[aw-maintenance:compiler-security] Compiler/security findings: github/gh-aw (zizmor strict-mode failure, config schema error, unapproved lock changes)

`github/gh-aw` failed strict-mode compiler validation (exit code 1): zizmor's security scanner reported findings that block strict mode across the 298-workflow suite, an `aw.json` repo-config file fails schema validation, 44 lock files show unapproved action removals (`docker/build-push-action`, `docker/setup-buildx-action`) under safe-update-mode guard, and one workflow uses an unconstrained `push-to-pull-request-branch: target: "*"`. Highest severity supported by tooling: **zizmor strict-mode failure** (severity not disclosed by the tool in this run — only pass/fail). Recommended next action: run the local fixing loop below to resolve the zizmor findings and re-approve or revert the removed Docker actions.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `298`
- **Generated lock files checked**: `298`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler (zizmor invocation) | all 298 workflows (suite-wide) | unknown | `zizmor failed` — strict mode requires zero zizmor findings; the compiler reported a non-zero zizmor result without printing per-finding detail in this run's captured output | Re-run `gh aw compile` locally with zizmor's verbose/JSON output to enumerate the specific finding(s), then fix the underlying workflow source and recompile until zizmor reports 0 findings |
| gh-aw compiler (config loader) | `.github/workflows/aw.json` | warning | `aw.json` does not match the expected repo-config schema: `/auto_upgrade` fails `oneOf` (got object, additional property `options` not allowed); compiler falls back to defaults (168h `action_failure_issue_expires`) | Fix `auto_upgrade` in `aw.json` to match the schema (boolean, or the documented object shape without `options`) |
| gh-aw compiler (safe-update guard), 44 workflows including `ace-editor.md`, `audit-workflows.md`, `cloclo.md`, `security-review.md`, `weekly-blog-post-writer.md`, `workflow-normalizer.md` (full list in details) | 44 lock files | warning | Safe update mode detected previously-approved actions removed from generated locks: `docker/build-push-action`, `docker/setup-buildx-action` | Use `--approve` if the removal is intentional, or revert the source change removing these actions; do not hand-edit `.lock.yml` |
| gh-aw compiler (guard/push-safety lint), workflow near `pr-nitpick-reviewer.md`/`pr-sous-chef.md` in scan order | 1 workflow | warning | `push-to-pull-request-branch: target: "*"` allows pushing to any PR branch with no additional constraints | Add `required-title-prefix:` or `required-labels:` to restrict which PRs can receive pushes |
| gh-aw compiler (shell-injection lint) | `dataflow-pr-discussion-dataset.md` | warning | `${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}` extracted from a `run:` script into an env var to prevent shell injection (auto-fixed by compiler, flagged for awareness) | No action required; compiler already applied the safe extraction |
| gh-aw compiler (sandbox review lint) | 100 workflows (suite-wide) | warning | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with an attached MCP gateway topology; requires human security review before merge/rollout | Record explicit human security-review approval for each flagged workflow before merge, per compiler guidance |
| gh-aw compiler (concurrency lint) | 31 `workflow_dispatch` workflows | warning | No `concurrency.job-discriminator`; generated conclusion concurrency group is shared across all dispatches | Add a discriminator, e.g. `${{ github.run_id }}`, to give each dispatch its own concurrency slot |
| gh-aw compiler (pip package lint) | multiple workflows (12 occurrences, 4 distinct invalid names, e.g. `/tmp/gh-aw/python/venv/bin/python`, `"mempalace==3.2.0"`) | warning | Invalid PyPI package names detected in pip install steps (paths/quoted strings misidentified as package names) | Review the flagged `pip install` invocations and ensure only valid PyPI package specifiers are passed, quoting/escaping issues aside |

All 44 workflows flagged for unapproved lock-file changes

ace-editor.md, agent-job-health.md, agent-performance-analyzer.md, agent-persona-explorer.md, agentic-token-audit.md, agentic-token-trend-audit.md, api-consumption-report.md, archivx-agentic-workflows-analyzer.md, audit-workflows.md, aw-failure-investigator.md, cloclo.md, copilot-pr-prompt-analysis.md, daily-agent-of-the-day-blog-writer.md, daily-agentrx-trace-optimizer.md, daily-ambient-context-optimizer.md, daily-cache-strategy-analyzer.md, daily-cli-tools-tester.md, daily-evals-report.md, daily-firewall-report.md, daily-go-test-stubs-aider.md, daily-grader-audit.md, daily-model-inventory.md, daily-model-resolution.md, daily-multi-device-docs-tester.md, daily-observability-report.md, daily-rendering-scripts-verifier.md, daily-safe-output-optimizer.md, daily-security-observability.md, daily-spending-forecast.md, daily-squid-image-scan.md, daily-storify.md, deep-report.md, detection-analysis-report.md, dev-hawk.md, example-permissions-warning.md, example-workflow-analyzer.md, mcp-inspector.md, metrics-collector.md, prompt-clustering-analysis.md, python-data-charts.md, q.md, safe-output-health.md, security-compliance.md, security-review.md, smoke-claude.md, smoke-codex.md, smoke-copilot-aoai-apikey.md, smoke-copilot-aoai-entra.md, smoke-copilot-arm.md, smoke-copilot.md, static-analysis-report.md, visual-regression-checker.md, weekly-blog-post-writer.md, workflow-normalizer.md

Raw evidence: exit code, summary, zizmor failure excerpt

```
Target: github/gh-aw
Exit code: 1
Workflow sources: 298
Compiled locks: 298
```

Final lines of `report.txt`:
```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 298 files
i Running zizmor security scanner on 298 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

`aw.json` schema warning:
```
.github/workflows/aw.json: warning: failed to load aw.json; compilation will continue with defaults, and action_failure_issue_expires will fall back to 168 hours where applicable: .github/workflows/aw.json does not match the expected schema: jsonschema validation failed with '(contoso.com/redacted)
- at '/auto_upgrade': 'oneOf' failed, none matched
- at '/auto_upgrade': got object, want boolean
- at '/auto_upgrade': additional properties 'options' not allowed. See the repo config documentation for the required fields
```

Note: no other actionlint/shellcheck/pyflakes error lines, no container/license/vulnerability-scanner (grype/syft/grant/poutine/runner-guard) findings, and no CVE identifiers were present anywhere in the captured `report.txt`. The zizmor failure line itself does not enumerate individual findings in this run's output — the compiler only reports the strict-mode pass/fail gate.

Generated diff summary

```
298 files changed, 15119 insertions(+), 35646 deletions(-)
```

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

### Control Plane
- Correlation ID: `33824386621-31`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33824386621

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33824822223) · copilot · auto · 60.2 AIC · ⌖ 9.76 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:24 AM UTC

Start by running `gh aw compile` with zizmor verbose or JSON output to enumerate the strict-mode findings across `.github/workflows/*.md`. Review `.github/workflows/aw.json` against the documented schema and inspect the reported workflow sources; do not hand-edit generated `.lock.yml` files. Done means strict validation passes, configuration and safety warnings are resolved or explicitly approved, and the full compiler scan is clean.

Written by the indexing model from the issue text.