[aw-maintenance:compiler-security] gh-aw compiler validation failure in github/gh-aw-threat-detection: stale lock files + zizmor strict-mode failure

Compiling all 7 GitHub Agentic Workflows in `github/gh-aw-threat-detection` (target SHA `df194f7a1398a8e913b588dddea11ee1d7718d86`) exited non-zero (exit code 1). No CVE/license/container-scanner findings were reported; the failure is a validation/compiler-consistency issue plus one lint warning and one anomalous zizmor strict-mode failure. Recommended next action: run the local fixing loop below to regenerate lock files and resolve the zizmor/lint findings.

- **Target repository**: `github/gh-aw-threat-detection`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `7`
- **Generated lock files checked**: `7`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compile (lock drift) | `.github/workflows/detection-failure-monitor.lock.yml`, `detection-stats-daily.lock.yml`, `gh-aw-issue-digest.lock.yml`, `gh-aw-parity-monitor.lock.yml`, `smoke-claude-standalone.lock.yml`, `smoke-codex-standalone.lock.yml`, `smoke-copilot-standalone.lock.yml` | unknown | All 7 committed `.lock.yml` files are stale: recompiling from the `.md` sources produces a diff of 440 insertions / 371 deletions across the 7 files, meaning the checked-in generated workflows do not match their current sources. | Run `gh aw compile` and commit the regenerated `.lock.yml` files so committed locks match sources. |
| actionlint (lint) | `.github/workflows/detection-stats-daily.md` | warning | `workflow_dispatch` workflow has no `concurrency.job-discriminator`; the generated conclusion concurrency group is shared across all dispatches, so overlapping dispatches can collide/cancel each other. | Add a discriminator, e.g. `${{ github.run_id }}`, to the workflow's concurrency configuration. |
| zizmor (security scanner) | all 7 compiled workflows | unknown | Compiler reported `✗ zizmor failed` under strict mode with the message "zizmor found 0 security warnings/errors in workflows" — the failure message is self-contradictory (0 findings but still treated as a strict-mode failure), so exit code 1 could stem from a scanner/compiler integration bug rather than an actual vulnerability. Needs human confirmation of root cause. | Re-run `gh aw compile` locally with the same strict flags after fixing the lock drift above; if zizmor still reports this message with 0 findings, treat it as a compiler/tooling bug and file it upstream rather than searching for a phantom vulnerability. |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`github/gh-aw-threat-detection`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler output (report.txt)

```text
.github/workflows/detection-stats-daily.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 7 files
i Running zizmor security scanner on 7 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

Lock-file diff summary (diff-stat.txt)

```text
.../workflows/detection-failure-monitor.lock.yml | 111 +++++++++---------
.github/workflows/detection-stats-daily.lock.yml | 115 ++++++++++---------
.github/workflows/gh-aw-issue-digest.lock.yml | 115 ++++++++++---------
.github/workflows/gh-aw-parity-monitor.lock.yml | 115 ++++++++++---------
.github/workflows/smoke-claude-standalone.lock.yml | 115 ++++++++++---------
.github/workflows/smoke-codex-standalone.lock.yml | 125 ++++++++++++---------
.../workflows/smoke-copilot-standalone.lock.yml | 115 ++++++++++---------
7 files changed, 440 insertions(+), 371 deletions(-)
```

### Control Plane

- Correlation ID: `33826939975-32`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33826939975`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33827371515) · copilot · auto · 16.6 AIC · ⌖ 9.25 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:57 AM UTC

Work in the target repository github/gh-aw-threat-detection, starting with the seven .github/workflows/*.md sources and their committed .lock.yml files. Run gh aw compile with the stated strict validation and inspect the lock-file diff, the detection-stats-daily concurrency warning, and the contradictory zizmor result. Done means sources and generated locks agree, the lint warning is resolved, and strict validation passes or the remaining compiler/scanner issue is documented for upstream.

Written by the indexing model from the issue text.