fix: remove base branch override from fix-review-findings

[PureWeen]

gh-aw blocks base branch overrides. The agent passed base: 'main' which caused all safe outputs to be cancelled.

[github-actions]

Reviewer 1 Summary (claude-opus-4.6)

The .md source change is correct — removing "base": "main" from the create_pull_request example and adding a warning callout is the right fix for the "Base branch override is not allowed" error.

However, the lock file was recompiled with gh-aw v0.68.3 instead of the existing v0.71.1, introducing multiple security and functional regressions that are unrelated to the prompt change:

#	Severity	Finding
1	🔴 CRITICAL	Container image SHA-256 digest pins removed — images referenced by mutable tag only
2	🔴 CRITICAL	save_base_github_folders.sh / restore_base_github_folders.sh steps removed — PR content can override agent instructions
3	🟡 MODERATE	Protected files list reduced (DESIGN.md, CLAUDE.md, GEMINI.md unprotected); .githooks/, .husky/ path prefixes unprotected
4	🟡 MODERATE	All infrastructure components downgraded (firewall 0.25.28→0.25.20, MCP server v1.0.2→v0.32.0, copilot CLI 1.0.35→1.0.21, etc.)
5	🟢 MINOR	actions/setup-node removed from manifest and workflow steps

Root cause: The lock file was recompiled with an older compiler. The fix is to recompile with v0.71.1+ so the lock file retains all security features from the base branch while incorporating the prompt-only change.

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

Generated by Expert Code Review (auto) for issue #793 · ● 25M

[github-actions]

🔴 CRITICAL — Lock file recompiled with older gh-aw compiler; multiple security regressions

The .md source change is a 2-line prompt fix (remove "base": "main"), but the lock file was recompiled with v0.68.3 instead of the existing v0.71.1. The frontmatter hash is unchanged (03b9c5f...), confirming the frontmatter wasn't modified — so no recompilation of the lock infrastructure was needed. Recompiling with an older compiler introduces these regressions:

1. Container image digest pins removed (supply-chain risk)

Base had @sha256: digest pins for gh-aw-firewall/agent, api-proxy, squid, and node:lts-alpine. The new lock uses only mutable tags (ghcr.io/github/gh-aw-firewall/agent:0.25.20 without digest). A compromised or re-pushed tag at the registry would silently replace the image.

2. Agent config folder save/restore steps removed (prompt injection surface)

The v0.71.1 lock had:

- name: Save agent config folders for base branch restoration
  env:
    GH_AW_AGENT_FOLDERS: ".agents .claude .codex .crush .gemini .github .opencode"
    GH_AW_AGENT_FILES: ".crush.json AGENTS.md CLAUDE.md GEMINI.md opencode.jsonc"
  run: bash "\$\{RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"

and a matching restore_base_github_folders.sh step. These are gone in the v0.68.3 output. Without them, a malicious PR that modifies .github/copilot-instructions.md or agent config files can alter the agent's behavior during the workflow run.

3. Protected files list shrunk

• Removed from protected_files: DESIGN.md, CLAUDE.md, GEMINI.md
• Removed from protected_path_prefixes: .githooks/, .husky/

The agent can now create or modify git-hook scripts (.githooks/, .husky/) via create_pull_request, which execute on developer machines.

4. Component version downgrades

Component	Base	Head
gh-aw-actions/setup	v0.71.1	v0.68.3
gh-aw-firewall	0.25.28	0.25.20
gh-aw-mcpg	v0.3.0	v0.2.19
github-mcp-server	v1.0.2	v0.32.0
copilot CLI	1.0.35	1.0.21

These may include security fixes now lost.

5. actions/setup-node removed from manifest

The action and its uses: step are absent from the new lock file.

Failing scenario: A fork PR adds a .husky/pre-commit file or modifies .github/copilot-instructions.md. With the base lock, both are blocked. With this PR's lock, the agent config folder override succeeds (no save/restore), and .husky/ files aren't protected.

Fix: Recompile the lock file with gh-aw v0.71.1 (or newer). Only the prompt body changed — the lock infrastructure should match what v0.71.1 produces for this frontmatter.

[github-actions]

🟡 MODERATE · 3/3 reviewers · Compiler version downgrade (v0.71.1 → v0.68.3)

The lock file was recompiled with an older compiler (v0.68.3 vs the previous v0.71.1). This causes several regressions in the auto-generated lock file:

1. Protected surface shrank (2/3 reviewers confirmed): protected_files lost DESIGN.md, CLAUDE.md, GEMINI.md; protected_path_prefixes lost .githooks/, .husky/. These are compiler defaults that changed between versions — the .md frontmatter doesn't explicitly list them.
2. gh-aw-actions/setup action pinned to the older v0.68.3 release SHA instead of v0.71.1.
3. Other compiler-default changes (firewall container versions, MCP gateway version, etc.) may have regressed.

Recommendation: Recompile with v0.71.1+ (gh aw compile .github/workflows/fix-review-findings.md) to preserve the original runtime version's defaults. The .md source change itself is correct — only the compiler version used for recompilation is the issue.