[aw-maintenance:compiler-security] gh-aw compiler validation findings in githubnext/gh-aw-workshop (23 errors, 13 warnings)

Compiling all 23 GitHub Agentic Workflow sources in `githubnext/gh-aw-workshop` with `gh aw compile` (strict validation + full lint/scanner suite) exited non-zero (exit code 1). 22 lock files regenerated with diffs. Highest-severity supported finding: 16 `error`-level expression type errors (`aw_context` undefined) in `workshop-student-simulator.lock.yml`, plus 7 `error`-level shellcheck findings in `workshop-ui-screenshots.lock.yml` and 13 `warning`-level missing concurrency discriminators across dispatch-triggered workflows. Recommended next action: run the local fixing loop below to resolve the expression-type and shellcheck errors first, then add job-discriminators to silence the warnings.

- **Target repository**: `githubnext/gh-aw-workshop`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `23`
- **Generated lock files checked**: `22`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler (expression) | `workshop-student-simulator.lock.yml` | error | Property `aw_context` is not defined in object type `{}` at 16 locations (lines 182, 260-263, 306-309, 526) — likely a template expression referencing an undeclared/mistyped context field | Fix the source `.md` template to reference a valid context property, or declare `aw_context` correctly; recompile until the expression-type error clears |
| shellcheck | `workshop-ui-screenshots.lock.yml` (script embedded at line 497) | unknown (shellcheck: style/warning/info) | SC2001 (style, x2): prefer `${variable//search/replace}`; SC2034 (warning): `refs` appears unused; SC2094 (info, x2): reading and writing same file in same pipeline; SC2221/SC2222 (warning): overlapping case patterns (line 24 always overrides line 25) | Rewrite the embedded shell script in the source `.md` to use parameter expansion instead of `sed`-via-`grep` idiom where flagged, remove or use the unused `refs` variable, avoid same-file read/write in a pipe, and reorder/merge the `case` patterns so line 24/25 don't collide |
| gh-aw compiler (concurrency) | 13 workflows: `curriculum-evaluator`, `docs-linker`, `guidelines-enforcer`, `manual-semver-release`, `markdown-dedup`, `security-side-quest`, `side-quest`, `training-plan-research`, `workflow-skills-editor`, `workshop-author`, `workshop-builder`, `workshop-explanatory-diagrams`, `workshop-skill-activity-author` | warning | `workflow_dispatch` workflow has no `concurrency.job-discriminator`; generated conclusion concurrency group is shared by all dispatches | Add a `concurrency.job-discriminator` (e.g. `${{ github.run_id }}`) to each workflow's frontmatter so concurrent dispatches don't collide |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler report excerpt (bounded)

```
150 total report lines: 23 error, 16 warning (13 unique warning text: missing concurrency.job-discriminator)

.github/workflows/workshop-student-simulator.lock.yml
182:51: error: [expression] property "aw_context" is not defined in object type {}
260:80,200 / 261:82,204 / 262:75,190 / 263:72: error: [expression] property "aw_context" is not defined in object type {}
306:80,200 / 307:82,204 / 308:75,190 / 309:72: error: [expression] property "aw_context" is not defined in object type {}
526:130: error: [expression] property "aw_context" is not defined in object type {}

.github/workflows/workshop-ui-screenshots.lock.yml
497:9: error: [shellcheck] SC2001:style:21:15 — prefer ${variable//search/replace}
497:9: error: [shellcheck] SC2001:style:22:16 — prefer ${variable//search/replace}
497:9: error: [shellcheck] SC2034:warning:12:1 — refs appears unused
497:9: error: [shellcheck] SC2094:info:26:27 — read/write same file in pipeline
497:9: error: [shellcheck] SC2094:info:32:12 — read/write same file in pipeline
497:9: error: [shellcheck] SC2221:warning:24:25 — pattern always overrides later pattern (line 25)
497:9: error: [shellcheck] SC2222:warning:24:31 — pattern never matches (previous pattern line 25)
```

No token-like or credential-like values were present in the excerpted output.

Generated diff summary (22 lock files, all workflow_dispatch/concurrency regenerated)

```
22 files changed, 11824 insertions(+), 7825 deletions(-)
```

Files modified: `aw-accuracy-reviewer`, `curriculum-evaluator`, `docs-linker`, `guidelines-enforcer`, `manual-semver-release`, `markdown-dedup`, `q`, `security-side-quest`, `side-quest`, `title-similarity-review`, `training-plan-research`, `workflow-skills-editor`, `workshop-author`, `workshop-builder`, `workshop-explanatory-diagrams`, `workshop-link-checker`, `workshop-order-review`, `workshop-playwright-qa`, `workshop-skill-activity-author`, `workshop-student-simulator`, `workshop-sync-check`, `workshop-ui-screenshots` (all `.lock.yml`).

### Control Plane
- Correlation ID: `33818396937-30`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33818396937

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33818756303) · copilot · auto · 22 AIC · ⌖ 8.71 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 11:48 PM UTC

Start with the .github/workflows/*.md sources corresponding to workshop-student-simulator and workshop-ui-screenshots, then run gh aw compile with strict validation. Use the gh-aw MCP fix and compile tools rather than editing generated .lock.yml files, and review the affected workflow sources and generated diffs. Done means the expression, shellcheck, concurrency, and security findings are clean or any unsafe fix is documented.

Written by the indexing model from the issue text.