔬 Smoke Test Results — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	✅
File write/read	✅ (Smoke test passed for Copilot PAT at Tue Jun 9 22:40:17 UTC 2026)

PR: fix: recompile smoke-copilot-pat lock file — @lpcox

Overall: ✅ PASS

🔑 PAT report filed by Smoke Copilot PAT

[github-actions]

Smoke Test Results: PASS

✅ Test 1: MCP connectivity — Verified merged PRs #4540 and #4406
✅ Test 2: GitHub.com connectivity — HTTP 200
✅ Test 3: File I/O — Sandbox write/read successful
✅ Test 4: BYOK inference — Direct mode (COPILOT_PROVIDER_API_KEY → api-proxy → api.githubcopilot.com) active

Author: @lpcox | Assignees: None
Mode: Direct BYOK (api-proxy sidecar verified working)

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

@lpcox

• GitHub MCP API: ✅
• GitHub.com connectivity: ✅
• File I/O test: ✅
• BYOK inference test: ✅
  Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
  PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.openai.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.openai.com"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

🔬 Smoke Test Results

Test	Result
GitHub MCP	✅ PR fetched: fix: recompile smoke-copilot-pat lock file
GitHub.com HTTP	✅ (pre-step smoke file confirms pass)
File write/read	✅ /tmp/gh-aw/agent/smoke-test-copilot-27240414173.txt verified

Overall: PASS

Author: @lpcox · No assignees

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke test:

• fix: recompile smoke-copilot-pat lock file
• fix: update test-hard-cap model from claude-opus-4.7 to claude-opus-4.8
• GitHub PR list: ✅
• Playwright title: ✅
• Temp file: ✅
• Build: ✅
  Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ timeout (no PONG)
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ timeout

Overall: FAIL — host.docker.internal is not reachable from this runner environment. Service containers are unavailable.

🔌 Service connectivity validated by Smoke Services