[aw-maintenance:compiler-security] Compiler & security scan findings: github/gh-aw-firewall (exit code 1)

`github/gh-aw-firewall` compiled with 70 workflow sources / 70 lock files, but `gh aw compile` exited non-zero (exit code 1) due to 7 strict-mode actionlint/shellcheck errors, plus 26 workflow_dispatch concurrency-discriminator warnings, 12 privileged cloud-hypervisor sandbox-runtime warnings requiring human security review, 3 `/tmp/` path-hygiene warnings, and 1 `id-token: write` OIDC-permission warning. Highest severity supported by tooling: shellcheck `SC2038` (unsafe `find`/xargs filename handling) in `duplicate-code-detector.md`. Recommended action: run the local fixing loop below to resolve the strict-mode compiler errors, then re-run compilation.

- **Target repository**: `github/gh-aw-firewall`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `70`
- **Generated lock files checked**: `70`
- **Result**: `findings`

### Findings

| Tool | Workflow | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | duplicate-code-detector.md | warning (SC2038) | `find` output piped without `-print0`/`xargs -0`, unsafe for non-alphanumeric filenames | Use `find .. -print0 \| xargs -0 ..` or `find .. -exec .. +` |
| actionlint/shellcheck | duplicate-code-detector.md | style (SC2129) | Multiple individual `>>` redirects to same file | Group commands with `{ cmd1; cmd2; } >> file` |
| actionlint/shellcheck | smoke-chroot.md | warning (SC2155) | `export GOROOT=$(go env GOROOT)` masks command return value | Declare then assign: `local GOROOT; GOROOT=$(go env GOROOT)` |
| actionlint/shellcheck | smoke-claude.md | info (SC2086) | Unquoted variable expansions (3 occurrences) risk globbing/word-splitting | Quote variables, e.g. `"$EXPR_GITHUB_REPOSITORY"` |
| gh-aw compiler | 12 workflows (auth-doctor-updater, doc-maintainer, model-api-mapping-updater, sbx-gvisor-doc-updater, schema-sync, self-hosted-runner-doctor-updater, smoke-cloud-hypervisor-build-test, smoke-cloud-hypervisor-claude, smoke-cloud-hypervisor-codex, smoke-cloud-hypervisor, smoke-playwright-cloud-hypervisor, update-release-notes) | warning | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with an attached MCP gateway topology | Require human security review/explicit approval before merge or rollout |
| gh-aw compiler | 26 workflow_dispatch workflows | warning | Missing `concurrency.job-discriminator`; concurrent dispatches share one conclusion group | Add a discriminator such as `${{ github.run_id }}` |
| gh-aw compiler | build-test-network-isolation.md, network-isolation-test.md, self-hosted-runner-doctor.md | warning | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/` | Use `/tmp/gh-aw/agent/` for agent temp files so they are captured as run artifacts |
| gh-aw compiler | smoke-copilot-byok-aoai-entra.md | warning | Workflow grants `id-token: write` (OIDC) | Confirm audience validation and cloud trust-policy configuration are correct |

### Local fixing loop

1. Install or update the `gh-aw` extension, then configure your coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `github/gh-aw-firewall` checkout.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files directly.
3. Require the agent to repeat the full compiler validation and security scan (strict mode, actionlint, shellcheck) until it passes cleanly, or stop and explain any finding needing human action (e.g., the cloud-hypervisor sandbox reviews).

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler/scanner output (bounded)

```text
i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'cloud.google.com' → 'chrome', 'docs.github.com' → 'github'
.github/workflows/auth-doctor-updater.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'crates.io' → 'rust', 'bun.sh' → 'node', 'deno.land' → 'deno', 'jsr.io' → 'deno'
.github/workflows/build-test-network-isolation.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ as the root for all temporary files generated by the agent — its contents are uploaded as a run artifact.

i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'crates.io' → 'rust', 'bun.sh' → 'node', 'deno.land' → 'deno', 'jsr.io' → 'deno'
.github/workflows/build-test.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ as the root for all temporary files generated by the agent — its contents are uploaded as a run artifact.

.github/workflows/build-test.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/contribution-check.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/doc-maintainer.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'api.openai.com' → 'codex'
.github/workflows/model-api-mapping-updater.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'docs.docker.com' → 'containers'
.github/workflows/sbx-gvisor-doc-updater.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/schema-sync.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/security-guard.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/self-hosted-runner-doctor-updater.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/self-hosted-runner-doctor.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ as the root for all temporary files generated by the agent — its contents are uploaded as a run artifact.

.github/workflows/smoke-chroot.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-claude.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

i recommend using ecosystem identifiers instead of individual domain names for better maintainability: '*.vsblob.vsassets.io' → 'dotnet'
.github/workflows/smoke-cloud-hypervisor-build-test.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-cloud-hypervisor-build-test.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/smoke-cloud-hypervisor-claude.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-cloud-hypervisor-claude.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/smoke-cloud-hypervisor-codex.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-cloud-hypervisor-codex.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/smoke-cloud-hypervisor.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-cloud-hypervisor.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'chatgpt.com' → 'codex'
.github/workflows/smoke-codex.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-copilot-byok-aoai-apikey.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

.github/workflows/smoke-copilot-byok-aoai-entra.md: warning: This workflow grants id-token: write permission
OIDC tokens can authenticate to
... (truncated, see full report.txt artifact for complete output) ...
```

Diff summary (lock-file changes, first entries)

```text
.github/workflows/auth-doctor-updater.lock.yml | 61 +--------
.../build-test-network-isolation.lock.yml | 69 +++-------
.github/workflows/build-test.lock.yml | 60 ++------
.github/workflows/ci-cd-gaps-assessment.lock.yml | 60 ++------
.github/workflows/ci-doctor.lock.yml | 110 +++------------
.github/workflows/claude-token-optimizer.lock.yml | 60 ++------
.../workflows/claude-token-usage-analyzer.lock.yml | 60 ++------
.../cli-flag-consistency-checker.lock.yml | 60 ++------
.../workflows/config-consistency-auditor.lock.yml | 110 +++------------
.github/workflows/contribution-check.lock.yml | 60 ++------
.github/workflows/copilot-token-optimizer.lock.yml | 60 ++------
.../copilot-token-usage-analyzer.lock.yml | 60 ++------
.../workflows/dependency-security-monitor.lock.yml | 60 ++------
.github/workflows/doc-maintainer.lock.yml | 11 +-
.github/workflows/duplicate-code-detector.lock.yml | 60 ++------
.github/workflows/export-audit.lock.yml | 60 ++------
.../workflows/firewall-issue-dispatcher.lock.yml | 60 ++------
.../workflows/issue-duplication-detector.lock.yml | 112 +++------------
.github/workflows/issue-monster.lock.yml | 60 ++------
.../workflows/model-api-mapping-updater.lock.yml | 11 +-
.github/workflows/network-isolation-test.lock.yml | 69 +++-------
.../workflows/pelis-agent-factory-advisor.lock.yml | 110 +++------------
.github/workflows/plan.lock.yml | 60 ++------
.github/workflows/red-team-benchmark.lock.yml | 49 ++-----
.github/workflows/refactoring-scanner.lock.yml | 60 ++------
.github/workflows/sbx-gvisor-doc-updater.lock.yml | 11 +-
.github/workflows/sbx-rollout-monitor.lock.yml | 100 +++-----------
.github/workflows/schema-sync.lock.yml | 63 +--------
.github/workflows/secret-digger-claude.lock.yml | 141 +++----------------
.github/workflows/secret-digger-codex.lock.yml | 141 +++----------------
... (70 lock files modified total; see diff-stat.txt artifact for full list) ...
```

### Control Plane
- Correlation ID: `33826939975-32`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33826939975

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33827338019) · copilot · auto · 26.9 AIC · ⌖ 9.03 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:58 AM UTC

Start with the listed .github/workflows/*.md sources, especially duplicate-code-detector.md, smoke-chroot.md, and smoke-claude.md, then run the gh aw compile fixing loop with strict validation. Use the gh-aw MCP fix and compile tools rather than editing generated .lock.yml files. Done means the compiler and security scans pass cleanly, or remaining cloud-hypervisor findings have documented human approval.

Written by the indexing model from the issue text.