[aw-maintenance:compiler-security] gh-aw compile (exit 1) on github/gh-aw: zizmor gate failure + 97 sandbox reviews + 44 unapproved action removals

Compiling all 299 workflow sources in `github/gh-aw` with the gh-aw compiler's full strict-mode/lint/scanner suite exits non-zero (1). The failing gate is the zizmor security-scanner step, whose own message is self-contradictory ("zizmor found 0 security warnings/errors ... workflows must have no zizmor findings in strict mode" — reported as failing anyway), so no concrete zizmor rule/finding can be attributed. No actionlint/shellcheck errors were present. The largest concrete, attributable issues are: 97 workflows flagged for mandatory human security review due to a privileged `cloud-hypervisor` sandbox runtime with attached MCP gateway, 44 workflows where safe-update guard detected previously-approved `docker/build-push-action` and `docker/setup-buildx-action` removed without `--approve`, 8 workflows missing required GitHub-toolset permissions, and one repo-level `aw.json` schema validation failure on `auto_upgrade`. Recommended next action: run the local fixing loop below, starting with the zizmor gate (may require a zizmor version/config fix rather than a workflow content fix) and the `aw.json` schema fix, then triage the sandbox-runtime reviews and unapproved-action removals as a batch.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `299`
- **Generated lock files checked**: `299`
- **Result**: `findings`

### Findings

| Tool | Workflow / File | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compile (strict gate) | all 298 files (aggregate) | unknown | `zizmor` step exits non-zero with message "zizmor found 0 security warnings/errors in workflows — workflows must have no zizmor findings in strict mode," which is internally contradictory (claims 0 findings yet fails the gate). No per-file zizmor rule ID or finding text is present in the captured report, so no specific vulnerability can be attributed. | Re-run `zizmor` directly (or via `gh aw compile`) with verbose/JSON output to capture the actual finding or crash reason; this may be a scanner/tool-invocation bug in the compiler rather than a real security finding — do not treat as a confirmed vulnerability without further evidence. |
| gh-aw compile (config loader) | `.github/workflows/aw.json` | warning | Repo config fails schema validation: `/auto_upgrade` — `oneOf` failed (got object, wants boolean; additional property `options` not allowed). Falls back to defaults, including `action_failure_issue_expires` defaulting to 168h. | Fix `auto_upgrade` in `aw.json` to match the documented schema (boolean, or remove unsupported `options` key). |
| gh-aw compile (sandbox review policy) | 97 workflows, e.g. `ace-editor.md`, `agentic-token-trend-audit.md`, `architecture-guardian.md` | warning (policy) | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with an attached MCP gateway topology; compiler requires explicit human security review/approval before merge or rollout. | Obtain and record explicit human security review approval per the project's change process before merging/rolling out these workflows, or switch off the `cloud-hypervisor` runtime if review is not yet complete. |
| gh-aw compile (safe-update guard) | 44 workflows, e.g. `agent-job-health.md`, `weekly-blog-post-writer.md`, `workflow-normalizer.md` | warning | Safe-update mode detected unapproved removal of previously-approved actions `docker/build-push-action` and `docker/setup-buildx-action`. | Either re-approve the change with `--approve` after review, revert the unapproved removal, or have an interactive coding agent review and approve it. |
| gh-aw compile (permissions check) | 8 workflows: `daily-security-red-team.md`, `daily-spending-forecast.md`, `front-page-copy-guard.md`, `hippo-embed.md`, `smoke-claude-on-copilot.md`, `smoke-copilot-auto.md`, `smoke-github-claude.md`, `test-quality-sentinel.md` | warning | Missing required permissions for configured GitHub toolsets (e.g. `pull-requests: read`, `issues: read`) — some GitHub tools will be unavailable until granted. | Add the missing permission scopes to workflow frontmatter, or remove/adjust the toolsets that require them. |

Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action (e.g. the zizmor gate, which may need scanner-level rather than workflow-level investigation, and the sandbox-runtime human-review approvals, which cannot be resolved by an agent alone).

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files (including `.github/workflows/aw.json`); never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely — in particular, investigate why the zizmor gate reports failure while claiming "0 findings," and flag the 97 `cloud-hypervisor` sandbox workflows and 44 unapproved-action-removal workflows for required human review/approval rather than attempting to silently approve or bypass them.

Raw compiler summary

```
Target: github/gh-aw
Exit code: 1
Workflow sources: 299
Compiled locks: 299
```

Diff stat: 298 lock files changed, 15861 insertions(+), 36388 deletions(-) (expected regeneration drift from recompiling with the current compiler version; not itself a security finding).

Category counts extracted from `report.txt` (82KB, 1202 lines): `sandbox.agent.runtime` privileged-KVM warnings: 97; safe-update unapproved-changes warnings: 44; template-separator mid-line warnings: 17; invalid pip-package-name warnings: 12; missing `concurrency.job-discriminator` warnings: 31; missing-permissions warnings: 8. No `error:`-level actionlint/shellcheck findings were present in the report.

### Control Plane
- Correlation ID: `33834075588-34`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33834075588

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33834443759) · copilot · auto · 43.7 AIC · ⌖ 8.65 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 3:56 AM UTC

Start with the gh-aw compile output and .github/workflows/aw.json, then rerun the zizmor step directly with verbose or JSON output to distinguish a scanner finding from an invocation failure. Review the listed workflow sources for permissions and safe-update warnings, while treating the cloud-hypervisor reviews and action removals as human approval items. Done means the compiler result is explained and fixable findings are resolved or explicitly documented as requiring review.

Written by the indexing model from the issue text.