[aw-maintenance:compiler-security] Compiler validation failures in githubnext/gh-aw-workshop: expression-type errors and shellcheck findings (2 workflows)

The gh-aw compiler was run against **githubnext/gh-aw-workshop** (23 workflow sources, 22 generated lock files) with strict validation, actionlint, and shellcheck enabled. The compiler exited with code `1`. No dedicated container/vulnerability scanners (zizmor, poutine, runner-guard, grype, syft, grant) reported findings in the run's evidence — actionlint expression checks and shellcheck are the source of all 23 errors and 13 warnings below. Highest-severity supported finding: **actionlint expression-type errors** (build-breaking) in `workshop-student-simulator.md`, requiring a template fix before that workflow will compile cleanly. Recommended next action: run the local fixing loop below to correct the `aw_context` fallback expression and the shellcheck-flagged script, then recompile.

- **Target repository**: `githubnext/gh-aw-workshop`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `23`
- **Generated lock files checked**: `22`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | workshop-student-simulator.md | error | 16 occurrences: `property "aw_context" is not defined in object type {}` — the fallback expression `fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}')` fails type-checking because `github.event.inputs`/`client_payload` don't statically declare `aw_context`. | Adjust the source `.md` to reference `aw_context` via a context that actionlint recognizes (e.g., cast through `fromJSON(toJSON(github.event.inputs))` or use `github.event.inputs['aw_context']` bracket indexing), then recompile with `gh aw compile`. |
| shellcheck (SC2001, style) | workshop-ui-screenshots.md | unknown (style) | Script uses `sed` for substitution where `${variable//search/replace}` would suffice (2 occurrences). | Replace `sed` calls with bash parameter expansion. |
| shellcheck (SC2034, warning) | workshop-ui-screenshots.md | warning | Variable `refs` appears unused. | Remove or export `refs` if used externally. |
| shellcheck (SC2094, info) | workshop-ui-screenshots.md | info | 2 occurrences: script reads and writes the same file within one pipeline. | Use a temp file or restructure the pipeline to avoid same-file read/write. |
| shellcheck (SC2221/SC2222, warning) | workshop-ui-screenshots.md | warning | A `case` pattern always overrides a later one; the later pattern never matches. | Reorder or merge the overlapping `case` patterns. |
| gh-aw compiler (concurrency lint) | 13 workflows: curriculum-evaluator, docs-linker, guidelines-enforcer, manual-semver-release, markdown-dedup, security-side-quest, side-quest, training-plan-research, workflow-skills-editor, workshop-author, workshop-builder, workshop-explanatory-diagrams, workshop-skill-activity-author | warning | `workflow_dispatch` workflow has no `concurrency.job-discriminator`; the generated conclusion concurrency group is shared by all dispatches. | Add a discriminator such as `${{ github.run_id }}` to each workflow's concurrency config. |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence (bounded)

**summary.txt**
```
Target: githubnext/gh-aw-workshop
Exit code: 1
Workflow sources: 23
Compiled locks: 22
```

**Diff stat (22 lock files changed, 11824 insertions(+), 7825 deletions(-))** — full diff omitted for brevity; see `diff-stat.txt` in the run artifact for per-file counts.

**Sample actionlint error**
```
.github/workflows/workshop-student-simulator.lock.yml:182:51: error: [expression] property "aw_context" is not defined in object type {}
...
GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
```

**Sample shellcheck error**
```
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2001:style:21:15: See if you can use ${variable//search/replace} instead
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2034:warning:12:1: refs appears unused. Verify use (or export if used externally)
```

No token-like or credential-like values were present in the reviewed excerpts.

### Control Plane
- Correlation ID: `33830504321-33`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33830504321

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33830847991) · copilot · auto · 23.4 AIC · ⌖ 7.02 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 2:54 AM UTC

Start with .github/workflows/workshop-student-simulator.md and workshop-ui-screenshots.md, then review the listed workflow sources with missing concurrency discriminators. Run gh aw compile with strict validation, actionlint, and shellcheck enabled; use the reported generated lock-file locations to trace findings back to source files. Done means the compiler succeeds and the reported expression, shellcheck, and concurrency findings are resolved without editing generated lock files.

Written by the indexing model from the issue text.