[dependabot]

Bumps golang.org/x/term from 0.46.0 to 0.47.0.

Commits

• 0851034 go.mod: update golang.org/x dependencies
• See full diff in compare view

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 write tools absent from 23-tool catalog ("unknown tool")	BLOCKED	⚠️
C	CLI	reads (via gateway-backed github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes	gh unauthenticated in this runner (no GH_TOKEN) — could not reach GitHub API	BLOCKED	⚠️
E	CLI	GraphQL mutations	same auth gap as D	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked on any surface. ⚠️ notes: (B) gh-aw's tools.github: always sets GITHUB_READ_ONLY=1, so write tools are never registered with the backend — this confirms gh-aw's own defense-in-depth, not mcpg's independent DIFC/guard layer (per the architectural note in the test plan). (D/E) gh CLI had no GH_TOKEN in this job, so REST/GraphQL writes failed on auth before reaching GitHub's permission check, not proving the token-scope boundary. Details: /tmp/gh-aw/agent/readonly-stress-39046251250.txt.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[lpcox]

@copilot merge main and resolve conflicts

[Copilot]

@copilot merge main and resolve conflicts

main is already an ancestor of this branch (the current commit’s parent), so there were no new changes to merge and no conflicts to resolve.

[lpcox]

@copilot fix the failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/39060287145/job/117476858456?pr=15108

[Copilot]

@copilot fix the failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/39060287145/job/117476858456?pr=15108

I investigated and retried run 39060287145 once. The Go unit, integration, race, lint, and Rust guard checks passed; both attempts failed only in the post-job “Redact secrets in logs” step (internal redaction validation error), unrelated to the x/term update. No repository change is warranted for this workflow/tooling failure, and the retry also failed at that step.