[aw-maintenance:compiler-security] github/gh-aw-mcpg: actionlint strict-mode errors + compile warnings

gh-aw compiler validation failed for `github/gh-aw-mcpg` (exit code 1): actionlint reported 5 strict-mode shellcheck errors in `release.lock.yml`, plus 5 workflow warnings (1 missing permission, 3 `/tmp/` prompt references, 1 missing concurrency discriminator, 1 missing PR-branch fetch wildcard). Highest severity: actionlint errors (strict-mode, build-breaking). Recommended next action: run the local fixing loop below, prioritizing the `release.md` shellcheck fixes since they block compilation.

- **Target repository**: `github/gh-aw-mcpg`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `36`
- **Generated lock files checked**: `36`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | release.lock.yml:1410 | error (strict) | SC2001: prefer `${variable//search/replace}` over `sed`-style substitution | Rewrite the shell substitution in `release.md`'s run script using bash parameter expansion |
| actionlint (shellcheck) | release.lock.yml:1410 | error (strict, x3) | SC2086: unquoted variable expansions on script lines 12–15 may cause globbing/word splitting | Quote all variable expansions (`"$VAR"`) in the affected run step of `release.md` |
| gh-aw compile (permissions) | github-mcp-guard-coverage-checker.md | warning | Missing `pull-requests: read` permission required by the `pull_requests` toolset | Add `pull-requests: read` to workflow frontmatter permissions, or remove the `pull_requests` toolset |
| gh-aw compile (prompt lint) | gpl-dependency-checker.md, mcp-gateway-log-analyzer.md, release.md, test-improver.md | warning | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/` | Update prompts to use `/tmp/gh-aw/agent/` as the temp-file root so artifacts are captured |
| gh-aw compile (concurrency) | release.md | warning | `workflow_dispatch` trigger has no `concurrency.job-discriminator`; dispatches share one concurrency group | Add a discriminator (e.g. `${{ github.run_id }}`) to the workflow's concurrency config |
| gh-aw compile (safe-outputs) | release.md | warning | `push-to-pull-request-branch` uses `target: "*"` but checkout lacks a wildcard fetch pattern | Add `checkout: { fetch: ["*"], fetch-depth: 0 }` to the workflow frontmatter |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler/scanner output (bounded)

```text
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2001:style:12:15: See if you can use ${variable//search/replace} instead
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2086:info:12:20: Double quote to prevent globbing and word splitting
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2086:info:13:14: Double quote to prevent globbing and word splitting
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2086:info:14:14: Double quote to prevent globbing and word splitting
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2086:info:15:14: Double quote to prevent globbing and word splitting
✗ actionlint failed
strict mode: actionlint found 5 errors in workflows - workflows must have no actionlint errors in strict mode

.github/workflows/github-mcp-guard-coverage-checker.md: warning: Missing required permissions for GitHub toolsets:
- pull-requests: read (required by pull_requests)

.github/workflows/gpl-dependency-checker.md: warning: Prompt references /tmp/ directly.
.github/workflows/mcp-gateway-log-analyzer.md: warning: Prompt references /tmp/ directly.
.github/workflows/release.md: warning: Prompt references /tmp/ directly.
.github/workflows/test-improver.md: warning: Prompt references /tmp/ directly.

.github/workflows/release.md: warning: workflow_dispatch has no concurrency.job-discriminator.

⚠ push-to-pull-request-branch: target: "*" requires wildcard fetch at checkout; not configured.
```

No credential-like or token-like values were present in the compiler output.

Diff summary (22 lock files regenerated during compile)

```text
22 files changed, 875 insertions(+), 771 deletions(-)
```

These diffs reflect regenerated lock files produced during this dry-run compilation and are informational only — no changes were pushed to `github/gh-aw-mcpg`.

### Control Plane
- Correlation ID: `33830504321-33`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33830504321

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33830835353) · copilot · auto · 21.9 AIC · ⌖ 11.3 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 2:53 AM UTC

Start with .github/workflows/release.md and inspect the reported run script, then review github-mcp-guard-coverage-checker.md, gpl-dependency-checker.md, mcp-gateway-log-analyzer.md, and test-improver.md. Run the gh-aw compile validation and actionlint through the stated fixing loop; done means strict-mode errors and the listed compiler warnings are resolved without editing generated .lock.yml files.

Written by the indexing model from the issue text.