[aw-maintenance:compiler-security] Compiler security findings: github/gh-aw-firewall (actionlint strict-mode errors + advisory warnings)

Compiler validation of `github/gh-aw-firewall` (70 workflow sources, 70 lock files) failed in strict mode with exit code 1: actionlint found 7 shellcheck errors across 3 lock files (`duplicate-code-detector`, `smoke-chroot`, `smoke-claude`), plus 45 advisory warnings (mostly `sandbox.agent.runtime: cloud-hypervisor` privileged-KVM review notices and missing `concurrency.job-discriminator` on `workflow_dispatch` workflows). Highest-severity supported finding: actionlint/shellcheck errors blocking strict-mode compilation. Recommended next action: run the local fixing loop below to resolve the shellcheck findings and re-add job discriminators.

- **Target repository**: `github/gh-aw-firewall`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `70`
- **Generated lock files checked**: `70`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | duplicate-code-detector.lock.yml:466 | warning (blocks strict mode) | SC2038: unsafe `find` piped without `-print0`/`xargs -0` (non-alphanumeric filenames) | Use `find .. -print0 \| xargs -0 ..` or `find .. -exec .. +` |
| actionlint/shellcheck | duplicate-code-detector.lock.yml:466 | style (blocks strict mode) | SC2129: repeated individual redirects instead of grouped `{ }` | Group commands with `{ cmd1; cmd2; } >> file` |
| actionlint/shellcheck | smoke-chroot.lock.yml:550 | warning (blocks strict mode) | SC2155: `export GOROOT=$(go env GOROOT)` masks command return value | Declare then assign: `export GOROOT; GOROOT=$(go env GOROOT)` |
| actionlint/shellcheck | smoke-claude.lock.yml:502,510,516 | info (blocks strict mode) | SC2086 (×3): unquoted variables risk globbing/word-splitting (`$EXPR_GITHUB_REPOSITORY`, `$EXPR_GITHUB_RUN_ID`) | Double-quote the variable expansions |
| gh-aw linter | 8 workflows (auth-doctor-updater, doc-maintainer, model-api-mapping-updater, sbx-gvisor-doc-updater, schema-sync, self-hosted-runner-doctor-updater, smoke-cloud-hypervisor* (3), smoke-playwright-cloud-hypervisor, update-release-notes) | unknown | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with attached MCP gateway; requires explicit human security review before merge/rollout | Record explicit human security-review approval in the change process before merging/rolling out these workflows |
| gh-aw linter | ~20 `workflow_dispatch` workflows (e.g. build-test, contribution-check, security-guard, smoke-* family) | unknown | Missing `concurrency.job-discriminator`; generated conclusion concurrency group shared across all dispatches | Add a discriminator such as `${{ github.run_id }}` to `concurrency.job-discriminator` |
| gh-aw linter | smoke-copilot-byok-aoai-entra.md | unknown | Workflow grants `id-token: write`; OIDC token could authenticate to cloud providers | Verify audience validation and trust policy configuration are correct for this OIDC use |
| gh-aw linter | self-hosted-runner-doctor.md, build-test-network-isolation.md | unknown | Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/` | Update prompt to use `/tmp/gh-aw/agent/` as the temp-file root |
| gh-aw linter (advisory) | multiple workflows | unknown | Recommend ecosystem identifiers instead of individual domains for firewall allow-lists (e.g. `cloud.google.com`→`chrome`, `crates.io`→`rust`, `api.openai.com`→`codex`, etc.) | Replace individual domains with the suggested ecosystem identifiers for maintainability |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler summary

```
Target: github/gh-aw-firewall
Exit code: 1
Workflow sources: 70
Compiled locks: 70
```

70 lock files changed (`git-status.txt`/`diff-stat.txt`), consistent with a routine `gh aw compile` regeneration; no unexpected file modifications observed.

Full raw actionlint/lint output (redacted, bounded)

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 68 files
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2038:warning:3:1: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2038:warning:5:1: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames
.github/workflows/duplicate-code-detector.lock.yml:466:9: error: [shellcheck] SC2129:style:3:82: Consider using { cmd1; cmd2; } >> file instead of individual redirects
.github/workflows/smoke-chroot.lock.yml:550:9: error: [shellcheck] SC2155:warning:4:8: Declare and assign separately to avoid masking return values
.github/workflows/smoke-claude.lock.yml:502:9: error: [shellcheck] SC2086:info:2:85: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:510:9: error: [shellcheck] SC2086:info:1:19: Double quote to prevent globbing and word splitting
.github/workflows/smoke-claude.lock.yml:516:9: error: [shellcheck] SC2086:info:1:40: Double quote to prevent globbing and word splitting
✗ actionlint failed
strict mode: actionlint found 7 errors in workflows - workflows must have no actionlint errors in strict mode
```

No token-like or credential-like values were present in the raw output.

### Control Plane
- Correlation ID: `33818742682-20`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33818742682`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33818742682) · copilot · auto · 29.5 AIC · ⌖ 7.21 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 11:49 PM UTC

In github/gh-aw-firewall, begin with the affected .github/workflows/*.md sources corresponding to duplicate-code-detector.lock.yml, smoke-chroot.lock.yml, and smoke-claude.lock.yml; do not edit generated locks. Configure the gh-aw MCP server, then use its fix and compile tools and rerun the listed strict validation scans. Done means the shellcheck findings and workflow discriminator issues are resolved, with any required human security review explicitly recorded.

Written by the indexing model from the issue text.