[aw-maintenance:compiler-security] Compiler exit 1 in github/gh-aw: zizmor strict-mode logic bug + widespread security-relevant warnings

Compiling all 299 gh-aw workflow sources in `github/gh-aw` (sha `76182db3eedf54cb4ac6e4415dca550bcb0f77c6`) exits with code 1. The proximate cause is a **compiler logic bug**: zizmor reports 0 findings yet strict mode still fails the run. Beyond that, 218 non-fatal warnings surfaced across categories — most notably 97 privileged-runtime notices, a wildcard PR-branch push target, and 44 safe-update "unapproved action" flags — worth triaging even though they didn't block compilation. Recommended next action: fix the zizmor strict-mode inversion first (it's currently the only reason exit code is non-zero), then address the wildcard push-target and permission warnings.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `299`
- **Generated lock files checked**: `299`
- **Result**: findings

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor (strict mode) | all 298 scanned files | unknown (contradictory) | `report.txt` line 1201-1202: `✗ zizmor failed` / `strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode`. The message states 0 findings but is still treated as a failure — this is the actual cause of exit code 1, not a real security defect in the scanned workflows. | Fix the strict-mode success/failure condition in the gh-aw compiler so a 0-finding zizmor run is treated as pass. |
| compiler (safe-outputs/push-to-pull-request-branch) | (workflow at report.txt:730) | medium | `push-to-pull-request-branch: target: "*"` allows pushing to any PR branch with no additional constraints. | Scope `target:` to specific branches/patterns instead of `*`. |
| compiler (sandbox.agent.runtime) | 97 workflows | unknown | `sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology` — requires human security review before merge/rollout. | Confirm each flagged workflow has documented, explicit human approval for this runtime, or switch to a non-privileged runtime. |
| compiler (safe update mode) | 44 workflows | unknown | Previously-approved actions `docker/build-push-action` / `docker/setup-buildx-action` were removed without re-approval. | Use `--approve` after review, or revert the unapproved removals. |
| compiler (permissions) | 8 workflows | unknown | Missing required permissions for GitHub toolsets (e.g. `issues: read`). | Add the listed permissions to workflow frontmatter or reduce required toolsets. |
| compiler (aw.json schema) | `.github/workflows/aw.json` | unknown | Repo config fails schema validation at `/auto_upgrade` (`oneOf` mismatch); compiler falls back to defaults. | Fix `aw.json` `auto_upgrade` field to match the expected schema (boolean or valid object shape). |
| compiler (pip package names) | 12 workflows | unknown | Invalid pip package names detected, e.g. shell-expression artifacts like `/tmp/gh-aw/python/venv/bin/python` or quoted strings passed as package specs. | Correct the `pip` package list entries to valid PyPI names; remove shell-substitution leakage into package specs. |
| compiler (concurrency) | 31 workflows | unknown | `workflow_dispatch` workflows lack `concurrency.job-discriminator`, sharing one concurrency slot across dispatches. | Add a discriminator such as `${{ github.run_id }}`. |

No actionlint, shellcheck, poutine, runner-guard, grant, grype, or syft findings were reported in `report.txt` beyond the sections above; those tools did not surface additional distinct findings in this run.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`github/gh-aw`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler summary

```
Target: github/gh-aw
Exit code: 1
Workflow sources: 299
Compiled locks: 299
```

Diff stat: 298 lock files changed, 15861 insertions(+), 36388 deletions(-) (regenerated locks from current sources vs. checked-in state).

Zizmor failure excerpt (report.txt lines 1198-1202)

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 298 files
i Running zizmor security scanner on 298 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

### Control Plane
- Correlation ID: `33830504321-33`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33830504321

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33830777688) · copilot · auto · 31.3 AIC · ⌖ 9.36 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 2:54 AM UTC

Start with the gh-aw compiler's zizmor strict-mode handling and use the MCP server's fix and compile tools as described. Review the affected .github/workflows/*.md sources and .github/workflows/aw.json, without editing generated .lock.yml files. Done means the full strict validation passes, or remaining findings are clearly documented as requiring human review.

Written by the indexing model from the issue text.