Context

gh-aw-firewall v0.25.10 now ships an esbuild single-file bundle (awf-bundle.js, ~357KB) alongside the traditional pkg binaries (~50MB). See github/gh-aw-firewall#1577.

GitHub hosted runners already have Node.js 22, so the lightweight bundle works out of the box — no need to download a 50MB binary that redundantly bundles the Node.js 18 runtime (which is EOL since April 2025).

Proposal

1. Bump AWF version to v0.25.10 in gh-aw's setup/install steps
2. Switch from the pkg binary (awf-linux-x64) to the esbuild bundle (awf-bundle.js) in the Actions setup step — this reduces download size from ~50MB to ~357KB per workflow run
3. Update the install command to use node awf-bundle.js instead of executing the standalone binary directly

Benefits

• ~140x smaller download per workflow run (357KB vs 50MB)
• Runs on a maintained Node.js runtime (runner's Node 22) instead of bundled Node 18 (EOL)
• Faster workflow startup — less time downloading and extracting the AWF binary

Notes

• The bundle requires Node.js >= 20 on the runner, which all GitHub hosted runners satisfy
• The bundle has the same CLI interface — no changes to AWF flags or invocation patterns
• --build-local is not supported in bundle mode (not relevant for CI usage)