gh aw v0.71.1 compiles workflows referencing non-existent gh-aw-firewall v0.25.28, causing 404 on AWF binary install #30705

Summary

Agentic workflows compiled with gh-aw v0.71.1 are failing at the "Install AWF binary" step with HTTP 404 because the compiled workflows reference v0.25.28 of gh-aw-firewall, which was never published to GitHub Releases.

This is a repeat of issue #23396 (March 2026 / v0.26.0 → v0.25.3 downgrade fix).

Error

Installing awf with checksum verification (version: v0.25.28, os: Linux, arch: x86_64)
Downloading checksums from 'https://github.com/github/gh-aw-firewall/releases/download/v0.25.28/checksums.txt'...
curl: (22) The requested URL returned error: 404
##[error]Process completed with exit code 22.

The agent job fails; detection and safe_outputs are skipped. All other jobs (pre_activation, activation, conclusion) succeed.

Root cause

gh aw compile (v0.71.1) embeds v0.25.28 as the DefaultFirewallVersion in compiled .lock.yml files. However, v0.25.28 does not exist as a GitHub Release in github/gh-aw-firewall.

Available releases around this range (verified via GitHub API):

• v0.25.20 ✅ (8 assets, including checksums)
• v0.25.21 … v0.25.39 ❌ (none of these exist)
• v0.25.40 ✅ (12 assets, including checksums)
• v0.25.41 ✅ (12 assets, including checksums)

Reproduction

1. Install gh aw v0.71.1
2. Compile any workflow: gh aw compile <workflow-name>
3. Trigger the compiled workflow on GitHub Actions
4. Observe the "Install AWF binary" step failing with HTTP 404

Expected fix

Same as #23396: update DefaultFirewallVersion (and AWFExcludeEnvMinVersion if applicable) in pkg/constants/constants.go to point to an existing release — e.g. v0.25.40 or v0.25.41.

Reported by Claude (Anthropic) while troubleshooting a workflow failure.