[platform-assessment 2026-09] gh-aw Drift Sentinel findings #19

gh-aw Drift Sentinel — 2026-09

Scope checked: 6 workflow sources (ci-doctor, documentation-watch, gh-aw-drift-sentinel, issue-triage-agent, next-feature-opportunities, platform-radar), their .lock.yml outputs, .github/aw/actions-lock.json, and shared imports under .github/workflows/shared/. No agentics-maintenance.yml file exists in this repository.

Finding 1 — Pinned gh-aw compiler is 3 releases behind latest stable

• Source: https://github.com/github/gh-aw/releases/tag/v0.87.10 (published 2026-08-31)
• Repository impact: All 6 .lock.yml files embed "compiler_version":"v0.86.2" (released 2026-08-11), matching .github/aw/actions-lock.json pin github/gh-aw-actions/setup@v0.86.2. Latest stable is v0.87.10.
• Assessment: watch
• Rationale: Lock files are internally consistent (identical compiler version, action SHAs, and container digests across all 6 workflows), so there is no source-to-lock mismatch to fix. v0.87.10 adds on.cooldown and typed on.stop-after, neither used in this repo's frontmatter, and no schema fields were removed that these workflows rely on (no top-level roles:, no max-runs, no on.stop-after). No immediate compile-time break is evidenced. Confidence: medium — recommend re-running gh aw compile on the next scheduled maintenance pass to pick up the container/action bumps below.

Finding 2 — Pinned firewall and MCP Gateway containers are behind the versions shipped with v0.87.10

• Source: https://github.com/github/gh-aw/releases/tag/v0.87.10
• Repository impact: All 6 lock files pin ghcr.io/github/gh-aw-firewall/*:0.27.44 and ghcr.io/github/gh-aw-mcpg:v0.4.9. Release notes for v0.87.10 state the Firewall was bumped to v0.28.10 (PR #56914) and MCP Gateway to v0.4.14 (PR #57188), with gateway compiler output migrated to agentId (PR #56990).
• Assessment: watch
• Rationale: These are security/network-isolation and MCP-proxy components; staying multiple versions behind is not itself a break, but the agentId/agentIds schema change (PR #56939, now validated as mutually exclusive) could affect tools.github or other MCP declarations if this repo ever adds agentId/agentIds fields. No such fields exist today in any workflow, so no repository-specific action is required yet. Recommend re-checking after the next gh aw compile run updates the pins.

No action required:

• No source/lock frontmatter or body hash mismatches found (all .lock.yml metadata comments are present and consistent with committed .md sources by lock timestamp ordering).
• No usage of deprecated/removed configuration (top-level roles:, non-positive max-runs) found in any workflow frontmatter.
• Shared imports (otlp.md, github-guard-policy.md, platform-maintenance.md, reporting.md) use only stable, currently-supported frontmatter keys (network.allowed, observability.otlp, tools.github.approval-labels).

References:

• §33518634096

Generated by gh-aw Drift Sentinel · auto · 37.2 AIC · ⌖ 1.38 AIC · ⊞ 7.9K · ◷