[platform-assessment 2026-08] GitHub platform radar

[github-actions]

Overview

Assessment period: July 2026 – August 2026 (changes since the June 2026 assessment).
Repository scope: .github/workflows/, .github/aw/, modules/, agentic lock files.

---

Key Findings

#	Area	Assessment	Severity
1	gh-aw v0.81.6 → v0.84.2 (version gap + security fix)	adopt	🔴 High
2	Breaking compile changes in v0.83.5 & v0.82.10	evaluate	🟠 Medium
3	GitHub MCP Server v1.4.0 → v1.8.0	evaluate	🟡 Low–Medium
4	actions/checkout@v4 unpinned in non-lock workflows	watch	🟡 Low

---

Finding 1 — gh-aw version gap + security fix (adopt)

Source: https://github.com/github/gh-aw/releases (2026-07-22 through 2026-08-01)

Repository impact: All agentic lock files (*.lock.yml) carry the metadata header compiler_version: v0.81.6 — confirmed in gh-aw-drift-sentinel.lock.yml. The actions-lock.json at .github/aw/actions-lock.json pins github/gh-aw-actions/setup@v0.81.6 and github/gh-aw-actions/setup-cli@v0.81.6.

Assessment: adopt — v0.84.2 (2026-08-01) includes a security fix for an argument injection vulnerability (CWE-88) in the git archive fallback path (#49500). The lock files should be recompiled against the latest release via gh aw compile after reviewing the breaking changes below.

Evidence

From v0.84.2 release notes:

Fixed argument injection vulnerability (CWE-88) in the git archive fallback path (#49500)

Current pinned version: v0.81.6 (SHA ba6380cc6e5be5d21677bebe04d52fb48e3abec7)
Latest available: v0.84.2 (2026-08-01)

---

Finding 2 — Breaking compile changes (evaluate)

Source: https://github.com/github/gh-aw/releases/tag/v0.83.5 (2026-07-29), https://github.com/github/gh-aw/releases/tag/v0.82.10 (2026-07-16)

Repository impact: Any .github/agents/*.agent.md or agentic workflow .md source files that reference agent-job step outputs in the prompt body, or declare inputs: under a custom job, will fail to recompile. The agentics-maintenance.yml and other lock files will need source review before upgrading.

Assessment: evaluate — Before running gh aw compile to upgrade, audit all .md source files:

1. v0.83.5 — Referencing agent-job step outputs directly in a prompt body is now a compile error. Move such values into env: and interpolate from there.
2. v0.83.5 — Declaring inputs: under a custom job is now rejected at compile time.
3. v0.82.10 — Strict security mode is now the default: sudo injection and --enable-host-access are no longer injected automatically. Any workflow relying on these must opt in explicitly.

Evidence

From v0.83.5 release notes:

⚠️ Breaking Changes

• Referencing agent-job step outputs directly in a prompt body is now a compile error (#48610) — move such values into env: and interpolate from there instead.
• Declaring inputs: under a custom job is now rejected at compile time (#48607).

From v0.82.10 release notes:

⚠️ Breaking Changes

• Strict security mode is now the default — sudo injection and --enable-host-access are no longer injected automatically.

---

Finding 3 — GitHub MCP Server v1.4.0 → v1.8.0 (evaluate)

Source: https://github.com/github/github-mcp-server/releases (2026-07-15 through 2026-07-30)

Repository impact: All lock files pin the MCP server container at ghcr.io/github/github-mcp-server:v1.4.0@sha256:2afb26356481d1a350e14544a6e160f7f7ec1561a1ea309b823665abf0309036 (confirmed in gh-aw-drift-sentinel.lock.yml manifest). Releases v1.5.0, v1.6.0, v1.7.0 (referenced in gh-aw v0.83.3 as the "updated default"), and v1.8.0 (2026-07-30) are now available.

Assessment: evaluate — gh-aw v0.83.3 already updated its default to v1.7.0; recompiling against v0.84.2 will automatically pick up v1.8.0. No manual action needed beyond the upgrade in Finding 1.

Evidence

From v0.83.3 release notes:

GitHub MCP Server v1.7.0 — Updated the default GitHub MCP server to v1.7.0, bringing the latest MCP tool improvements to all workflows.

Current pinned: v1.4.0 (2026-06-18)
Latest available: v1.8.0 (2026-07-30)
Affected paths: all *.lock.yml container manifests

---

Finding 4 — actions/checkout@v4 unpinned (watch)

Source: Repository files .github/workflows/build-deploy.yml, .github/workflows/validate.yml

Repository impact: These two hand-authored workflows (not generated by gh-aw) reference actions/checkout@v4 and actions/setup-node@v4 by floating major-version tags rather than pinned SHAs. This is inconsistent with the gh-aw-compiled lock files, which pin to SHAs.

Assessment: watch — No active exploit, but floating tags are a supply-chain risk. Consider pinning to SHA (as the lock files do).

---

Next Actions

1. Review all .github/agents/*.agent.md source files for v0.83.5 breaking patterns (step-output refs in prompt body; inputs: under custom jobs).
2. Upgrade by running gh aw compile against v0.84.2 to apply the CWE-88 security fix and pick up MCP Server v1.8.0 automatically.
3. Verify that no workflow relies on implicit sudo or --enable-host-access (v0.82.10 strict security default).
4. Consider pinning actions/checkout and actions/setup-node in build-deploy.yml and validate.yml to SHA references.

References:

• §30704022956
• gh-aw v0.84.2
• github-mcp-server v1.8.0

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.blog

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.blog"

See Network Configuration for more information.

Generated by Platform Radar · 40.2 AIC · ⌖ 6.36 AIC · ⊞ 5.1K · ◷

[github-actions]

Documentation Watch — 2026-08-03

Scope reviewed: modules/ghec/challenges/ch19-*, modules/ghec/challenges/ch34-*, modules/ghec/challenges/ch30-*, .github/agents/squad.agent.md, .agents/skills/content-review/references/trusted-sources.md, docs/EXTERNAL-REPOS.md, README.md, modules/ghaw/setup.md — representative sample; no material issues found in the latter four.

---

Finding — Stale "Copilot coding agent" product name in two files

Source: Official docs URLs already embedded in this repository:

• https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-cloud-agent (ch19 reference links)
• https://docs.github.com/en/enterprise-cloud@latest/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/create-custom-agents (ch34 reference links)

The cloud-agent path in these official docs.github.com URLs, and the activity title "Ch19 — Copilot Cloud Agent", confirm GitHub now uses Copilot cloud agent as the product name. The term "Copilot coding agent" for the GitHub-built issue-assignment feature is stale.

Repository impact: Two files use the old product name in contexts that describe the GitHub-built feature (not third-party coding agents, which retain a distinct identity):

File	Line	Stale text
modules/ghec/challenges/ch19-copilot-coding-agent/README.md	122	"the Copilot coding agent now has a real candidate task"
.github/agents/squad.agent.md	~line 5 & section header	"GitHub Copilot coding agent" / "## Copilot Coding Agent Member"

Note: uses of "third-party coding agents" and "AI coding agents" (generic) elsewhere in the repo are not affected — those refer to a distinct category and the term remains valid.

Assessment: evaluate

Rationale: The official docs links embedded in the repository itself already resolve to cloud-agent paths, meaning participants following reference links would see "Copilot cloud agent" while the squad agent and one validation checklist item still say "Copilot coding agent." Confidence is high based on the canonical docs.github.com URL evidence already present in the repo. No documentation changes are recommended from this assessment (per workflow contract) — this is a flag for the content owner to verify and update if confirmed.

References:

• §30796906833
• docs.github.com — About Copilot cloud agent

Generated by Documentation Link and Product-Term Watcher · 38.2 AIC · ⌖ 5.7 AIC · ⊞ 5K · ◷

[github-actions]

Documentation Watch — 2026-08 update

Scope reviewed this run: modules/ghec/challenges/ch19-copilot-coding-agent/README.md, modules/ghec/resources/provisioning/challenges/_TEMPLATE/README.md, modules/ghec/challenges/ch30-copilot-ai-governance/README.md, README.md, SECURITY.md, CONTRIBUTING.md, modules/ghaw/, docs/ (representative sample).

---

Finding — Stale product terminology: "Copilot coding agent"

Source: docs.github.com/en/copilot/concepts/agents/cloud-agent/about-cloud-agent — canonical product name is Copilot cloud agent (formerly Copilot coding agent).

Assessment: watch

Rationale: The product rename is confirmed by the official docs URL path (cloud-agent/) and the docs linked in ch19/meta.yml. Most of ch19/README.md already uses the correct term, but two locations still use the old name in customer-visible text:

Path	Line	Stale text
modules/ghec/challenges/ch19-copilot-coding-agent/README.md	122	the Copilot coding agent now has a real candidate task and review gate
modules/ghec/resources/provisioning/challenges/_TEMPLATE/README.md	27	"Copilot coding agent policy enabled (NOT available on EMU repos)"

The ch30 references (coding-agent use, third-party coding-agent policy) appear to be generic descriptive use rather than product-name references and do not require action.

No broken links were found in the sampled official GitHub URLs; all docs.github.com paths follow the current cloud-agent structure.

Next action: Update the two lines above to use "Copilot cloud agent" / "Copilot cloud agent policy" to match current official product terminology. No pull request is created by this workflow — remediation is a manual edit.

References:

• §31367180119
• About Copilot cloud agent

Generated by Documentation Link and Product-Term Watcher · 28.4 AIC · ⌖ 5.62 AIC · ⊞ 5K · ◷

[github-actions]

Documentation Link Watch — 2026-08-17

Scope: Representative scan of modules/ghec/challenges/ and customer-facing docs for broken or redirected official GitHub URLs.

---

🟡 Finding — Redirected docs.github.com URL

Source: https://docs.github.com/en/copilot/managing-copilot/managing-github-copilot-in-your-organization/managing-policies-for-copilot-in-your-organization
Redirects to (HTTP 301): https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies
Repository impact: Two files contain the old URL:

• modules/ghec/challenges/ch19-copilot-coding-agent/README.md (line 137)
• modules/ghec/challenges/ch19-copilot-coding-agent/meta.yml (line 46)

Assessment: watch
Rationale: The URL currently redirects correctly (301 → 200), so readers are not blocked. However, the redirect indicates the docs have been reorganized under the new how-tos/administer-copilot/ path structure. If GitHub removes the redirect in a future docs cleanup, the link will break. The new canonical URL is confirmed reachable and correct.

Verification evidence

curl -s -o /dev/null -w "%{http_code} %{redirect_url}" \
  "https://docs.github.com/.../managing-policies-for-copilot-in-your-organization"
→ 301 https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies

curl -s -o /dev/null -w "%{http_code}" \
  "https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies"
→ 200

All other sampled docs.github.com/en/copilot/ URLs in ch19, ch30, ch31, ch33, ch34 returned 200 directly with no redirects.

---

✅ No Other Issues Found

All other sampled official GitHub URLs across modules/ghec/challenges/, modules/ghaw/setup.md, modules/ghas/setup.md, README.md, CONTRIBUTING.md, and .devcontainer/README.md returned HTTP 200 with no redirects.

---

Next Action

Update the two affected files to use the canonical URL https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies when next editing ch19-copilot-coding-agent.

References:

• §32006193917
• Canonical URL

Generated by Documentation Link and Product-Term Watcher · 37.6 AIC · ⌖ 5.7 AIC · ⊞ 5K · ◷