[aw-maintenance:compiler-security] github/gh-aw-mcpg: gh-aw compiler strict-mode failure (5 actionlint/shellcheck errors) + review-mode findings

**Target repository**: `github/gh-aw-mcpg` (target SHA `97a3970b`)
**Compiler exit code**: `1`
**Workflow sources checked**: `36`
**Generated lock files checked**: `36`
**Result**: `findings`

Compiling all `.github/workflows/*.md` sources with strict mode fails: actionlint's shellcheck integration reports 5 errors in the generated `release.lock.yml`, so `gh aw compile --strict` cannot pass. In addition, one workflow (`github-mcp-guard-coverage-checker.md`) is missing a required GitHub permission, three workflows reference `/tmp/` directly instead of the sandboxed `/tmp/gh-aw/agent/` artifact root, and `release.md` has two configuration warnings (missing `concurrency.job-discriminator` for `workflow_dispatch`, and a `push-to-pull-request-branch` target that needs a wildcard `checkout.fetch` pattern). Highest-severity/blocking item: the 5 actionlint/shellcheck errors in `release.lock.yml`, which are the actual compile-blocking failures (exit code 1).

### Findings

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck SC2001) | release.lock.yml:1410 | error | Inline shell script uses `sed`-style pattern where `${variable//search/replace}` would be more robust/idiomatic | Rewrite the shell substitution in `release.md`'s embedded script using bash parameter expansion instead of `sed`/regex capture |
| actionlint (shellcheck SC2086, x4) | release.lock.yml:1410 (lines 12–15 of embedded script) | error/info | Unquoted shell variables in a `run:` step risk globbing/word-splitting | Quote the affected variables (`"$VAR"`) in the shell script embedded in `release.md` |
| gh-aw permission checker | github-mcp-guard-coverage-checker.md | warning | Missing `pull-requests: read` permission required by the `pull_requests` GitHub toolset | Add `permissions: pull-requests: read` to frontmatter, or remove the `pull_requests` toolset if not needed |
| gh-aw prompt linter | gpl-dependency-checker.md, mcp-gateway-log-analyzer.md, test-improver.md, release.md | warning | Prompt references `/tmp/` directly instead of the sandboxed `/tmp/gh-aw/agent/` artifact root | Update prompt text to use `/tmp/gh-aw/agent/` for all agent-generated temporary files |
| gh-aw concurrency checker | release.md | warning | `workflow_dispatch` trigger has no `concurrency.job-discriminator`; concurrency group is shared across all dispatches | Add a discriminator such as `${{ github.run_id }}` to the concurrency group |
| gh-aw safe-outputs checker | release.md | warning | `push-to-pull-request-branch` with `target: "*"` requires PR branches to be fetched, but checkout config lacks a wildcard fetch | Add `checkout: fetch: ["*"], fetch-depth: 0` to the workflow's checkout configuration |
| gh-aw domain linter | multiple (repeated, 9x) | info | Recommends ecosystem identifier `github` instead of raw domain `github.com` for network egress config | Replace `github.com` domain entries with the `github` ecosystem identifier where used in `network:` allow-lists |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository (`github/gh-aw-mcpg`).
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler/scanner output (bounded)

```
Target: github/gh-aw-mcpg
Exit code: 1
Workflow sources: 36
Compiled locks: 36
```

Key excerpt (full report available in workflow run artifacts):

```
.github/workflows/github-mcp-guard-coverage-checker.md: warning: Missing required permissions for GitHub toolsets:
- pull-requests: read (required by pull_requests)

.github/workflows/gpl-dependency-checker.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ ...
.github/workflows/mcp-gateway-log-analyzer.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ ...
.github/workflows/test-improver.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ ...
.github/workflows/release.md: warning: Prompt references /tmp/ directly. Use /tmp/gh-aw/agent/ ...
.github/workflows/release.md: warning: workflow_dispatch workflow has no concurrency.job-discriminator; ...

⚠ push-to-pull-request-branch: target: "*" requires that all PR branches are fetched at checkout.

i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 22 files
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2001:style — See if you can use ${variable//search/replace} instead
.github/workflows/release.lock.yml:1410:9: error: [shellcheck] SC2086:info — Double quote to prevent globbing and word splitting (x3)
✗ actionlint failed
strict mode: actionlint found 5 errors in workflows - workflows must have no actionlint errors in strict mode
```

Recompile diff summary (22 lock files regenerated by compiler, informational)

```
.github/workflows/daily-compliance-checker.lock.yml | 75 ++++++++++---------
.github/workflows/duplicate-code-detector.lock.yml | 75 ++++++++++---------
.github/workflows/gateway-issue-dispatcher.lock.yml | 75 ++++++++++---------
.github/workflows/ghcr-download-tracker.lock.yml | 75 ++++++++++---------
.github/workflows/github-mcp-guard-coverage-checker.lock.yml | 59 ++++++++-------
.github/workflows/go-fan.lock.yml | 57 ++++++++-------
.github/workflows/go-logger.lock.yml | 75 ++++++++++---------
.github/workflows/gpl-dependency-checker.lock.yml | 75 ++++++++++---------
.github/workflows/guard-status-tracker.lock.yml | 75 ++++++++++---------
.github/workflows/integrity-filtering-audit.lock.yml | 75 ++++++++++---------
.github/workflows/issue-monster.lock.yml | 83 ++++++++++++----------
.github/workflows/mcp-gateway-log-analyzer.lock.yml | 75 ++++++++++---------
.github/workflows/nightly-docs-reconciler.lock.yml | 75 ++++++++++---------
.github/workflows/nightly-schema-updater.lock.yml | 75 ++++++++++---------
.github/workflows/nightly-workflow-compiler.lock.yml | 75 ++++++++++---------
.github/workflows/plan.lock.yml | 79 ++++++++++----------
.github/workflows/release.lock.yml | 79 ++++++++++----------
.github/workflows/repo-assist.lock.yml | 82 ++++++++++-----------
.github/workflows/rust-guard-improver.lock.yml | 75 ++++++++++---------
.github/workflows/semantic-function-refactor.lock.yml | 75 ++++++++++---------
.github/workflows/test-coverage-improver.lock.yml | 79 ++++++++++----------
.github/workflows/test-improver.lock.yml | 78 ++++++++++----------
22 files changed, 875 insertions(+), 771 deletions(-)
```

This diff reflects lock files being regenerated from current sources (e.g. gh-aw version/template drift) and is separate from the actionlint errors above; review it after applying source fixes to confirm no unintended behavior changes.

Note on scope: no container images, license (GPL), or dedicated security-scanner (zizmor/poutine/runner-guard/grype/syft) findings were present in the captured report; the report only contains actionlint/shellcheck errors and gh-aw compiler warnings/info messages as listed above.

### Control Plane
- Correlation ID: `33818396937-30`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33818396937

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33818807516) · copilot · auto · 19.5 AIC · ⌖ 7.36 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 11:50 PM UTC

Work in the .github/workflows/*.md sources, especially release.md, github-mcp-guard-coverage-checker.md, gpl-dependency-checker.md, mcp-gateway-log-analyzer.md, and test-improver.md; do not edit generated .lock.yml files. Start by running gh aw compile --strict in github/gh-aw-mcpg and inspect the embedded script producing release.lock.yml: done means the reported permission, path, concurrency, fetch, and shellcheck findings are resolved and the full listed validation scan passes.

Written by the indexing model from the issue text.