🔄 chore: update pinned gh-aw schema URL to v0.88.7

[github-actions]

Schema URL Update

Updates the MCP Gateway JSON schema validation URL from the previous version to v0.88.7.

Files Changed

• internal/config/validation_errors.go — SchemaURL constant updated to v0.88.7

Why

Pinning to a specific release tag ensures reproducible, deterministic configuration validation — the schema won't silently change between runs.

Release Notes

See the gh-aw release notes for changes in this schema version.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• raw.githubusercontent.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "raw.githubusercontent.com"

See Network Configuration for more information.

Generated by Nightly Schema Updater · copilot · gpt54 · 25 AIC · ⊞ 33.2K · ◷

• expires on Sep 16, 2026, 2:54 AM UTC

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor (runsc kernel-level isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 write tools absent from gateway catalog (23 read-only tools only); attempted calls → "unknown tool"	BLOCKED	⚠️ INCONCLUSIVE — absence proves backend GITHUB_READ_ONLY=1 config, not independent mcpg gateway enforcement layer
C	CLI	reads (list_issues, get_file_contents)	data returned via proxied github CLI	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh CLI unauthenticated in this environment (no GH_TOKEN); all calls failed before reaching GitHub	BLOCKED	⚠️ INCONCLUSIVE — token-scope boundary not exercised, no writes leaked
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	not attempted (same auth gap as D)	BLOCKED	⚠️ INCONCLUSIVE

Overall: INCONCLUSIVE

No write leaked through mcpg on any surface. Part B is inconclusive because gh-aw's tools.github: wrapper unconditionally sets GITHUB_READ_ONLY=1 on the backend, so write tools never reach the catalog — this masks whether mcpg's own DIFC/guard layer would independently block them (that's covered separately by internal/guard/internal/difc unit tests). Parts D/E are inconclusive because gh had no auth token in this run. Results hold identically to the default runtime: reads succeed, no writes leaked.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (star/comment/issue_write/branch/file/PR)	all "unknown tool" (-32602); write tools absent from the 23-tool catalog (GITHUB_READ_ONLY=1)	BLOCKED	⚠️
C	CLI	reads (proxied github binary)	data returned	ALLOWED	✅
D	CLI	REST writes (gh api)	gh unauthenticated — GH_TOKEN unset in this job, could not attempt	BLOCKED	⚠️
E	CLI	GraphQL mutations (gh api graphql)	gh unauthenticated (same as D)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: all 6 targeted write tools (star_repository, add_issue_comment, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the backend's exposed tool catalog (only 23 read-only tools registered, per gh-aw's GITHUB_READ_ONLY=1 default). This confirms backend-level read-only config but not mcpg's own independent gateway-level write-blocking layer.

⚠️ Part D/E: gh CLI had no GH_TOKEN in this environment, so REST/GraphQL write attempts could not be issued at all — the token-scope boundary was not exercised this run.

No writes leaked on any surface. See internal/guard/internal/difc unit tests for independent coverage of mcpg's own DIFC write-blocking layer.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime