[aw-maintenance:compiler-security] Compiler security findings: github/gh-aw-firewall (7 strict-mode shellcheck errors + advisories)

Compiling all 70 gh-aw workflows in `github/gh-aw-firewall` (SHA `dc72343e`) failed strict-mode `actionlint` validation with 7 shellcheck errors across 3 workflows, plus 21 non-blocking compiler lint/security warnings (sandbox privileged-runtime notices, missing concurrency job-discriminators, one `id-token: write` OIDC grant, a `/tmp/` path convention warning, and ecosystem-identifier suggestions). No vulnerable container images, license, or dependency-scanner findings were reported. Highest-severity actionable item: strict-mode compile failure (blocking) from shellcheck findings (all `warning`/`info`/`style` severity per shellcheck, but strict mode treats them as compile errors). Recommended next action: run the local fixing loop below to have a coding agent quote variables and fix `find`/redirect patterns in the 3 affected `.md` sources, then recompile.

- **Target repository**: `github/gh-aw-firewall`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `70`
- **Generated lock files checked**: `70`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|----------------|----------|---------|--------------|
| actionlint (shellcheck) | duplicate-code-detector | warning (SC2038) | `find` output piped without `-print0`/`xargs -0`, breaks on non-alphanumeric filenames (2 occurrences) | Use `find .. -print0 \| xargs -0 ..` or `find .. -exec .. +` |
| actionlint (shellcheck) | duplicate-code-detector | style (SC2129) | Individual redirects into same file; should batch with `{ cmd1; cmd2; } >> file` | Group commands and redirect once |
| actionlint (shellcheck) | smoke-chroot | warning (SC2155) | `export GOROOT=$(go env GOROOT)` masks command return value | Declare then assign: `export GOROOT; GOROOT=$(go env GOROOT)` |
| actionlint (shellcheck) | smoke-claude | info (SC2086) | Unquoted variable expansions risk globbing/word-splitting (3 occurrences: `$EXPR_GITHUB_REPOSITORY`, `$EXPR_GITHUB_RUN_ID`) | Double-quote all variable expansions in the affected `run:` scripts |
| gh-aw compiler | auth-doctor-updater, doc-maintainer, model-api-mapping-updater, sbx-gvisor-doc-updater, schema-sync, self-hosted-runner-doctor-updater, smoke-cloud-hypervisor* (4), smoke-playwright-cloud-hypervisor, update-release-notes | unknown (advisory) | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with an attached MCP gateway topology | Require explicit human security review/approval before merge or rollout, per compiler guidance |
| gh-aw compiler | smoke-copilot-byok-aoai-entra | unknown (advisory) | Workflow grants `id-token: write`; OIDC tokens can authenticate to cloud providers | Verify audience validation and trust-policy scoping are correctly configured |
| gh-aw compiler | ~18 `workflow_dispatch` workflows (build-test, contribution-check, security-guard, smoke-chroot, smoke-claude, smoke-cloud-hypervisor*, smoke-codex, smoke-copilot*, smoke-docker-sbx*, smoke-gemini, smoke-gvisor*, smoke-otel-tracing, smoke-services) | unknown (advisory) | No `concurrency.job-discriminator`; concurrent dispatches share one conclusion concurrency group | Add a discriminator such as `${{ github.run_id }}` |
| gh-aw compiler | self-hosted-runner-doctor, build-test, build-test-network-isolation | unknown (advisory) | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/` | Update prompt to use `/tmp/gh-aw/agent/` as the temp-file root |
| gh-aw compiler | multiple workflows (network domain lists) | unknown (advisory) | Individual domain names used where ecosystem identifiers exist (e.g. `cloud.google.com`→`chrome`, `crates.io`→`rust`, `bun.sh`/`deno.land`/`jsr.io`→`node`/`deno`, `api.openai.com`→`codex`, `docs.docker.com`→`containers`, `*.vsblob.vsassets.io`→`dotnet`, `chatgpt.com`→`codex`, `generativelanguage.googleapis.com`/`aiplatform.googleapis.com`→`chrome`) | Replace individual domains with ecosystem identifiers for maintainability |

No zizmor, poutine, runner-guard, grype, syft, or grant findings appeared in the captured report; no container image vulnerabilities or license issues were reported.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler summary

```
Target: github/gh-aw-firewall
Exit code: 1
Workflow sources: 70
Compiled locks: 70
```

Full compiler/scanner report highlights (report.txt, 133 lines total; full log in workflow run artifacts for run 33809322621)

```
i recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'cloud.google.com' → 'chrome', 'docs.github.com' → 'github'
.github/workflows/auth-doctor-updater.md: warning: sandbox.agent.runtime: cloud-hypervisor uses a privileged KVM preview path with an attached MCP gateway topology. Require a human security review before merge or rollout, and record explicit approval in your change process.

.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2038:warning: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2129:style: Consider using { cmd1; cmd2; } >> file instead of individual redirects
.github/workflows/smoke-chroot.lock.yml:550:9: error: [shellcheck] SC2155:warning: Declare and assign separately to avoid masking return values
.github/workflows/smoke-claude.lock.yml:502:9: error: [shellcheck] SC2086:info: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:510:9: error: [shellcheck] SC2086:info: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:516:9: error: [shellcheck] SC2086:info: Double quote to prevent globbing and word splitting

✗ actionlint failed
strict mode: actionlint found 7 errors in workflows - workflows must have no actionlint errors in strict mode
```

Diff-stat overview (lock-file drift, 70 files changed)

Compilation showed drift between checked-in `.lock.yml` files and a fresh compile from current `.md` sources (60–150 line reductions per file, typical of a compiler/action-version delta) in addition to the strict-mode failure above. This is out of scope for this security report but should be reconciled by running `gh aw compile` and committing regenerated locks alongside the shellcheck fixes.

### Control Plane
- Correlation ID: 33808856057-28
- Central repository: githubnext/gh-aw-cao
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33808856057

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33809322621) · copilot · auto · 33.5 AIC · ⌖ 16.6 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 9:49 PM UTC

Start with the .github/workflows/*.md sources corresponding to duplicate-code-detector, smoke-chroot, and smoke-claude; the captured lock-file locations identify where the strict actionlint errors appear. Run the gh-aw compile workflow with strict validation and review generated lock-file diffs without editing locks directly. Done means the seven shellcheck errors are gone and any remaining security advisories are either resolved or explicitly documented for human review.

Written by the indexing model from the issue text.