chore: bump MCPG (MCP Gateway) from v0.2.17 to v0.2.19

[lpcox]

Summary

Bumps the default MCP Gateway (gh-aw-mcpg) Docker image version from v0.2.17 to v0.2.19.

Changes

• pkg/constants/version_constants.go: Updated DefaultMCPGatewayVersion from v0.2.17 to v0.2.19
• .github/aw/actions-lock.json: Added SHA256 digest pin for ghcr.io/github/gh-aw-mcpg:v0.2.19 (sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd)
• 187 .lock.yml files: Recompiled with updated MCPG version and digest-pinned image references

Verification

• Binary rebuilt (make build)
• All 187 workflows recompiled (make recompile)
• Lock files contain digest-pinned v0.2.19 image references
• Format and lint clean (make fmt && make lint)

Closes #26068

[lpcox]

@copilot resolve the merge conflicts in this pull request

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the default MCP Gateway (gh-aw-mcpg) Docker image from v0.2.17 to v0.2.19 and propagates the new version/digest through the action pin databases and generated workflow lock files.

Changes:

• Bumped DefaultMCPGatewayVersion to v0.2.19.
• Added digest pin metadata for ghcr.io/github/gh-aw-mcpg:v0.2.19 to the pin/lock JSON sources.
• Regenerated workflow .lock.yml files to reference v0.2.19 and its digest in manifests/download steps.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Bumps the default MCP Gateway version constant to v0.2.19.
pkg/workflow/data/action_pins.json	Adds a digest-pinned entry for gh-aw-mcpg:v0.2.19 to the workflow pin database.
.github/aw/actions-lock.json	Adds a digest-pinned entry for gh-aw-mcpg:v0.2.19 to the GitHub Actions lock metadata.
.github/workflows/workflow-health-manager.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/video-analyzer.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/test-workflow.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/test-quality-sentinel.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/test-dispatcher.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/security-compliance.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/schema-feature-coverage.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/schema-consistency-checker.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/plan.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/metrics-collector.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/github-remote-mcp-auth-test.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/github-mcp-tools-report.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/firewall.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/example-permissions-warning.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/draft-pr-cleanup.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/discussion-task-miner.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/dictation-prompt.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/dev.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/delight.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/craft.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/copilot-cli-deep-research.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/codex-github-remote-mcp-test.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/cli-consistency-checker.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/artifacts-summary.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).
.github/workflows/ace-editor.lock.yml	Updates pinned MCPG image references from v0.2.17 to v0.2.19 (manifest/comments/download list).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 100/190 changed files
• Comments generated: 1

[Copilot]

This adds the new MCPG pin but keeps the older v0.2.17 pin alongside it. If the intent is to prevent accidental regressions to older MCPG versions, consider removing (or otherwise deprecating) the v0.2.17 entry so only the currently-supported MCPG versions remain available for selection.

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in f0eda8a. Merged main into the branch, accepted main's version of the 187 conflicted .lock.yml files, then recompiled all workflows so they contain the MCPG v0.2.19 reference.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw q9zRs7hTpRyj (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ,short (http block)
• https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v7
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha .egg (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha to pkg/workflow/data/action_pins.json..." ame 1/x64/bin/git (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/docker/build-push-action/git/ref/tags/v7
  • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v7 --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[lpcox]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in c90a7eb. Merged main into the branch — accepted main's versions of the 187 conflicted .lock.yml files, merged the JSON pin files keeping main's new firewall 0.25.20 entries plus our v0.2.19 MCPG entry (and omitting v0.2.17), then rebuilt and recompiled all 187 workflows.

[github-actions]

Hey @lpcox 👋 — great work on this MCPG bump to v0.2.19! The PR is well-structured, references the originating issue (#26068), and all the mechanical changes (version constant, digest pin, 187 recompiled lock files) are accounted for. The verification checklist in the body is a nice touch.

One small item to address before merging:

• No test coverage for the version constant change — pkg/constants/version_constants.go now declares DefaultMCPGatewayVersion = "v0.2.19", but there's no test asserting the expected default. If a test already exists for this constant in pkg/constants/, a quick check to make sure it passes (or is updated) would close that gap. If none exists, a short assertion test would lock in the expected value and prevent accidental drift in future bumps.

If you'd like a hand, you can assign this prompt to your coding agent:

In the repository github/gh-aw, check whether a test file exists for pkg/constants/version_constants.go (e.g., pkg/constants/version_constants_test.go or similar). 

If a test for DefaultMCPGatewayVersion already exists, update it to assert the value is "v0.2.19".

If no test exists, create pkg/constants/version_constants_test.go with a single test:
  - TestDefaultMCPGatewayVersion: assert that constants.DefaultMCPGatewayVersion equals "v0.2.19"

Follow the existing test patterns in the pkg/constants/ directory. Run `make test` to confirm the test passes before finishing.

Generated by Contribution Check · ● 2.6M · ◷