[aw-maintenance:compiler-security] gh-aw compiler validation failing — 23 actionlint errors in githubnext/gh-aw-workshop

Compiling `githubnext/gh-aw-workshop` with the gh-aw strict-mode toolchain (compile + actionlint + shellcheck) exited with code `1`. Actionlint reported **23 errors** in `workshop-student-simulator.lock.yml` (all the same root-cause expression bug — `aw_context` is not a defined property in the empty-object type inferred for `github.event.inputs`/`github.event.client_payload` in one particular event context), plus 7 shellcheck findings (mostly style/info) in `workshop-ui-screenshots.lock.yml`, and 14 non-blocking warnings (13× missing `concurrency.job-discriminator`, 1× outdated `actions/checkout` pin). No container, license, or dedicated security-scanner (zizmor/poutine/runner-guard/grype/syft) findings were present in the evidence — those tools do not appear to have run in this pass or produced no findings; only actionlint/shellcheck output was captured. Highest-severity finding: the actionlint strict-mode errors, which block compilation.

- **Target repository**: `githubnext/gh-aw-workshop`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `23`
- **Generated lock files checked**: `22`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | workshop-student-simulator.lock.yml | error (blocking, 23 occurrences) | `property "aw_context" is not defined in object type {}` — expression references `github.event.inputs.aw_context` / `github.event.client_payload.aw_context` in a context where the compiler's generated type for that event's inputs/payload is empty, so actionlint's strict type-checker rejects the expression | Fix in the `.md` source: adjust the `aw_context` fallback expression (or the workflow's declared `on:` triggers/inputs) so the referenced property is defined for every event type the generated job can run under; do not hand-edit the `.lock.yml` — recompile after the source change |
| shellcheck (via actionlint) | workshop-ui-screenshots.lock.yml | style/info/warning (7 occurrences: SC2001, SC2034, SC2094 ×2, SC2221, SC2222) | Inline shell script (image-reference scanner) has minor quality issues: prefer `${var//search/replace}` over `sed`, an unused `refs` variable, reading/writing the same file in one pipeline, and two `case` patterns that shadow each other | Clean up the embedded shell script in the workflow source: replace the `sed` substitution, remove/use the unused `refs` var, avoid same-file read+write in a pipe, and fix the overlapping `case` patterns |
| gh-aw compiler | 13 workflow sources (curriculum-evaluator, docs-linker, guidelines-enforcer, manual-semver-release, markdown-dedup, security-side-quest, side-quest, training-plan-research, workflow-skills-editor, workshop-author, workshop-builder, workshop-explanatory-diagrams, workshop-skill-activity-author) | warning (non-blocking, 13 occurrences) | `workflow_dispatch` workflows have no `concurrency.job-discriminator`; concurrent dispatches share one concurrency group/slot | Add a discriminator such as `${{ github.run_id }}` to each workflow's `concurrency` config |
| gh-aw compiler (action-version check) | markdown-dedup.md (and possibly others using the same action) | info | `actions/checkout@v7.0.0` is outdated; latest is `v7.0.1` | Bump the pinned checkout SHA/tag to `v7.0.1` |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`githubnext/gh-aw-workshop`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Priority: (1) resolve the 23 actionlint `aw_context` type errors in `workshop-student-simulator.md` first since they block strict-mode compilation, (2) clean up the shellcheck findings in `workshop-ui-screenshots.md`, (3) add `concurrency.job-discriminator` to the 13 flagged `workflow_dispatch` workflows, (4) bump the outdated `actions/checkout` pin.

Raw compiler/actionlint output (bounded excerpt)

```
.github/workflows/workshop-student-simulator.lock.yml:182:51: error: [expression] property "aw_context" is not defined in object type {}
GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
...
(23 total occurrences of the same aw_context error class across lines 182, 260-263, 306-309, 526)

.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2001:style — See if you can use ${variable//search/replace} instead
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2034:warning — refs appears unused
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2094:info (x2) — Make sure not to read and write the same file in the same pipeline
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2221:warning — This pattern always overrides a later one on line 25
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] SC2222:warning — This pattern never matches because of a previous pattern on line 25

✗ actionlint failed
strict mode: actionlint found 23 errors in workflows - workflows must have no actionlint errors in strict mode
```

Warnings (13× missing job-discriminator, across curriculum-evaluator, docs-linker, guidelines-enforcer, manual-semver-release, markdown-dedup, security-side-quest, side-quest, training-plan-research, workflow-skills-editor, workshop-author, workshop-builder, workshop-explanatory-diagrams, workshop-skill-activity-author):
```
.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow.
```

Outdated action:
```
⚠ Action actions/checkout@v7.0.0 is outdated; latest available version is v7.0.1.
```

Diff summary (22 lock files regenerated, evidence of drift from stored locks)

```
22 files changed, 11824 insertions(+), 7825 deletions(-)
```
Full per-file diff stats and `git status` are recorded in the workflow's evidence artifacts; no secrets or credentials observed in the diffs.

### Control Plane
- Correlation ID: 33809349507-9
- Central repository: githubnext/gh-aw-cao
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33809349507

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33809349507) · copilot · auto · 30 AIC · ⌖ 7 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 9:48 PM UTC

Work in the named .github/workflows/*.md sources, starting with workshop-student-simulator.md and workshop-ui-screenshots.md; do not edit generated .lock.yml files. Launch gh aw mcp-server and use its fix and compile tools, then repeat strict compiler validation and the requested security scans. Done means the actionlint and shellcheck findings, concurrency warnings, and outdated checkout pin are resolved with clean regenerated locks.

Written by the indexing model from the issue text.