[aw-maintenance:compiler-security] github/gh-aw-firewall: actionlint strict-mode failures block compilation (7 shellcheck errors)

Compiling all 70 gh-aw workflow sources in `github/gh-aw-firewall` (target SHA `dc72343`) with `gh aw compile --strict` **fails** (exit code 1). Strict mode rejects the build because `actionlint`'s embedded shellcheck integration reports 7 errors across 3 generated lock files. No vulnerable container images, license issues, or other scanner findings were reported; all remaining output consists of advisory warnings (ecosystem-identifier suggestions, `cloud-hypervisor` sandbox review reminders, missing `concurrency.job-discriminator`, `/tmp/` path usage, and an `id-token: write` OIDC warning) that do not block compilation. Highest-severity supported finding: **shellcheck errors (actionlint strict-mode failure, severity as reported: warning/info within actionlint, but treated as blocking error by strict mode)**. Recommended next action: fix the 3 flagged workflow scripts and recompile.

- **Target repository**: `github/gh-aw-firewall`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `70`
- **Generated lock files checked**: `70` (68 scanned by actionlint)
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Tool-reported severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | `duplicate-code-detector.lock.yml` | warning (SC2038) ×2 | `find` output piped without `-print0`/`xargs -0`, unsafe for non-alphanumeric filenames | Use `find .. -print0 \| xargs -0 ..` or `find .. -exec .. +` in the source `.md`'s script step |
| actionlint (shellcheck) | `duplicate-code-detector.lock.yml` | style (SC2129) | Multiple individual `>>` redirects instead of grouped `{ ...; } >> file` | Group the redirected commands with `{ }` |
| actionlint (shellcheck) | `smoke-chroot.lock.yml` | warning (SC2155) | `export GOROOT=$(go env GOROOT)` masks command's return value | Declare then assign: `GOROOT=$(go env GOROOT); export GOROOT` |
| actionlint (shellcheck) | `smoke-claude.lock.yml` | info (SC2086) ×3 | Unquoted variable expansions (`$EXPR_GITHUB_REPOSITORY`, `$EXPR_GITHUB_RUN_ID`, redirect target) risk globbing/word-splitting | Quote the variable expansions in the corresponding source script step |

Deduplication: no overlapping findings across tools; all 7 are actionlint/shellcheck-only.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`github/gh-aw-firewall`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan (strict actionlint/shellcheck/yamllint/zizmor/poutine/runner-guard/grant/grype/syft) until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw actionlint/shellcheck error output (redacted, bounded)

```
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2038:warning:3:1: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2038:warning:5:1: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2129:style:3:82: Consider using { cmd1; cmd2; } >> file instead of individual redirects
.github/workflows/smoke-chroot.lock.yml:550:9: error: [shellcheck] SC2155:warning:4:8: Declare and assign separately to avoid masking return values
.github/workflows/smoke-claude.lock.yml:502:9: error: [shellcheck] SC2086:info:2:85: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:510:9: error: [shellcheck] SC2086:info:1:19: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:516:9: error: [shellcheck] SC2086:info:1:40: Double quote to prevent globbing and word splitting

✗ actionlint failed
strict mode: actionlint found 7 errors in workflows - workflows must have no actionlint errors in strict mode
```

Non-blocking advisory warnings (do not affect compile result)

- `sandbox.agent.runtime: cloud-hypervisor` privileged-KVM-preview warnings requiring human security review: `auth-doctor-updater.md`, `doc-maintainer.md`, `model-api-mapping-updater.md`, `sbx-gvisor-doc-updater.md`, `schema-sync.md`, `self-hosted-runner-doctor-updater.md`, `smoke-cloud-hypervisor-build-test.md`, `smoke-cloud-hypervisor-claude.md`, `smoke-cloud-hypervisor-codex.md`, `smoke-cloud-hypervisor.md`, `smoke-playwright-cloud-hypervisor.md`, `update-release-notes.md`
- Missing `concurrency.job-discriminator` on `workflow_dispatch`-triggered workflows: `build-test.md`, `contribution-check.md`, `security-guard.md`, `smoke-chroot.md`, `smoke-claude.md`, `smoke-cloud-hypervisor*.md`, `smoke-codex.md`, `smoke-copilot*.md`, `smoke-docker-sbx*.md`, `smoke-gemini.md`, `smoke-gvisor*.md`, `smoke-otel-tracing.md`, `smoke-services.md`
- `/tmp/` referenced directly instead of `/tmp/gh-aw/agent/`: `build-test-network-isolation.md`, `build-test.md`, `self-hosted-runner-doctor.md`
- `id-token: write` OIDC permission warning: `smoke-copilot-byok-aoai-entra.md`
- Ecosystem-identifier domain suggestions (informational, e.g. `crates.io`→`rust`, `api.openai.com`→`codex`, `chatgpt.com`→`codex`, `generativelanguage.googleapis.com`→`chrome`) across several workflows

### Control Plane
- Correlation ID: `33834075588-34`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33834075588

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33834424433) · copilot · auto · 22.9 AIC · ⌖ 6.84 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 3:51 AM UTC

Start in .github/workflows/duplicate-code-detector.md, smoke-chroot.md, and smoke-claude.md, whose script steps generate the flagged lock files. Run gh aw compile --strict in github/gh-aw-firewall, update only the source workflow Markdown rather than generated .lock.yml files, then recompile until actionlint reports no strict-mode errors.

Written by the indexing model from the issue text.