[aw-maintenance:compiler-security] Compiler exit 1: zizmor integration failure blocks strict-mode compile of all 298 workflows in github/gh-aw

**Target repository**: `github/gh-aw`
**Compiler exit code**: `1`
**Workflow sources checked**: `298`
**Generated lock files checked**: `298`
**Result**: `findings`

Compiling all 298 workflows with `gh aw compile --validate` (strict mode, full lint + zizmor scan) failed with exit code 1. The terminal blocking error is the zizmor security-scanner integration itself, reporting **0 findings while still failing strict mode** — an internal compiler-tool inconsistency, not a scanner-detected vulnerability. Beyond that blocker, the run's non-fatal lint pass surfaced ~213 warnings across the workflow set, dominated by a privileged `cloud-hypervisor` sandbox runtime advisory (100 occurrences) and safe-update unapproved action-removal notices (44 occurrences) for `docker/build-push-action` and `docker/setup-buildx-action`. No container-image vulnerability (grype/syft), license (grant), or SAST (poutine/runner-guard) findings could be evaluated because compilation stopped at the zizmor step before those stages ran.

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler (zizmor integration) | all 298 lock files (batch scan) | unknown | `strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode` — compiler reports the strict-mode failure message while `totalWarnings`/`highSeverityCount` are both 0, per `pkg/cli/zizmor.go` `interpretZizmorRunError`/`parseAndDisplayZizmorOutput`. This blocks the entire compile and prevents downstream container/license/SAST scanners from running. | Investigate why zizmor's docker exit code fell in the findings range (10–14) while stdout produced no parseable JSON findings (e.g., zizmor image output-format regression, stderr/stdout parsing mismatch, or a real 0-severity/informational finding not captured by `ParseSeverity`). Fix the parser or the docker invocation in `pkg/cli/zizmor.go` so the reported count matches the actual finding set, or add a regression test capturing this exit-code/finding-count mismatch. |
| gh-aw compiler (lint) | 100 workflows (see details) | warning | `sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout...` | Obtain and record explicit human security review/approval for each workflow using `cloud-hypervisor`, or migrate to a non-privileged runtime if the KVM preview capability is not required. |
| gh-aw compiler (safe update mode) | 44 workflows (see details) | warning | Previously-approved actions `docker/build-push-action` and `docker/setup-buildx-action` were removed without re-approval. | Use `--approve` to accept the intentional removal, revert the removal, or have a coding agent review and approve the change per the compiler's remediation options. |
| gh-aw compiler (lint) | 31 workflows | warning | `workflow_dispatch` workflows lack `concurrency.job-discriminator`, so the generated conclusion concurrency group is shared across all dispatches. | Add a discriminator (e.g. `${{ github.run_id }}`) to each affected workflow's concurrency config. |
| gh-aw compiler (lint) | 8 workflows | warning | Missing required permissions for configured GitHub toolsets; some GitHub tools unavailable until granted. | Add the missing permissions to each workflow's frontmatter as identified per-file in the raw report. |
| gh-aw compiler (lint) | 10 workflows | warning | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/`. | Update prompts to use `/tmp/gh-aw/agent/` as the root for generated temporary files so they are captured as run artifacts. |
| gh-aw compiler (lint) | 17 occurrences across a handful of workflows (e.g. `ab-testing-advisor.md`) | warning | Template separators (`{{#if ...}}`, `{{/if}}`) appear mid-line instead of on their own lines. | Move each flagged separator to its own line. |
| gh-aw compiler (lint) | 3 workflows (`smoke-claude.md`, `smoke-pi.md`, +1) | warning | `sandbox.agent.config.filesystem.allowWrite` is ignored for the configured runtime (only `cloud-hypervisor` enforces it; Docker/gVisor force read-only, docker-sbx rejects it). | Either switch these workflows to `cloud-hypervisor` (subject to the required security review above) or remove the ineffective `allowWrite` config. |
| gh-aw compiler (config) | `.github/workflows/aw.json` | warning | Repo config fails schema validation at `/auto_upgrade` (object provided where boolean expected; `options` not an allowed property); compiler falls back to defaults (168h `action_failure_issue_expires`). | Fix `.github/workflows/aw.json` to match the documented `auto_upgrade` schema (boolean, or object without `options` if unsupported). |

Additional lower-frequency lint findings

- 2× experiment comparison expressions use double quotes instead of required single quotes (`smoke-project.md` and one other).
- 2× checkout-related warnings.
- 1× `samples replay is enabled but no samples are configured` warning.
- 1× `This workflow grants id-token: write permission` (`smoke-copilot-aoai-entra.md`) — confirm this elevated permission is required and scoped correctly.
- 1× `Both slash_command and bots triggers are configured` — potential trigger overlap warranting review.
- Multiple `pip package name '/tmp/gh-aw/python/venv/bin/python' is invalid` diagnostics — a compiler-side path-vs-package-name confusion unrelated to workflow content; likely a compiler bug worth filing separately if reproducible outside this run.
- Several `i` (informational) notes recommending ecosystem identifiers over individual domain names for firewall allowlists — no action required, informational only.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action (in particular the zizmor exit-code/finding-count mismatch above, which may require a compiler code fix rather than a workflow-source change).

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: the zizmor step is currently reporting 0 findings while still failing strict-mode compilation (a possible compiler defect in `pkg/cli/zizmor.go`'s exit-code interpretation) — if this cannot be resolved via workflow-source changes alone, stop and report it as a compiler bug rather than making unrelated workflow edits to work around it.

Raw compiler summary

```
Target: github/gh-aw
Exit code: 1
Workflow sources: 298
Compiled locks: 298
```

Report tail (blocking failure):
```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 298 files
i Running zizmor security scanner on 298 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

### Control Plane
- Correlation ID: `33803302299-27`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33803302299

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33803946535) · copilot · auto · 58 AIC · ⌖ 8.23 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 8:53 PM UTC

Start in pkg/cli/zizmor.go, especially interpretZizmorRunError and parseAndDisplayZizmorOutput, then run gh aw compile --validate to reproduce the strict-mode failure. Trace the Docker zizmor invocation and output parsing; done means a zero-finding run is not falsely rejected and regression coverage captures the exit-code/finding-count mismatch.

Written by the indexing model from the issue text.