[aw-maintenance:compiler-security] Compiler validation failing: 23 actionlint errors in githubnext/gh-aw-workshop (aw_context typing + shellcheck)

Compiling all 23 workflow sources in `githubnext/gh-aw-workshop` with `gh aw compile` (strict mode + actionlint/shellcheck) failed with exit code 1: actionlint found 23 errors across the generated lock files, driven by two root causes — a repeated `aw_context` expression-typing bug in `workshop-student-simulator.md` (16 occurrences) and 7 shellcheck findings (style/warning/info) in a single embedded script in `workshop-ui-screenshots.md`. No container-image, license, or dedicated security-scanner (zizmor/poutine/runner-guard/grype/syft) findings appear in the captured report; only workflow-source lint/validation issues were surfaced. Highest severity: actionlint **error** (blocking, strict-mode). Recommended next action: run the local fixing loop below to correct the two source `.md` files and recompile until clean, then apply the outdated-action-version bump for `actions/checkout@v7.0.0` → `v7.0.1`.

- **Target repository**: `githubnext/gh-aw-workshop`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `23`
- **Generated lock files checked**: `22`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint (expression) | `workshop-student-simulator.md` (→ `.lock.yml`) | error | Repeated `[expression] property "aw_context" is not defined in object type {}` (16 occurrences, lines 182, 260–263, 306–309, 526) | Fix the source `if:`/expression referencing `aw_context` in `workshop-student-simulator.md` so the field is declared/typed correctly, then recompile |
| actionlint (shellcheck) | `workshop-ui-screenshots.md` (→ `.lock.yml`, embedded script) | error/style/warning/info (SC2001, SC2034, SC2094 ×2, SC2221, SC2222) | Embedded `run:` script has 7 shellcheck issues: unnecessary `sed` vs parameter expansion (SC2001 ×2), unused `refs` variable (SC2034), read/write of the same file in one pipeline (SC2094 ×2), and overlapping `case` patterns (SC2221/SC2222) | Rewrite the flagged shell snippet in `workshop-ui-screenshots.md` per shellcheck guidance (use `${var//search/replace}`, remove/use `refs`, avoid read+write of the same file in a pipeline, and de-duplicate the `case` patterns) |
| gh-aw compiler (advisory) | `actions/checkout@v7.0.0` (all workflows using it) | info | Action pin is outdated; latest is `v7.0.1` | Bump the pinned SHA/tag to `actions/checkout@v7.0.1` in affected workflow sources |
| gh-aw compiler (advisory) | workflow_dispatch workflows (curriculum-evaluator, docs-linker, guidelines-enforcer, manual-semver-release, markdown-dedup, security-side-quest, side-quest, training-plan-research, workflow-skills-editor, workshop-author, workshop-builder, workshop-explanatory-diagrams, workshop-skill-activity-author, and others) | warning | No `concurrency.job-discriminator`; concurrency group shared across all dispatches | Add a discriminator such as `${{ github.run_id }}` to each workflow's concurrency config |
| gh-aw compiler (advisory) | `q.md` (network/MCP guard) | info | Ecosystem-identifier recommendation: use `codex` instead of raw domain `openai.com` for maintainability | Replace the raw domain with the `codex` ecosystem identifier in network/MCP allow-list config |

No vulnerable container images, license findings, or zizmor/poutine/runner-guard/grype/syft findings were present in the captured report; only actionlint/shellcheck validation and compiler advisories were reported.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`githubnext/gh-aw-workshop`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence (bounded)

**summary.txt**
```
Target: githubnext/gh-aw-workshop
Exit code: 1
Workflow sources: 23
Compiled locks: 22
```

**Diff stat (top of `diff-stat.txt`)**
```
22 files changed, 11824 insertions(+), 7825 deletions(-)
```
(All 22 changed files are regenerated `.lock.yml` outputs of the compile; no source `.md` files were modified by the compiler itself.)

**Final actionlint summary line**
```
strict mode: actionlint found 23 errors in workflows - workflows must have no actionlint errors in strict mode
```

**Sample actionlint error (repeated pattern, 16 total in workshop-student-simulator.lock.yml)**
```
.github/workflows/workshop-student-simulator.lock.yml:182:51: error: [expression] property "aw_context" is not defined in object type {}
```

**Sample shellcheck error (7 total in workshop-ui-screenshots.lock.yml, all at line 497 in the compiled script)**
```
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2001:style:21:15: See if you can use ${variable//search/replace} instead
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2034:warning:12:1: refs appears unused. Verify use (or export if used externally)
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2094:info:26:27: Make sure not to read and write the same file in the same pipeline
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2094:info:32:12: Make sure not to read and write the same file in the same pipeline
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2221:warning:24:25: This pattern always overrides a later one on line 25
.github/workflows/workshop-ui-screenshots.lock.yml:497:9: error: [shellcheck] shellcheck reported issue in this script: SC2222:warning:24:31: This pattern never matches because of a previous pattern on line 25
```

No token-like or credential-like values were present in the reviewed output.

### Control Plane
- Correlation ID: `33813796170-29`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33813796170

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33814139896) · copilot · auto · 38.5 AIC · ⌖ 8.43 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 10:46 PM UTC

Start by reading .github/workflows/workshop-student-simulator.md and workshop-ui-screenshots.md, then run the documented strict gh aw compile loop in githubnext/gh-aw-workshop. Use the source files, not generated .lock.yml files, to address the reported expression and shellcheck findings, then review the checkout, concurrency, and q.md advisories. Done means the full validation completes without actionlint or shellcheck errors.

Written by the indexing model from the issue text.