Integrate gh-aw-firewall v0.28.11 attested artifact contract atomically

[lpcox]

Summary

Upgrade gh-aw to gh-aw-firewall v0.28.11 while atomically adopting its production Cloud Hypervisor artifact trust contract.

A version-only bump is not compatible: gh-aw currently provisions a tarball plus legacy checksums and emits five --cloud-hypervisor-*-sha256 flags. In v0.28.11, production Cloud Hypervisor execution instead requires an attested manifest, its Sigstore bundle, and the matching release tag. Legacy checksum flags are accepted only behind a dual development-only bypass that must not be enabled in generated production workflows.

Release: https://github.com/github/gh-aw-firewall/releases/tag/v0.28.11

Required changes

Provision the attested release artifacts

Update actions/setup/sh/cloud_hypervisor_setup_bundle.sh to:

• download the v0.28.11 Cloud Hypervisor artifact archive;
• download cloud-hypervisor-test-x86_64.manifest.json and cloud-hypervisor-test-x86_64.manifest.sigstore.jsonl;
• retain both files as immutable setup outputs;
• export the manifest path, bundle path, and normalized release tag for generated AWF invocations;
• fail closed when an artifact is missing, mutable, malformed, or associated with a different release.

AWF performs the authoritative offline Sigstore/provenance verification. gh-aw should provision its required gh trust tooling but should not implement a second, divergent verifier.

Emit the production CLI contract

Update pkg/workflow/awf_command_builder.go to emit:

--cloud-hypervisor-artifact-manifest <path>
--cloud-hypervisor-artifact-manifest-bundle <path>
--cloud-hypervisor-artifact-release-tag <tag>

Generated production workflows must not use:

--cloud-hypervisor-development-allow-unattested-artifacts
AWF_CLOUD_HYPERVISOR_DEVELOPMENT_ALLOW_UNATTESTED_ARTIFACTS=1

Remove the legacy five caller-supplied SHA flags from the production Cloud Hypervisor path once the attested contract is wired.

Synchronize configuration and schema

• Refresh pkg/workflow/schemas/awf-config.schema.json from the v0.28.11 schema.
• Add or reconcile the cloudHypervisor configuration model in pkg/workflow/awf_config.go, including artifact manifest, bundle, release tag, mount policy, resource settings, and explicitly development-only legacy fields.
• Reconcile gh-aw-local schema extensions such as boundedAgents using the existing schema-drift process documented in specs/awf-config-sources-spec.md.
• Extend schema and command-generation drift tests.

Update pins and generated workflows

• Bump DefaultFirewallVersion from v0.28.10 to v0.28.11 in pkg/constants/version_constants.go.
• Update AWF action/image pins and release digests in:
  • .github/aw/actions-lock.json
  • pkg/actionpins/data/action_pins.json
  • pkg/workflow/data/action_pins.json
• Regenerate workflow lock files only after the new setup outputs and command contract are implemented.

Acceptance criteria

• The version bump, setup changes, schema changes, and generated CLI flags land together; no intermediate commit produces incompatible Cloud Hypervisor workflows.
• Generated Cloud Hypervisor workflows use the manifest, Sigstore bundle, and exact v0.28.11 release tag.
• No production-generated workflow enables the unattested development bypass.
• Missing, tampered, mismatched-release, or substituted manifest/bundle inputs fail before VM launch.
• All five trusted local artifacts—Cloud Hypervisor, virtiofsd, kernel, rootfs, and supervisor—are verified through the attested manifest.
• Generated workflow tests assert the new flags and absence of legacy development bypasses.
• Existing credential and OIDC exclusions remain present.
• make build && make recompile && make recompile is clean and deterministic.
• At least one generated Cloud Hypervisor smoke workflow completes using the v0.28.11 production trust path.

Suggested validation

• Extend pkg/workflow/cloud_hypervisor_test.go for setup outputs, bundle download, release-tag propagation, generated flags, and bypass absence.
• Add setup-script negative tests for missing/tampered manifest and bundle inputs and release-tag mismatch.
• Confirm regenerated lock files no longer pin v0.28.10 or emit only the five legacy SHA flags.
• Run the dedicated Cloud Hypervisor live-KVM smoke/security workflow before merge.

Compatibility addendum: explicit mount policy

The migration must also preserve gh-aw generated tool discovery. gh-aw currently installs and locates engine/runtime tools under RUNNER_TOOL_CACHE, while gh-aw-firewall v0.28.11 defaults Cloud Hypervisor to workspace-only. Therefore the same atomic PR must initially emit:

--cloud-hypervisor-mount-policy workspace-and-tool-cache

This must be an explicit compiler-owned opt-in, not an inferred AWF default. Omitting it is secure but breaks current generated workflows. A later least-exposure change can sparse-stage only required binaries and switch back to explicit workspace-only.

Additional acceptance criteria:

• Generated Cloud Hypervisor commands explicitly select workspace-and-tool-cache until tool discovery no longer depends on the broad cache.
• Tests prove the tool-cache export is host-enforced read-only and is not enabled for workflows that do not need it.
• AWFCloudHypervisorMinVersion is raised to v0.28.11, or an equally fail-closed version gate prevents production Cloud Hypervisor pins using the obsolete trust contract.
• Host preflight/documentation covers gh, rsync, cgroup v2, Landlock, Docker, and KVM prerequisites.