[aw-maintenance:compiler-security] gh-aw compiler: 298/298 workflows compiled with 218 warnings; zizmor strict-mode scan failed anomalously

**Target**: `github/gh-aw` — compiler exited `1` (298/298 workflow sources compiled), 218 total warnings across recurring categories, and the zizmor strict-mode security scan failed with an internally inconsistent result (reported 0 findings yet returned a strict-mode error). Highest-severity supported item: the zizmor scan anomaly, which blocks strict compilation and needs investigation before any finding can be attributed a real severity. Recommended next action: run the local fixing loop below to triage the zizmor failure first, then clear the recurring compiler warnings.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `298`
- **Generated lock files checked**: `298`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler (zizmor step) | workflows (298 files scanned) | unknown | `zizmor failed` — strict mode reported "zizmor found 0 security warnings/errors" yet returned a strict-mode error (docker/zizmor exited in the findings range 10–14 despite the parser counting 0 warnings). This is an anomaly: either zizmor's JSON output could not be parsed correctly in this environment or a non-JSON/partial output was produced. | Re-run `zizmor` directly (verbose) against the lock files to capture raw JSON/stderr and confirm whether findings exist; do not assume 0 real findings — investigate before suppressing. |
| gh-aw compiler | 44 workflows (list in details) | warning | "safe update mode detected unapproved changes" — previously-approved actions `docker/build-push-action` and `docker/setup-buildx-action` were removed from the lock file baseline. | Use `--approve` if the removal is intentional, or revert the unapproved action removal; do not silently accept. |
| gh-aw compiler | 97 workflows | warning | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with an attached MCP gateway topology — requires human security review before merge/rollout. | Record explicit human security-review approval per workflow before any rollout, or move off the cloud-hypervisor runtime. |
| gh-aw compiler | 31 workflows | warning | `workflow_dispatch` workflows lack `concurrency.job-discriminator`; generated conclusion concurrency group is shared across all dispatches. | Add a discriminator such as `${{ github.run_id }}`. |
| gh-aw compiler | 8 workflows (e.g. `test-quality-sentinel.md`) | warning | Missing required permissions for requested GitHub toolsets (e.g. `issues: read`). | Add the listed missing permissions to workflow frontmatter or reduce required toolsets. |
| gh-aw compiler | 17 occurrences (`ab-testing-advisor.md` and others) | warning | Template separators (`{{#if ...}}` / `{{/if}}`) appear mid-line instead of on their own line. | Move separators to their own lines per compiler guidance. |
| gh-aw compiler | 12 occurrences | warning | Invalid pip package name reported: `/tmp/gh-aw/python/venv/bin/python` — not a valid PyPI package identifier. | Fix the workflow's Python tool/package declaration; it appears to reference a venv binary path instead of a package name. |
| gh-aw compiler | root `.github/workflows/aw.json` | warning | Config fails schema validation at `/auto_upgrade` (`oneOf` failed: got object, wanted boolean; `options` not an allowed additional property). Compilation continued with defaults. | Fix `auto_upgrade` in `aw.json` to match the schema (boolean, or documented object shape). |
| gh-aw compiler | `smoke-copilot-aoai-entra.md` | warning | Workflow grants `id-token: write` permission. | Confirm this is required and scoped minimally; document justification. |
| gh-aw compiler | 3 workflows (e.g. `step-name-alignment.md`) | warning | `sandbox.agent.config.filesystem.allowWrite` is ignored for the configured runtime and not written to the AWF config. | Switch to `cloud-hypervisor` runtime if the write-policy is required, or remove the ineffective setting. |
| gh-aw compiler | 10 workflows (e.g. `archivx-agentic-workflows-analyzer.md`, `super-linter.md`) | warning | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/`. | Update prompts to use `/tmp/gh-aw/agent/` as the temp-file root so contents are captured as run artifacts. |

Local fixing loop

1. Install/update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `github/gh-aw` checkout.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler tail (zizmor failure)

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 298 files
i Running zizmor security scanner on 298 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

Note: report.txt contains no actionlint/shellcheck/yamllint-specific findings, no poutine/runner-guard/grype/syft output, and no explicit `error:`-level compiler messages (`grep -c "error:"` = 0). Only the zizmor step reported a failure, and it is internally inconsistent (0 counted findings vs. a strict-mode failure), so no zizmor-specific severity or root cause is asserted here — it needs direct re-investigation with verbose output.

Diff summary

`diff-stat.txt` shows all 298 `.lock.yml` files modified (git-status.txt: 298 `M` entries), consistent with a full recompilation of the workflow set; no unexpected file additions/deletions were observed in the bounded evidence reviewed.

### Control Plane
- Correlation ID: `33808856057-28`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33808856057`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33809407157) · copilot · auto · 41 AIC · ⌖ 10.4 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 9:52 PM UTC

Start with the gh-aw MCP server's fix and compile tools, then rerun the strict compiler and verbose zizmor scan against the 298 workflow sources. Review `.github/workflows/*.md`, the root `.github/workflows/aw.json`, and generated lock-file diffs without editing `.lock.yml` files. Done means the anomaly is explained and actionable warnings are resolved or explicitly documented, with validation passing or human-review blockers identified.

Written by the indexing model from the issue text.