[aw-maintenance:compiler-security] github/gh-aw compiler security report: zizmor strict-mode gate fails despite 0 findings (298 workflows)

Compiling all 298 `github/gh-aw` workflows with the full strict-mode compiler/scanner suite exited with code 1, but the only blocking condition is a self-contradictory zizmor gate message reporting **zero** findings while still failing. No actionlint/shellcheck/yamllint/poutine/runner-guard/grant/grype/syft failures were present. Recommended next action: investigate the strict-mode zizmor gate as a likely compiler bug in `github/gh-aw`, separate from workflow-source content; secondary informational warnings (KVM sandbox runtime review, action-pin churn, missing concurrency discriminators) are non-blocking and listed for completeness.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `298`
- **Generated lock files checked**: `298`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|-------------|
| gh-aw compile (zizmor strict-mode gate) | all 298 workflows (single repo-wide gate) | unknown | `✗ zizmor failed` printed with "zizmor found 0 security warnings/errors ... workflows must have no zizmor findings in strict mode" — gate fails despite reporting zero findings | Investigate the gh-aw compiler's strict-mode zizmor gate logic (likely treats a non-zero zizmor process exit, unrelated to actual findings, as a hard failure). Fix in `github/gh-aw` compiler code, not workflow `.md` sources. |
| gh-aw compile (aw.json schema) | `.github/workflows/aw.json` | warning | `auto_upgrade` object with `options` fails schema validation against `repo-config-schema.json`; compiler falls back to defaults | Update `aw.json` to match current schema for `auto_upgrade`, or update schema/docs if `options` is intentionally supported |
| gh-aw compile (sandbox runtime) | 97 workflows (e.g. `ace-editor.md`, `agentic-token-trend-audit.md`, `api-consumption-report.md`, ...) | warning | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with attached MCP gateway; requires human security review before merge/rollout | Confirm documented human security sign-off for each flagged workflow, or move off preview runtime until reviewed |
| gh-aw compile (safe update / action pin) | 44 workflows (e.g. `agent-job-health.md`, `agentic-token-audit.md`, `aw-failure-investigator.md`, ...) | info | Safe-update detected removal of previously-approved `docker/build-push-action` / `docker/setup-buildx-action` from generated locks | Review whether intentional (upstream compiler/pinning change); re-approve via `--approve` or revert |
| gh-aw compile (concurrency) | 31 `workflow_dispatch` workflows (e.g. `agentic-token-trend-audit.md`, `ci-doctor.md`, ...) | warning | Missing `concurrency.job-discriminator`; generated conclusion concurrency group shared across all dispatches | Add a discriminator such as `${{ github.run_id }}` to each affected workflow's concurrency config |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `github/gh-aw` repository checkout.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action — particularly the zizmor strict-mode anomaly, which may need a compiler code fix rather than a workflow-source change.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely — in particular, determine whether the `✗ zizmor failed` / "found 0 security warnings/errors" contradiction is a compiler bug in the strict-mode gate (in `github/gh-aw` source) rather than something fixable via workflow edits.

Raw compiler tail (zizmor gate failure)

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 298 files
i Running zizmor security scanner on 298 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

Diff summary

298 lock files changed, 15119 insertions(+), 35646 deletions(-) — consistent with a compiler/action-pin version bump regenerating all locks; no per-file security diff content beyond the warnings summarized above.

Warning category counts (from full report.txt)

- `sandbox.agent.runtime: cloud-hypervisor ...` — 97 occurrences
- `safe update mode detected unapproved changes` — 44 occurrences
- `workflow_dispatch workflow has no concurrency.job-discriminator` — 31 occurrences
- `Prompt references /tmp/ directly...` — 10 occurrences
- `Missing required permissions for GitHub toolsets` — 8 occurrences
- `sandbox.agent.config.filesystem.allowWrite is ignored...` — 3 occurrences
- Template separator mid-line warnings (`{{#if}}` / `{{/if}}`) — several, in `ab-testing-advisor.md` and similar files
- `checkout: repository "github/gh-aw-side-repo" has no explicit ref` — 2 occurrences
- No actionlint, shellcheck, yamllint, poutine, runner-guard, grant, grype, or syft failures captured in the report

### Control Plane
- Correlation ID: 33826939975-32
- Central repository: githubnext/gh-aw-cao
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33826939975

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33827293275) · copilot · auto · 40 AIC · ⌖ 9.54 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:59 AM UTC

Start by reproducing the full strict-mode compile for the 298 workflows and trace the zizmor gate in the github/gh-aw compiler source; no compiler file is named in the report. Confirm why a zero-finding zizmor result exits with failure, then rerun the same compiler and security validation to verify that the gate passes without masking real findings.

Written by the indexing model from the issue text.