[aw-maintenance:compiler-security] github/gh-aw-mcpg: actionlint shellcheck errors block strict-mode compile in release.md

Compiling all 36 workflow sources in `github/gh-aw-mcpg` (target SHA `97a3970b35f6c076d596c650e462755b0b48215f`) with strict validation exits **code 1**: actionlint found 5 shellcheck errors in `.github/workflows/release.lock.yml` (generated from `release.md`), so the repository does not compile cleanly. No container/license/vulnerability scanner findings were present in the captured report. Highest-severity supported finding: actionlint (error-level) SC2001/SC2086 shell-quoting issues in the `release.md` run step. Recommended next action: run the local fixing loop below to have a coding agent fix the shell script and recompile until strict validation passes.

- **Target repository**: `github/gh-aw-mcpg`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `36`
- **Generated lock files checked**: `36` (22 changed vs. prior locks per diff-stat)
- **Result**: `findings`

### Findings

| Tool | Workflow/File | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | `release.md` → `release.lock.yml:1410` | error | SC2001: use `${variable//search/replace}` instead of `sed`-style substitution | Rewrite the shell snippet in `release.md` to use parameter expansion instead of `sed`, then recompile |
| actionlint (shellcheck) | `release.md` → `release.lock.yml:1410` | error (info in shellcheck) | SC2086 (×4, lines 12–15): unquoted variables allow globbing/word splitting | Double-quote the affected variable expansions in the `release.md` run step |
| gh-aw compiler | `github-mcp-guard-coverage-checker.md` | warning | Missing `pull-requests: read` permission required by the `pull_requests` GitHub toolset | Add `permissions: pull-requests: read` to frontmatter, or remove the `pull_requests` toolset requirement |
| gh-aw compiler | `gpl-dependency-checker.md`, `mcp-gateway-log-analyzer.md`, `release.md`, `test-improver.md` | warning | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/` | Update prompts to use `/tmp/gh-aw/agent/` as the temp-file root |
| gh-aw compiler | `release.md` | warning | `workflow_dispatch` has no `concurrency.job-discriminator`; conclusion concurrency group shared across dispatches | Add a discriminator such as `${{ github.run_id }}` to the concurrency config |
| gh-aw compiler | `release.md` | warning | `push-to-pull-request-branch` target `"*"` requires wildcard PR-branch fetch, but checkout lacks `fetch: ["*"]` | Add `checkout: fetch: ["*"]` and `fetch-depth: 0` to the workflow |

No container image, license, or dedicated security-scanner (zizmor/poutine/runner-guard/grype/syft) findings were present in the captured `report.txt`; guard-policy dry-run notices and "use ecosystem identifiers instead of domain names" recommendations were informational only and are not included as findings.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler/actionlint output (bounded excerpt)

```
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] shellcheck reported issue in this script: SC2001:style:12:15: See if you can use ${variable//search/replace} instead
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] shellcheck reported issue in this script: SC2086:info:12:20: Double quote to prevent globbing and word splitting
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] shellcheck reported issue in this script: SC2086:info:13:14: Double quote to prevent globbing and word splitting
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] shellcheck reported issue in this script: SC2086:info:14:14: Double quote to prevent globbing and word splitting
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] shellcheck reported issue in this script: SC2086:info:15:14: Double quote to prevent globbing and word splitting
✗ actionlint failed
strict mode: actionlint found 5 errors in workflows - workflows must have no actionlint errors in strict mode
```

Generated lock-file diff summary (22 files changed, 875 insertions, 771 deletions)

```
.../workflows/daily-compliance-checker.lock.yml | 75 ++++++++++---------
.github/workflows/duplicate-code-detector.lock.yml | 75 ++++++++++---------
.../workflows/gateway-issue-dispatcher.lock.yml | 75 ++++++++++---------
.github/workflows/ghcr-download-tracker.lock.yml | 75 ++++++++++---------
.../github-mcp-guard-coverage-checker.lock.yml | 59 ++++++++-------
.github/workflows/go-fan.lock.yml | 57 ++++++++-------
.github/workflows/go-logger.lock.yml | 75 ++++++++++---------
.github/workflows/gpl-dependency-checker.lock.yml | 75 ++++++++++---------
.github/workflows/guard-status-tracker.lock.yml | 75 ++++++++++---------
.../workflows/integrity-filtering-audit.lock.yml | 75 ++++++++++---------
.github/workflows/issue-monster.lock.yml | 83 ++++++++++++----------
.../workflows/mcp-gateway-log-analyzer.lock.yml | 75 ++++++++++---------
.github/workflows/nightly-docs-reconciler.lock.yml | 75 ++++++++++---------
.github/workflows/nightly-schema-updater.lock.yml | 75 ++++++++++---------
.../workflows/nightly-workflow-compiler.lock.yml | 75 ++++++++++---------
.github/workflows/plan.lock.yml | 79 ++++++++++----------
.github/workflows/release.lock.yml | 79 ++++++++++----------
.github/workflows/repo-assist.lock.yml | 82 ++++++++++-----------
.github/workflows/rust-guard-improver.lock.yml | 75 ++++++++++---------
.../workflows/semantic-function-refactor.lock.yml | 75 ++++++++++---------
.github/workflows/test-coverage-improver.lock.yml | 79 ++++++++++----------
.github/workflows/test-improver.lock.yml | 78 ++++++++++----------
22 files changed, 875 insertions(+), 771 deletions(-)
```

### Control Plane
- Correlation ID: `33826939975-32`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33826939975

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33827351466) · copilot · auto · 18.9 AIC · ⌖ 15 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:58 AM UTC

Start with .github/workflows/release.md and the actionlint findings reported at generated release.lock.yml:1410; use the gh-aw MCP fix and compile tools rather than editing generated lock files. Review the other named workflow sources for compiler warnings, then rerun strict validation and security checks until the workflows compile without findings.

Written by the indexing model from the issue text.