[aw-maintenance:compiler-security] Compiler validation failed for github/gh-aw-threat-detection (zizmor strict-mode anomaly + concurrency warning)

Compiling all 7 GitHub Agentic Workflows in `github/gh-aw-threat-detection` with the gh-aw compiler's full validation/lint/scanner suite exited with code **1** (2 finding categories: 1 lint warning, 1 unresolved scanner-status anomaly). No lock-file security vulnerabilities, no vulnerable container images, and no license findings were reported. Highest-severity supported finding: **unknown/unconfirmed** (zizmor step reported failure despite claiming 0 findings — see anomaly below). Recommended next action: run the local fixing loop below to add a `concurrency.job-discriminator` and to re-run zizmor locally to determine why it exits non-zero.

- **Target repository**: `github/gh-aw-threat-detection`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `7`
- **Generated lock files checked**: `7`
- **Result**: `findings`

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler (lint) | `detection-stats-daily.md` | unknown | `workflow_dispatch` trigger has no `concurrency.job-discriminator`; the generated conclusion concurrency group is shared across all dispatches | Add a discriminator, e.g. `${{ github.run_id }}`, to the workflow's concurrency group so concurrent dispatches don't collide |
| zizmor | all 7 compiled workflows | unknown (unconfirmed) | Compiler reports "✗ zizmor failed" while the same message states "zizmor found 0 security warnings/errors in workflows" — self-contradictory output. Cannot confirm an actual security finding from the evidence captured (`report.txt`); the underlying cause (e.g., a zizmor invocation/version error unrelated to findings) is not disclosed in the captured output | Re-run `gh aw compile --zizmor` locally/in the MCP loop to capture the full zizmor stderr/exit reason, then fix the real cause (or report back if it is a tooling defect rather than a workflow defect) |

No actionlint errors, no shellcheck/pyflakes errors, no vulnerable container images, and no license findings were present in the captured report beyond the above.

### Local fixing loop

1. Install or update the gh-aw extension, then configure your local coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`github/gh-aw-threat-detection`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely — in particular, capture and report the full zizmor stderr if it fails despite reporting 0 findings, since that message is self-contradictory and needs investigation before assuming a real security defect.

Raw compiler/scanner output (report.txt)

```
.github/workflows/detection-stats-daily.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; the generated conclusion concurrency group is shared by all dispatches of this workflow. Set a discriminator (for example, `${{ github.run_id }}`) to give each dispatch its own slot.

i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 7 files
i Running zizmor security scanner on 7 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

Generated lock-file diff summary

```
.github/workflows/detection-failure-monitor.lock.yml | 111 +++++++++---------
.github/workflows/detection-stats-daily.lock.yml | 115 ++++++++++---------
.github/workflows/gh-aw-issue-digest.lock.yml | 115 ++++++++++---------
.github/workflows/gh-aw-parity-monitor.lock.yml | 115 ++++++++++---------
.github/workflows/smoke-claude-standalone.lock.yml | 115 ++++++++++---------
.github/workflows/smoke-codex-standalone.lock.yml | 125 ++++++++++++---------
.github/workflows/smoke-copilot-standalone.lock.yml | 115 ++++++++++---------
7 files changed, 440 insertions(+), 371 deletions(-)
```

Git status (untracked/modified) at scan time:
```
M .github/workflows/detection-failure-monitor.lock.yml
M .github/workflows/detection-stats-daily.lock.yml
M .github/workflows/gh-aw-issue-digest.lock.yml
M .github/workflows/gh-aw-parity-monitor.lock.yml
M .github/workflows/smoke-claude-standalone.lock.yml
M .github/workflows/smoke-codex-standalone.lock.yml
M .github/workflows/smoke-copilot-standalone.lock.yml
?? .github/aw/logs/
```

### Control Plane
- Correlation ID: `33818396937-30`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33818396937

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33818828566) · copilot · auto · 16.2 AIC · ⌖ 7.4 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 11:49 PM UTC

Start with .github/workflows/detection-stats-daily.md and the captured report.txt; inspect the concurrency warning and the contradictory zizmor result across all seven workflows. Run gh aw compile --zizmor locally with the full output, then verify that the warning is resolved and zizmor either passes or has a documented tooling cause.

Written by the indexing model from the issue text.