[aw-maintenance:compiler-security] github/gh-aw-firewall: 7 actionlint/shellcheck errors block strict-mode compile

Compiling `github/gh-aw-firewall` in strict mode failed (exit code 1). Compiler validated 70 workflow sources / 70 lock files with no vulnerable-container, license, or dependency-scanner findings; the only blocking issues are 7 actionlint (shellcheck) errors across 3 generated lock files. Highest severity: `warning` (shellcheck SC2038/SC2129/SC2155/SC2086). Recommended next action: run the local fixing loop below to patch the offending `run:` scripts in the source `.md` workflows and recompile.

- **Target repository**: `github/gh-aw-firewall`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `70`
- **Generated lock files checked**: `70`
- **Result**: `findings`

### Findings

| Tool | Workflow/Lock file | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | `duplicate-code-detector.lock.yml:466` | warning (SC2038) | `find` output piped without `-print0`/`xargs -0`, unsafe for non-alphanumeric filenames | Use `find .. -print0 \| xargs -0 ..` or `find .. -exec .. +` |
| actionlint/shellcheck | `duplicate-code-detector.lock.yml:466` | warning (SC2129) | Multiple individual `>>` redirects to same file | Use `{ cmd1; cmd2; } >> file` |
| actionlint/shellcheck | `smoke-chroot.lock.yml:550` | warning (SC2155) | `export GOROOT=$(go env GOROOT)` masks command's return value | Declare then assign: `export GOROOT; GOROOT=$(go env GOROOT)` |
| actionlint/shellcheck | `smoke-claude.lock.yml:502` | info (SC2086) | Unquoted variable subject to globbing/word splitting | Double-quote the variable expansion |
| actionlint/shellcheck | `smoke-claude.lock.yml:510` | info (SC2086) | Unquoted `$EXPR_GITHUB_REPOSITORY` in `gh pr list --repo` | Double-quote the variable expansion |
| actionlint/shellcheck | `smoke-claude.lock.yml:516` | info (SC2086) | Unquoted `$EXPR_GITHUB_RUN_ID` path expansion | Double-quote the variable expansion |

Additional non-blocking lint advisories (not counted above, no severity assigned by compiler): several workflows recommend using ecosystem identifiers instead of individual firewall domain names (e.g. `cloud.google.com` → `chrome`, `crates.io` → `rust`); several `sandbox.agent.runtime: cloud-hypervisor` workflows require human security review before merge/rollout per compiler policy; several `workflow_dispatch` workflows lack a `concurrency.job-discriminator`; `smoke-copilot-byok-aoai-entra.md` grants `id-token: write` (OIDC) — ensure audience validation/trust policy is correct; two workflows reference `/tmp/` directly instead of `/tmp/gh-aw/agent/`.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler report (bounded)

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 68 files
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2038:warning: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2129:style: Consider using { cmd1; cmd2; } >> file instead of individual redirects
.github/workflows/smoke-chroot.lock.yml:550:9: error: [shellcheck] SC2155:warning: Declare and assign separately to avoid masking return values
.github/workflows/smoke-claude.lock.yml:502:9: error: [shellcheck] SC2086:info: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:510:9: error: [shellcheck] SC2086:info: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:516:9: error: [shellcheck] SC2086:info: Double quote to prevent globbing and word splitting
✗ actionlint failed
strict mode: actionlint found 7 errors in workflows - workflows must have no actionlint errors in strict mode
```

Diff summary (git status / diffstat, review-only, not applied)

70 `.lock.yml` files show modifications relative to the checked-out target HEAD (recompile drift/regeneration), e.g. `auth-doctor-updater.lock.yml`, `build-test.lock.yml`, `ci-doctor.lock.yml`, `secret-digger-claude.lock.yml`, `secret-digger-codex.lock.yml`, and others. This diff reflects the deterministic recompile step's output for evidence only; no git changes were pushed to the target repository.

### Control Plane
- Correlation ID: `33814116803-13`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33814116803`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33814116803) · copilot · auto · 20.5 AIC · ⌖ 12.2 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 10:46 PM UTC

Start with the source .github/workflows/*.md files corresponding to duplicate-code-detector.lock.yml, smoke-chroot.lock.yml, and smoke-claude.lock.yml; do not edit generated lock files. Configure the gh-aw MCP server, then run its fix and compile tools with strict validation and the listed security and lint checks. Done means the source changes preserve behavior and the full compiler scan passes, or any remaining human-action finding is documented.

Written by the indexing model from the issue text.