[aw-maintenance:compiler-security] githubnext/gh-aw-workshop: strict-mode compiler failure (23 actionlint errors, 22 lock files)

Target `githubnext/gh-aw-workshop` failed strict-mode compilation (exit code 1) across 23 workflow sources / 22 lock files. Actionlint reported 23 errors: 16 `[expression] property "aw_context" is not defined in object type {}` errors in `workshop-student-simulator.md`, and 7 shellcheck findings (SC2001, SC2034, SC2094 x2, SC2221, SC2222) embedded in a script in `workshop-ui-screenshots.md`. Additionally, 13 workflows emit non-blocking warnings for missing `concurrency.job-discriminator` on `workflow_dispatch` triggers. No container-image, license, or dedicated security-scanner (zizmor/poutine/runner-guard/grype/syft) findings appear in the report. Highest severity: actionlint strict-mode errors (build-blocking); recommended next action is to run the local fixing loop against `workshop-student-simulator.md` and `workshop-ui-screenshots.md`.

- **Target repository**: `githubnext/gh-aw-workshop`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `23`
- **Generated lock files checked**: `22`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression check) | `workshop-student-simulator.md` | error | 16 occurrences of `property "aw_context" is not defined in object type {}` at various `${{ }}` expressions (lines 182, 260-263, 306-309, 526) | Fix the expression context reference so `aw_context` is a valid property of the referenced object, or use the correct context/step-output syntax; recompile with `gh aw compile` |
| actionlint (shellcheck integration) | `workshop-ui-screenshots.md` | style/info/warning (unknown aggregate severity) | 7 shellcheck findings in embedded script (line 497 region): SC2001 x2 (style — prefer `${variable//search/replace}`), SC2034 (warning — unused var `refs`), SC2094 x2 (info — read/write same file in pipeline), SC2221/SC2222 (warning — overlapping case patterns on lines 24-25) | Rewrite the shell script to use parameter expansion instead of `sed`, remove or use the unused `refs` variable, avoid reading/writing the same file in one pipeline, and reorder/merge the case patterns so they don't overlap |
| actionlint (concurrency check) | 13 `workflow_dispatch` workflows (curriculum-evaluator, docs-linker, guidelines-enforcer, manual-semver-release, markdown-dedup, security-side-quest, side-quest, training-plan-research, workflow-skills-editor, workshop-author, workshop-builder, workshop-explanatory-diagrams, workshop-skill-activity-author) | unknown (non-blocking warning) | Generated conclusion concurrency group is shared across all dispatches; no `concurrency.job-discriminator` set | Add a discriminator such as `${{ github.run_id }}` to `concurrency.job-discriminator` in each workflow's frontmatter |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler summary

```
Target: githubnext/gh-aw-workshop
Exit code: 1
Workflow sources: 23
Compiled locks: 22
```

Generated lock-file diff stat (22 files, +11824/-7825)

```
.github/workflows/aw-accuracy-reviewer.lock.yml | 860 +++++++++-------
.github/workflows/curriculum-evaluator.lock.yml | 853 +++++++++-------
.github/workflows/docs-linker.lock.yml | 933 ++++++++++--------
.github/workflows/guidelines-enforcer.lock.yml | 897 ++++++++++-------
.github/workflows/manual-semver-release.lock.yml | 833 +++++++++-------
.github/workflows/markdown-dedup.lock.yml | 884 ++++++++++-------
.github/workflows/q.lock.yml | 970 ++++++++++--------
.github/workflows/security-side-quest.lock.yml | 909 ++++++++++-------
.github/workflows/side-quest.lock.yml | 909 ++++++++++-------
.github/workflows/title-similarity-review.lock.yml | 832 +++++++++-------
.github/workflows/training-plan-research.lock.yml | 903 ++++++++++-------
.github/workflows/workflow-skills-editor.lock.yml | 907 ++++++++++-------
.github/workflows/workshop-author.lock.yml | 909 ++++++++++-------
.github/workflows/workshop-builder.lock.yml | 1030 ++++++++++++--------
.../workshop-explanatory-diagrams.lock.yml | 908 ++++++++++-------
.github/workflows/workshop-link-checker.lock.yml | 849 +++++++++-------
.github/workflows/workshop-order-review.lock.yml | 837 +++++++++-------
.github/workflows/workshop-playwright-qa.lock.yml | 905 ++++++++++-------
.../workshop-skill-activity-author.lock.yml | 907 ++++++++++-------
.../workflows/workshop-student-simulator.lock.yml | 856 +++++++++-------
.github/workflows/workshop-sync-check.lock.yml | 882 ++++++++++-------
.github/workflows/workshop-ui-screenshots.lock.yml | 876 ++++++++++-------
22 files changed, 11824 insertions(+), 7825 deletions(-)
```

Note: the large diff sizes reflect the compiler regenerating all lock files with the current toolchain version; they are not all attributable to the flagged findings.

Actionlint tool output (excerpt, credentials redacted if present)

```
✗ actionlint failed
strict mode: actionlint found 23 errors in workflows - workflows must have no actionlint errors in strict mode

16x [check-syntax-expression] workshop-student-simulator.lock.yml — property "aw_context" is not defined in object type {}
at lines: 182:51, 260:80, 260:200, 261:82, 261:204, 262:75, 262:190, 263:72, 306:80, 306:200, 307:82, 307:204, 308:75, 308:190, 309:72, 526:130

7x [check-shellcheck-integration] workshop-ui-screenshots.lock.yml:497:9
SC2001 (style) line 21:15 — prefer ${variable//search/replace}
SC2001 (style) line 22:16 — prefer ${variable//search/replace}
SC2034 (warning) line 12:1 — refs appears unused
SC2094 (info) line 26:27 — read/write same file in pipeline
SC2094 (info) line 32:12 — read/write same file in pipeline
SC2221 (warning) line 24:25 — pattern always overrides a later one on line 25
SC2222 (warning) line 24:31 — pattern never matches because of a previous pattern on line 25

13x [check-concurrency] workflow_dispatch workflows missing concurrency.job-discriminator (non-blocking warning)
```

### Control Plane
- Correlation ID: `33826939975-32`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33826939975`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33827307317) · copilot · auto · 34.4 AIC · ⌖ 7.91 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:56 AM UTC

Start with .github/workflows/workshop-student-simulator.md and workshop-ui-screenshots.md, where the strict-mode actionlint errors are reported. Use the gh-aw fixing loop and recompile with gh aw compile rather than editing generated .lock.yml files. Done means the 23 actionlint errors are resolved and strict compilation and the reported validation checks pass.

Written by the indexing model from the issue text.