[aw-compat] Daily gh-aw compatibility audit (2026-09-14): 18/20 compile clean, pxt typo now 3rd-run repeat, testfx blocker resolved

Daily audit of gh-aw compatibility across public adopters — build, discover, clone, compile, and auto-fix 20 real-world repos with the latest local `gh-aw` build, then cluster whatever still fails.

### Key metrics

- Build: `gh-aw` @ `a013f5a` via `make build` — SUCCESS
- Repos selected (top 20 by stars, discovered via GitHub code search for the gh-aw lock-file marker): 20/20 cloned
- `compile --strict` before `fix --write`: **9/20 failed**
- `fix --write` auto-resolved: **7/9** (macios, vscode-powershell ×3 workflows, azure-sdk-for-go, ring, ggpubr, drasi-platform ×7 workflows, pydantic-ai)
- Still failing after fix: **2/20** — `OtterMind/Chat2DB`, `microsoft/pxt`

### Selection churn vs. 2026-09-11 run

Added `OtterMind/Chat2DB` (28,116★ — verified genuine adopter, not a name-squat: real `ai-issue-assistant.md`/`ai-pr-reviewer.md` sources) and `drasi-project/drasi-platform` (1,249★). Dropped `fsprojects/FSharp.Data` (873★) and `OpenMS/OpenMS` (620★).

### Resolved since last run — microsoft/testfx footer blocker

Flagged 2026-09-09 and 2026-09-11: `create-pull-request-review-comment.footer` had no codemod and permanently failed `--strict`. This run it compiles cleanly (36/36 workflows, 0 errors) — the repo's own `review-shared.md` has already migrated `footer` to live under `submit-pull-request-review`, matching what we suggested twice. No gh-aw action needed; closing this thread out.

### New pattern — codex engine silently ignores bash allow-listing

`OtterMind/Chat2DB`'s `ai-issue-assistant.md` and `ai-pr-reviewer.md` both use `engine: codex` with an explicit `tools.bash: ["gh *"]` allow-list, which the `codex` engine ignores at runtime. The codemod (`bash-allowlist-unsupported-engine-guided-error`) correctly detects this and *deliberately declines* to auto-fix — the two remediations (switch to an engine that enforces allow-lists, or widen to `bash: ["*"]`) are security-relevant judgment calls, not something a codemod should decide silently. This is working as intended. Only 1/20 repos hit it so far, below our bar for a standalone "missing codemod" issue — flagging here as a pattern to watch in case a second repo surfaces it.

### Escalating — microsoft/pxt: unknown GitHub tool typo, 3rd consecutive audit

`.github/workflows/documentation.md:20` lists `semantic_code_search` under `tools.github.allowed`. That name has never existed; the closest real entries are `semantic_issue_similarity_search` and `semantic_issues_search`. This is a mistake in pxt's own workflow source, not a gh-aw regression, and `fix --write` correctly leaves it alone (nothing safe to auto-correct). We've now seen the **identical failure on 2026-09-09, 2026-09-11, and 2026-09-14** — three separate daily audits, roughly 5 days, with no change. We checked and there's no open issue proposing a fix for the underlying DX gap.

**Suggested improvement:** when compile emits `Unknown GitHub tool(s): X`, suggest the closest valid name(s) by edit distance against `pkg/workflow/data/github_tool_to_toolset.json`, instead of listing the first few valid tools alphabetically. This would have caught pxt's typo at the user's own compile time on all three occasions, and is a generally useful DX improvement independent of any one repo.

Dominant auto-fixed cluster this run (no action needed)

5 repos / 6 workflow files failed `--strict` because `tools.github.min-integrity: none` requires an explicit `tools.bash`, and were cleanly auto-resolved by `fix --write` adding `tools.bash: false`:

- `dotnet/macios` — `ci-postmortem.md`
- `PowerShell/vscode-powershell` — `issue-comment-handler.md`, `issue-triage.md`, `stale-closer.md`
- `Azure/azure-sdk-for-go` — `issue-triage.md`
- `dgreif/ring` — `issue-triage.md`
- `kassambara/ggpubr` — `issue-triage.md`

Also auto-fixed: `drasi-project/drasi-platform` (7 workflows, `pull_request_target` + checkout flagged insecure) and `pydantic/pydantic-ai` (1 workflow, `workflow_run` missing branch restriction). All working exactly as designed — strict mode's security net catching real gaps, then resolving them automatically.

Full per-repo results (20/20)

| Repository | Stars | Compile before | Fix | Compile after |
|---|---|---|---|---|
| OtterMind/Chat2DB | 28,116 | fail | manual fix required | **fail** |
| pydantic/pydantic-ai | 19,919 | fail | fixed | pass |
| Jguer/yay | 13,747 | pass | — | pass |
| py-why/dowhy | 8,313 | pass | — | pass |
| ethereum/ethereum-org-website | 5,965 | pass | — | pass |
| camunda/camunda | 4,275 | pass | — | pass |
| shopware/shopware | 3,426 | pass | — | pass |
| dotnet/macios | 2,902 | fail | fixed | pass |
| Azure/azure-sdk-for-java | 2,565 | pass | — | pass |
| microsoft/pxt | 2,305 | fail | no fix available | **fail** |
| dotnet/android | 2,138 | pass | — | pass |
| PowerShell/vscode-powershell | 1,910 | fail | fixed | pass |
| Azure/azure-sdk-for-go | 1,853 | fail | fixed | pass |
| dgreif/ring | 1,520 | fail | fixed | pass |
| fabulous-dev/Fabulous | 1,274 | pass | — | pass |
| kassambara/ggpubr | 1,271 | fail | fixed | pass |
| drasi-project/drasi-platform | 1,249 | fail | fixed | pass |
| microsoft/testfx | 1,043 | pass | — | pass |
| fslaborg/Deedle | 1,005 | pass | — | pass |
| ionide/ionide-vscode-fsharp | 897 | pass | — | pass |

### Next steps

- No standalone "missing codemod" or "common syntax errors" issue this run — every widespread cluster was either already auto-fixed correctly or is a single-repo user mistake.
- Track the pxt typo across a 4th run; if still unresolved, consider whether daily-summary issues are the right escalation channel at all.
- Watch for a 2nd repo hitting the codex-bash-allowlist pattern before considering any codemod change there.

Run artifacts: `aw-compat/runs/2026-09-14-08-54-24-285/` in cache-memory (results.jsonl, per-repo logs, analysis-summary.md, error-clusters.json, missing-codemods.json).

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `api.anthropic.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "api.anthropic.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [🔧 Daily AW Cross-Repo Compile Check](https://github.com/github/gh-aw/actions/runs/34824829321) · claude · agent · 337 AIC · ⌖ 8.5 AIC · ⊞ 8.2K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fdaily-aw-cross-repo-compile-check%22&type=issues)
> - [x] expires on Sep 21, 2026, 1:16 AM UTC-08:00

Start with the pxt failure described in the audit and inspect pkg/workflow/data/github_tool_to_toolset.json, then trace where compile reports unknown GitHub tools. Compare the reported name against valid entries and determine how suggestions should be surfaced. Done means the compile output provides useful closest-name suggestions for typos such as semantic_code_search, with tests covering the behavior.

Written by the indexing model from the issue text.