[aw-maintenance:compiler-security] Compiler strict-mode failure in daily-runtime-threat-scan (zizmor gate false failure + stale lock file)

Compiled `github/gh-aw-actions` (target SHA `49459c75b37a0b82b4ecb15e1079972cc3353bc9`) with the gh-aw compiler's full validation/lint/security-scanner suite. The compile exited non-zero (1) due to an apparent strict-mode gate bug in the zizmor integration — zizmor reported **0** security warnings/errors, yet the compiler still failed the build with a message claiming findings must be zero. The generated `daily-runtime-threat-scan.lock.yml` is also substantially out of sync with its `.md` source (399 insertions / 231 deletions), indicating the checked-in lock file is stale and needs recompilation. No other lint/actionlint/shellcheck/container/license findings were reported. Recommended next action: recompile the workflow to refresh the lock file and investigate the zizmor strict-mode gate logic (likely an off-by-one or inverted condition treating a 0-finding pass as a failure).

- **Target repository**: `github/gh-aw-actions`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `1`
- **Generated lock files checked**: `1`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compile (zizmor strict-mode gate) | `daily-runtime-threat-scan.lock.yml` | unknown | Compile exits 1 with message "zizmor found 0 security warnings/errors ... workflows must have no zizmor findings in strict mode" — a self-contradictory failure condition (0 findings reported, but gate still fails). Likely a bug in the strict-mode threshold check rather than a real security issue. | Recompile with the latest gh-aw extension; if the false failure persists, file/inspect the zizmor strict-mode gate logic in gh-aw for an inverted or off-by-one comparison. |
| gh-aw compile (lock-file drift) | `daily-runtime-threat-scan.lock.yml` | unknown | Checked-in lock file differs from a fresh compile of the `.md` source by 399 insertions / 231 deletions — the committed lock file is stale relative to its source. | Run `gh aw compile` and commit the refreshed `.lock.yml`. |

No actionlint, shellcheck, pyflakes, container-image, or license findings were reported in this run's evidence.

### Local fixing loop

1. Install or update the gh-aw extension, then configure your coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `github/gh-aw-actions` repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler report (report.txt)

```
✓ .github/workflows/daily-runtime-threat-scan.md (99.2 KB)
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on .github/workflows/daily-runtime-threat-scan.lock.yml
i Running zizmor security scanner on .github/workflows/daily-runtime-threat-scan.lock.yml
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in daily-runtime-threat-scan.lock.yml - workflows must have no zizmor findings in strict mode
```

Git status / diff summary

```
$ git status --porcelain
M .github/workflows/daily-runtime-threat-scan.lock.yml
?? .github/aw/logs/

$ git diff --stat
.../workflows/daily-runtime-threat-scan.lock.yml | 630 +++++++++++++--------
1 file changed, 399 insertions(+), 231 deletions(-)
```

### Control Plane
- Correlation ID: `33813796170-29`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33813796170`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33814188733) · copilot · auto · 15.3 AIC · ⌖ 8.02 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 10:45 PM UTC

Start with .github/workflows/daily-runtime-threat-scan.md and its generated daily-runtime-threat-scan.lock.yml, then run gh aw compile with strict validation. If the zero-finding failure persists, inspect the gh-aw compiler's zizmor strict-mode gate logic. Done means compilation passes and the checked-in lock file matches the source without security findings.

Written by the indexing model from the issue text.