[aw-maintenance:compiler-security] githubnext/gh-aw-workshop: actionlint strict-mode compile failure (aw_context undefined) + shellcheck & concurrency warnings

`githubnext/gh-aw-workshop` failed strict-mode compilation (exit code 1, 23 actionlint errors across 22 lock files). The dominant issue is a property `aw_context` referenced in expressions but not defined in the object schema, hit 17 times in `workshop-student-simulator.md`/`.lock.yml`, plus 6 shellcheck findings (styles/warnings, no criticals) in `workshop-ui-screenshots.lock.yml`, and 13 low-severity "missing concurrency job-discriminator" warnings across workflow_dispatch workflows. No container/image or license-scanner findings were present in the report. Highest-severity supported finding: actionlint strict-mode `error` (undefined `aw_context` property) — this blocks compilation and must be fixed first.

- **Target repository**: `githubnext/gh-aw-workshop`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `23`
- **Generated lock files checked**: `22`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|-------------|
| actionlint (expression) | workshop-student-simulator.md / .lock.yml | error | Property `aw_context` is not defined in object type `{}` (17 occurrences at lines 182, 260–263, 306–309, 526) | Fix the `.md` source expression referencing `aw_context` — either declare/pass the field in the workflow's context object or use the correct supported expression path, then recompile |
| actionlint (shellcheck) | workshop-ui-screenshots.lock.yml (run script line 497) | style/warning/info | SC2001 (use `${var//search/replace}`), SC2034 (`refs` unused), SC2094×2 (read/write same file in pipeline), SC2221/SC2222 (overlapping case patterns) | Rewrite the corresponding shell script block in the `.md` source: use parameter expansion instead of `sed`, remove or export the unused `refs` var, avoid reading and writing `image-refs.json` in the same pipeline, and reorder/de-duplicate the `case` patterns |
| gh-aw compiler (lint) | 13 workflow_dispatch workflows incl. curriculum-evaluator, docs-linker, guidelines-enforcer, manual-semver-release, markdown-dedup, security-side-quest, side-quest, training-plan-research, workflow-skills-editor, workshop-author, workshop-builder, workshop-explanatory-diagrams, workshop-skill-activity-author | warning | No `concurrency.job-discriminator`; generated conclusion concurrency group shared across all dispatches | Add a `concurrency.job-discriminator` (e.g. `${{ github.run_id }}`) to each affected `workflow_dispatch` workflow's frontmatter |

No container image vulnerability, license, poutine, runner-guard, grant, grype, or syft findings were reported.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `githubnext/gh-aw-workshop` repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw report excerpt (errors and warnings)

```
.github/workflows/workshop-student-simulator.lock.yml:182:51: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:260:80: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:260:200: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:261:82: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:261:204: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:262:75: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:262:190: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:263:72: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:306:80: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:306:200: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:307:82: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:307:204: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:308:75: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:308:190: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:309:72: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-student-simulator.lock.yml:526:130: error: [expression] property "aw_context" is not defined in object type {}
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2001:style — use ${variable//search/replace} instead
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2034:warning — refs appears unused
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2094:info — reading and writing same file in pipeline (x2)
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2221/SC2222:warning — overlapping case patterns
✗ actionlint failed
strict mode: actionlint found 23 errors in workflows - workflows must have no actionlint errors in strict mode

13x: .md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow.
```

Diff summary (22 lock files changed, generated only)

```
22 files changed, 11824 insertions(+), 7825 deletions(-)
```
No source `.md` files were modified by the compile step — only generated `.lock.yml` outputs changed as a byproduct of recompilation; these are not committed by this worker.

### Control Plane
- Correlation ID: `33834075588-34`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33834075588`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33834331713) · copilot · auto · 32.8 AIC · ⌖ 11 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 3:50 AM UTC

Start with the .github/workflows/workshop-student-simulator.md and workshop-ui-screenshots.md sources, not their generated .lock.yml files, and inspect the affected expressions and shell script. Review the frontmatter of the listed workflow_dispatch sources for concurrency settings. Use the gh-aw MCP fix and compile tools, then rerun strict compilation and the reported security checks until the findings are resolved or documented.

Written by the indexing model from the issue text.