[aw-maintenance:compiler-security] Compiler warning + zizmor scanner failure in github/gh-aw-threat-detection (7 workflows)

Target `github/gh-aw-threat-detection` compiled with `gh aw compile` exit code **1** (findings). 7 workflow sources / 7 lock files were checked. One actionlint warning was found, and the zizmor security scanner step failed the strict-mode gate despite reporting 0 findings — this anomaly itself needs investigation before the run can be trusted as clean. Recommended action: run the local fixing loop below to resolve the concurrency warning and re-run the full compile+scan suite to confirm zizmor passes cleanly.

- **Target repository**: `github/gh-aw-threat-detection`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `7`
- **Generated lock files checked**: `7`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (gh-aw compiler) | `.github/workflows/detection-stats-daily.md` | warning | `workflow_dispatch` workflow has no `concurrency.job-discriminator`; generated conclusion concurrency group is shared by all dispatches | Add a discriminator such as `${{ github.run_id }}` to the workflow's concurrency configuration so each dispatch gets its own slot |
| zizmor (strict mode gate) | all 7 compiled workflows | unknown | Compile step reports "zizmor failed" / "strict mode: zizmor found 0 security warnings/errors in workflows — workflows must have no zizmor findings in strict mode" even though 0 findings were reported — exit-code/message mismatch prevents confirming a clean scan | Re-run the full compiler+scanner suite locally to reproduce; determine whether this is a zizmor exit-code bug, a strict-mode gate misconfiguration, or a suppressed finding, and fix accordingly before treating the workflow as clean |

Raw report.txt (bounded)

```
.github/workflows/detection-stats-daily.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 7 files
i Running zizmor security scanner on 7 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

Diff summary (lock file regeneration only, not reviewed as behavior change)

```
.../workflows/detection-failure-monitor.lock.yml | 111 +++++++++---------
.github/workflows/detection-stats-daily.lock.yml | 115 ++++++++++---------
.github/workflows/gh-aw-issue-digest.lock.yml | 115 ++++++++++---------
.github/workflows/gh-aw-parity-monitor.lock.yml | 115 ++++++++++---------
.github/workflows/smoke-claude-standalone.lock.yml | 115 ++++++++++---------
.github/workflows/smoke-codex-standalone.lock.yml | 125 ++++++++++++---------
.../workflows/smoke-copilot-standalone.lock.yml | 115 ++++++++++---------
7 files changed, 440 insertions(+), 371 deletions(-)
```

Untracked: `.github/aw/logs/` (compiler run artifacts, not part of source diff).

### Local fixing loop

1. Install/update the gh-aw extension (`gh extension install githubnext/gh-aw` or `gh extension upgrade gh-aw`), then configure your coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `github/gh-aw-threat-detection` repository root.
2. Give the agent the prompt below and require it to use the MCP server's `fix` and `compile` tools rather than editing generated `.lock.yml` files directly.
3. Require the agent to repeat the full compiler validation and security scan (strict mode, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, syft) until it passes cleanly, or stop and explain any finding that cannot be safely auto-fixed.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

### Control Plane
- Correlation ID: `33834075588-34`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33834075588

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33834353883) · copilot · auto · 15.4 AIC · ⌖ 7.7 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 3:51 AM UTC

Start with .github/workflows/detection-stats-daily.md and reproduce the report using gh aw compile from the github/gh-aw-threat-detection repository. Use the gh-aw MCP server's fix and compile tools, then rerun the full strict validation and security scan across all 7 workflows. Done means the concurrency warning is resolved and zizmor's exit status consistently confirms a clean scan.

Written by the indexing model from the issue text.