Summary
In v0.89.21, the MCP gateway docker run command that the compiler writes into MCP_GATEWAY_DOCKER_COMMAND referenced the gateway image by digest (ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a862…). In v0.91.4, the same command references ghcr.io/github/gh-aw-mcpg:v0.4.29 by tag only. The image download step in the same lock still lists the digest-pinned image, so the gateway runs a tag-resolved image instead of the verified one.
Reproduction
- Check out microsoft/hve-core at
abb8299bf (8 sources in .github/workflows/*.md).
- Run
gh aw compile --action-mode action --action-tag v0.91.4.
- Run
grep 'MCP_GATEWAY_DOCKER_COMMAND=' .github/workflows/*.lock.yml | grep -o 'gh-aw-mcpg:[^ "]*'.
| Compiler |
Locks whose gateway docker run uses a digest |
| v0.89.21 |
8 of 8 (gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086) |
| v0.91.4 |
0 of 8 (gh-aw-mcpg:v0.4.29) |
The pinned image is ghcr.io/github/gh-aw-mcpg:v0.4.29@sha256:ec08867ac8a4823e01efb2de2ba85a313199bb7ae666ef70ae58effc162a9bf3; the lock's download step and manifest list it.
Expected
MCP_GATEWAY_DOCKER_COMMAND uses the same digest-pinned reference the download step pulls, as in v0.89.21. Dependency-pinning scanners flag the tag-only reference (8 new findings for us).
Context
This blocks upgrading from v0.89.21, which is the only route to the fixes for #65939, #65940, and #65941. Tracked downstream in microsoft/hve-core#3137.
Summary
In v0.89.21, the MCP gateway
docker runcommand that the compiler writes intoMCP_GATEWAY_DOCKER_COMMANDreferenced the gateway image by digest (ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a862…). In v0.91.4, the same command referencesghcr.io/github/gh-aw-mcpg:v0.4.29by tag only. The image download step in the same lock still lists the digest-pinned image, so the gateway runs a tag-resolved image instead of the verified one.Reproduction
abb8299bf(8 sources in.github/workflows/*.md).gh aw compile --action-mode action --action-tag v0.91.4.grep 'MCP_GATEWAY_DOCKER_COMMAND=' .github/workflows/*.lock.yml | grep -o 'gh-aw-mcpg:[^ "]*'.docker runuses a digestgh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086)gh-aw-mcpg:v0.4.29)The pinned image is
ghcr.io/github/gh-aw-mcpg:v0.4.29@sha256:ec08867ac8a4823e01efb2de2ba85a313199bb7ae666ef70ae58effc162a9bf3; the lock's download step and manifest list it.Expected
MCP_GATEWAY_DOCKER_COMMANDuses the same digest-pinned reference the download step pulls, as in v0.89.21. Dependency-pinning scanners flag the tag-only reference (8 new findings for us).Context
This blocks upgrading from v0.89.21, which is the only route to the fixes for #65939, #65940, and #65941. Tracked downstream in microsoft/hve-core#3137.