Add containers ecosystem to workflow firewall allowlists

.github/workflows/agentics-maintenance.yml

@@ -13,11 +13,11 @@
 # \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
 #  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
 #
-# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.38.5). DO NOT EDIT.
+# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.41.0). DO NOT EDIT.
 #
 # To regenerate this workflow, run:
 #   gh aw compile
-# For more information: https://github.com/githubnext/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
+# For more information: https://github.com/github/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
 #
 # Alternative regeneration methods:
 # make recompile
@@ -47,7 +47,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: githubnext/gh-aw/actions/setup@v0.38.5
+        uses: github/gh-aw/actions/setup@v0.41.0
         with:
           destination: /opt/gh-aw/actions
 

.github/workflows/daily-compliance-checker.md

@@ -12,6 +12,11 @@ permissions:
 
 engine: copilot
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 safe-outputs:
   create-issue:
     title-prefix: "[compliance] "

.github/workflows/daily-multi-device-docs-tester.md

@@ -42,6 +42,7 @@ safe-outputs:
 network:
   allowed:
     - node
+    - containers
 
 imports:
   - shared/docs-server-lifecycle.md

.github/workflows/duplicate-code-detector.md

@@ -9,6 +9,10 @@ permissions:
   issues: read
   pull-requests: read
 engine: copilot
+network:
+  allowed:
+    - defaults
+    - containers
 tools:
   serena: ["go"]
 safe-outputs:

.github/workflows/go-fan.md

@@ -21,6 +21,7 @@ network:
     - defaults
     - github
     - go
+    - containers
 
 imports:
   - shared/reporting.md

.github/workflows/go-logger.md

@@ -12,6 +12,11 @@ permissions:
 
 engine: copilot
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 safe-outputs:
   create-pull-request:
     title-prefix: "[log] "

.github/workflows/issue-monster.md

@@ -17,6 +17,11 @@ permissions:
 engine: copilot
 timeout-minutes: 30
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 tools:
   github:
     toolsets: [default, pull_requests]

.github/workflows/mcp-gateway-log-analyzer.md

@@ -13,6 +13,11 @@ permissions:
 
 engine: copilot
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 safe-outputs:
   create-issue:
     title-prefix: "[mcp-gateway-logs] "

.github/workflows/nightly-docs-reconciler.md

@@ -7,6 +7,10 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+network:
+  allowed:
+    - defaults
+    - containers
 tools:
   github:
     toolsets: [default]

.github/workflows/nightly-mcp-stress-test.md

@@ -17,6 +17,7 @@ network:
   allowed:
     - defaults
     - go
+    - containers
 
 tools:
   github:

.github/workflows/plan.md

@@ -11,6 +11,10 @@ permissions:
   issues: read
   pull-requests: read
 engine: copilot
+network:
+  allowed:
+    - defaults
+    - containers
 tools:
   github:
     toolsets: [default, discussions]

.github/workflows/release.md

@@ -29,7 +29,7 @@ network:
   allowed:
     - defaults
     - node
-    - "ghcr.io"
+    - containers
 sandbox:
   agent: awf  # Firewall enabled (migrated from network.firewall)
 tools:

.github/workflows/semantic-function-refactor.md

@@ -10,6 +10,11 @@ permissions:
   issues: read
   pull-requests: read
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 imports:
   - shared/reporting.md
 

.github/workflows/smoke-codex.md

@@ -22,6 +22,7 @@ network:
     - defaults
     - github
     - playwright
+    - containers
 tools:
   cache-memory: true
   github:

.github/workflows/smoke-copilot.md

@@ -20,6 +20,7 @@ network:
     - node
     - github
     - playwright
+    - containers
 tools:
   agentic-workflows:
   cache-memory: true

.github/workflows/test-coverage-improver.md

@@ -12,6 +12,11 @@ permissions:
 
 engine: copilot
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 steps:
   - name: Set up Go
     uses: actions/setup-go@v6

.github/workflows/test-improver.md

@@ -10,6 +10,11 @@ permissions:
   issues: read
   pull-requests: read
 
+network:
+  allowed:
+    - defaults
+    - containers
+
 steps:
   - name: Set up Go
     uses: actions/setup-go@v6