Bump CLI, MCP SDK, and scanner image defaults by Copilot · Pull Request #52855 · github/gh-aw

Copilot · 2026-08-15T05:49:50Z

Routine version refresh for CLI/MCP tooling and static-analysis Docker images. This updates six CLI/MCP defaults and three scanner image pins, including security-relevant Syft and Grype bumps.

CLI / MCP defaults
- Claude Code: 2.1.227 → 2.1.233
- GitHub Copilot CLI: 1.0.79 → 1.0.80
- GitHub Copilot SDK: 1.0.8 → 1.0.11
- Gemini CLI: 0.39.1 → 0.55.1
- Pi: 0.84.1 → 0.84.2
- @modelcontextprotocol/sdk: 1.24.0 → 1.30.0
Docker scanner images
- Syft: v1.50.0 → v1.51.0
- Grype: v0.116.1 → v0.117.0
- Shellcheck: v0.10.0 → v0.11.0
- Refreshed SHA-pinned image digests.
Generated/runtime metadata
- Synced Copilot compat metadata and installer fallback version.
- Refreshed Copilot SDK/Copilot package lock entries.
- Recompiled workflow lockfiles and updated affected wasm golden output.

const DefaultCopilotVersion Version = "1.0.80"
const DefaultGeminiVersion Version = "0.55.1"
const DefaultMCPSDKVersion Version = "1.30.0"

Fixes [ca] CLI/Docker version check: 6 CLI updates, 3 Docker image bumps (2026-08-15) #52853

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 25.9 AIC · ⌖ 6.97 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-15T06:26:19Z

PR Triage

Category: chore | Risk: medium | Score: 35/100

Impact: 15/50 (routine version bump across CLI/MCP/scanner defaults, large mechanical diff)
Urgency: 10/30 (no incident driving this, routine maintenance)
Quality: 10/20 (large diff footprint, no reviews yet, CI unknown, draft)

Recommended action: defer
Routine dependency-version refresh; large mechanical diff (266 files) warrants a careful but non-urgent pass.

Generated by 🔧 PR Triage Agent · auto · 46.6 AIC · ⌖ 2.63 AIC · ⊞ 8.1K · ◷

github-actions · 2026-08-15T12:25:49Z

PR Triage

Category: chore
Risk: medium
Priority: low
Score: 40/100
Recommended action: defer

Routine CLI/MCP/Docker version bump touching 266 files. No CI runs detected yet. Low urgency; defer until CI signal available.

_{Automated triage — see [PR Triage Report] for full context.}

Generated by 🔧 PR Triage Agent · auto · 62.5 AIC · ⌖ 2.53 AIC · ⊞ 8.1K · ◷

github-actions · 2026-08-15T12:54:50Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-15T12:54:59Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-15T12:55:04Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the implementation label and has only 17 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-15T12:55:13Z

✅ PR Code Quality Reviewer completed the code quality review.

Reviewed PR #52855. No actionable blocking issues found in the changed lines; version bumps and regenerated workflow lockfiles appear internally consistent, and no new review comments were necessary.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-08-15T12:56:04Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship. This PR only bumps default CLI/MCP SDK/scanner image versions (changeset entry, compat.json max-agent bump, and regenerated .lock.yml files). No hand-authored logic changed, so there is no over-engineering to flag.

Generated by Ponytail Reviewer for #52855

github-actions

Routine version bump — all version strings updated consistently across lock files and env vars. No logic or security concerns. ✅

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 15 AIC · ⌖ 7.01 AIC · ⊞ 5.6K

github-actions

Skills-Based Review 🧠

Applied /grill-with-docs — routine version-refresh PR, no logic changes.

📋 Review Summary

What was checked

.github/aw/compat.json: max-agent correctly advanced from 1.0.79 → 1.0.80 in sync with the Copilot CLI default bump.
.changeset/patch-cli-docker-version-updates-2026-08-15.md: Well-formed changeset entry, correct bump type (patch), concise description.
Lock files (~260 .lock.yml): mechanically recompiled — no manual review needed.

Positive Highlights

✅ Changeset entry matches the scope and intent of the PR.
✅ compat.json max-agent kept in sync with the new CLI default — the right place for this change.
✅ SHA-pinned Docker images refreshed (Syft, Grype, Shellcheck), consistent with supply-chain hardening practices.
✅ PR description explicitly lists all version deltas.

No actionable issues found.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 24.7 AIC · ⌖ 8.33 AIC · ⊞ 7.7K
_{Comment /matt to run again}

Copilot

Pull request overview

Refreshes default CLI, MCP SDK, and scanner versions, including generated workflow metadata.

Changes:

Bumps six CLI/MCP defaults and related installer metadata.
Updates Syft, Grype, and ShellCheck image pins.
Recompiles affected workflow metadata and golden output.

Show a summary per file

File	Description
`pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden`	Updates Gemini golden output.
`pkg/constants/version_constants.go`	Bumps default tool versions.
`pkg/cli/README.md`	Refreshes scanner-image documentation.
`pkg/cli/docker_images.go`	Updates scanner tags and digests.
`actions/setup/sh/install_copilot_cli.sh`	Updates Copilot fallback version.
`actions/setup/js/package.json`	Bumps Copilot SDK dependency.
`.github/workflows/workflow-skill-extractor.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/workflow-normalizer.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/weekly-safe-outputs-spec-review.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/weekly-editors-health-check.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/visual-regression-checker.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/video-analyzer.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/update-astro.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/uk-ai-operational-resilience.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/super-linter.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/static-analysis-report.md`	Updates ShellCheck commands.
`.github/workflows/squad-game-planner.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-workflow-call.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-service-ports.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-multi-pr.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-create-cross-repo-pr.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-copilot-small.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-ci.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/smoke-checkout-pr-dispatch.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/sighthound-security-scan.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/repo-tree-map.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/pr-description-caveman.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/ponytail-reviewer.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/objective-impact-report.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/notion-issue-summary.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/github-remote-mcp-auth-test.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/firewall.lock.yml`	Updates Copilot CLI and SDK metadata.
`.github/workflows/example-permissions-warning.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/example-failure-category-filter.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/designer-drift-audit.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/daily-team-status.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/daily-schema-audit-cursor.lock.yml`	Updates Copilot CLI and SDK metadata.
`.github/workflows/daily-model-inventory.md`	Bumps inventory SDK installation.
`.github/workflows/daily-max-ai-credits-test.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/daily-credit-limit-test.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/daily-byok-ollama-test.lock.yml`	Refreshes Copilot metadata.
`.github/workflows/bot-detection.lock.yml`	Refreshes Copilot metadata.
`.github/aw/compat.json`	Extends Copilot compatibility range.
`.changeset/patch-cli-docker-version-updates-2026-08-15.md`	Records the patch release.

Review details

Files reviewed: 125/266 changed files
Comments generated: 1
Review effort level: Balanced

Copilot · 2026-08-15T13:56:15Z

@@ -71,7 +71,7 @@ steps:

      # Pull shellcheck Docker image
      echo "Pulling shellcheck image..."
-      docker pull koalaman/shellcheck:v0.10.0
+      docker pull koalaman/shellcheck:v0.11.0


Fixed in 29f2b6d: both shellcheck references in .github/workflows/static-analysis-report.md are now pinned to v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d, and .github/workflows/static-analysis-report.lock.yml was recompiled accordingly.

pelikhan · 2026-08-15T13:04:38Z

@copilot resolve the merge conflicts on this branch.

…cker-versions # Conflicts: # .github/workflows/design-decision-gate.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-15T13:19:26Z

@copilot resolve the merge conflicts on this branch.

Resolved and pushed in 5e0c3e8115 (includes merge conflict resolution after merging origin/main into this branch).

pelikhan · 2026-08-15T13:24:19Z

@copilot resolve the merge conflicts on this branch.

gh-aw-bot · 2026-08-15T13:25:31Z

@copilot Quick triage for maintainer-ready follow-up:

This branch still shows merge-conflict state. Please run make merge-main, resolve any remaining conflicts cleanly, rerun the relevant validation, and then use the pr-finisher skill before handing the PR back to maintainers.

Run context: https://github.com/github/gh-aw/actions/runs/31886878354

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.7 AIC · ⌖ 5.9 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

…cker-versions # Conflicts: # .github/workflows/pr-code-quality-reviewer.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-15T13:36:21Z

@copilot resolve the merge conflicts on this branch.

Resolved and pushed in 1345ecfad5.

pelikhan · 2026-08-15T13:38:08Z

@copilot resolve the merge conflicts on this branch.

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

gh-aw-bot · 2026-08-15T13:55:32Z

@copilot Quick triage for maintainer-ready follow-up:

This branch still shows merge-conflict state. Please run make merge-main, resolve any remaining conflicts cleanly, rerun the relevant validation, and then use the pr-finisher skill before handing the PR back to maintainers.

Outstanding review items (newest first):

Bump CLI, MCP SDK, and scanner image defaults #52855 (comment) — pin the workflow scanner image pull to the same digest as ShellcheckImage, then recompile the workflow

Run context: https://github.com/github/gh-aw/actions/runs/31888236959

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 25.9 AIC · ⌖ 6.97 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-15T13:55:47Z

@copilot Quick triage for maintainer-ready follow-up:

This branch still shows merge-conflict state. Please run make merge-main, resolve any remaining conflicts cleanly, rerun the relevant validatio...

Done in 29f2b6d: ran make merge-main, resolved remaining merge state, pinned shellcheck to the SHA digest in .github/workflows/static-analysis-report.md (and recompiled lockfile), then validated with make fmt, make lint, make test-unit, make test, and make agent-report-progress.

github-actions · 2026-08-15T17:24:44Z

🎉 This pull request is included in a new release.

Release: v0.86.3

Initial plan

0798481

Copilot AI assigned Copilot and pelikhan Aug 15, 2026

Copilot AI linked an issue Aug 15, 2026 that may be closed by this pull request

[ca] CLI/Docker version check: 6 CLI updates, 3 Docker image bumps (2026-08-15) #52853

Closed

4 tasks

Copilot started work on behalf of pelikhan August 15, 2026 05:50 View session

github-actions Bot mentioned this pull request Aug 15, 2026

[pr-review] Daily PR Code Quality Review — 31867888921 #52856

Open

Bump CLI and Docker tool versions

2691232

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update CLI tools and Docker images for version check~~ Bump CLI, MCP SDK, and scanner image defaults Aug 15, 2026

Copilot finished work on behalf of pelikhan August 15, 2026 06:07

Copilot AI requested a review from pelikhan August 15, 2026 06:07

github-actions Bot added pr-action:defer pr-agent:copilot pr-priority:low pr-risk:medium pr-type:chore labels Aug 15, 2026

github-actions Bot mentioned this pull request Aug 15, 2026

[PR Triage Report] PR Triage Report — 2026-08-15 (Run 31869042445) #52862

Closed

github-actions Bot mentioned this pull request Aug 15, 2026

[PR Triage Report] PR Triage Report — 2026-08-15 (run 31884164165) #52888

Closed

pelikhan marked this pull request as ready for review August 15, 2026 12:53

Copilot AI balanced review requested due to automatic review settings August 15, 2026 12:53

Copilot started reviewing on behalf of pelikhan August 15, 2026 12:54 View session

github-actions Bot approved these changes Aug 15, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 15, 2026

[aw] No-Op Runs #48838

Open

Copilot AI reviewed Aug 15, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 15, 2026 13:05 View session

Copilot AI and others added 2 commits August 15, 2026 13:11

Merge remote-tracking branch 'origin/main' into copilot/update-cli-do…

be5d532

…cker-versions # Conflicts: # .github/workflows/design-decision-gate.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Resolve merge conflict in design-decision-gate lockfile

5e0c3e8

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 15, 2026 13:19

Copilot started work on behalf of pelikhan August 15, 2026 13:24 View session

github-actions Bot mentioned this pull request Aug 15, 2026

[pr-sous-chef] PR Sous Chef run report #52798

Open

Merge remote-tracking branch 'origin/main' into copilot/update-cli-do…

1345ecf

…cker-versions # Conflicts: # .github/workflows/pr-code-quality-reviewer.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 15, 2026 13:36

Copilot started work on behalf of gh-aw-bot August 15, 2026 13:37 View session

Merge origin/main and pin shellcheck digest in static-analysis-report

29f2b6d

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 15, 2026 13:57

Copilot AI requested a review from gh-aw-bot August 15, 2026 13:57

Copilot started work on behalf of gh-aw-bot August 15, 2026 13:57 View session

pelikhan merged commit ac9f455 into main Aug 15, 2026
1 check failed

pelikhan deleted the copilot/update-cli-docker-versions branch August 15, 2026 13:57

Copilot stopped work on behalf of gh-aw-bot due to an error August 15, 2026 13:57
The session was cancelled by the user.

Uh oh!

Conversation

Copilot AI commented Aug 15, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026

PR Triage

Uh oh!

github-actions Bot commented Aug 15, 2026

PR Triage

Uh oh!

github-actions Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

What was checked

Positive Highlights

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Aug 15, 2026

Uh oh!

Copilot AI commented Aug 15, 2026

Uh oh!

pelikhan commented Aug 15, 2026

Uh oh!

gh-aw-bot commented Aug 15, 2026

Uh oh!

Copilot AI commented Aug 15, 2026

Uh oh!

pelikhan commented Aug 15, 2026

Uh oh!

gh-aw-bot commented Aug 15, 2026

Uh oh!

Copilot AI commented Aug 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 15, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 15, 2026 •

edited

Loading

github-actions Bot commented Aug 15, 2026 •

edited

Loading

github-actions Bot commented Aug 15, 2026 •

edited

Loading

github-actions Bot commented Aug 15, 2026 •

edited

Loading

github-actions Bot commented Aug 15, 2026 •

edited

Loading