[aw-maintenance:compiler-security] github/gh-aw compiler security scan: zizmor strict-mode gate anomaly + 218 workflow warnings (exit 1)

`github/gh-aw` compiled with **298/298** workflow sources and lock files generated, but `gh aw compile` exited **1** because the strict-mode zizmor security gate failed. Zizmor reports **0** security findings yet the gate still fails (`strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode`), which looks like a compiler/scanner integration defect rather than a genuine vulnerability — needs investigation before it can be classified as a real security finding. Beyond that, the compile surfaced 218 workflow-level warnings across several categories (repo-config schema violation, 97 cloud-hypervisor sandbox runtime warnings requiring human security review, 44 "unapproved action changes" in safe-update mode removing `docker/build-push-action`/`docker/setup-buildx-action`, 31 missing `concurrency.job-discriminator` warnings, plus scattered permission/id-token findings). No container image or license scanner output was present in the evidence (grype/syft/grant/poutine/runner-guard produced no findings recorded in `report.txt`). Recommended next action: run the local fixing loop below, starting with the zizmor gate anomaly and the cloud-hypervisor sandbox warnings (highest-severity/attention items), then clear the unapproved-action and discriminator warnings.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `298`
- **Generated lock files checked**: `298`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compile (strict, zizmor gate) | all 298 workflows | unknown | zizmor gate fails strict mode while reporting 0 findings (`zizmor found 0 security warnings/errors ... must have no zizmor findings`) — anomalous gate behavior, not a confirmed vulnerability | Investigate whether zizmor ran/produced output correctly in this environment; rerun `gh aw compile` with zizmor enabled and inspect raw zizmor output before treating as a real finding |
| gh-aw compile | `.github/workflows/aw.json` | warning | `auto_upgrade` field does not match repo-config schema (`oneOf` failed: expected boolean, got object with `options`) — compiler falls back to defaults (168h expiry) | Fix `auto_upgrade` in `aw.json` to match the schema (boolean, or the documented object shape) |
| gh-aw compile | 97 workflows (e.g. `ace-editor.md`, `agentic-token-trend-audit.md`, `api-consumption-report.md`, `architecture-guardian.md`, ...) | warning | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with an attached MCP gateway topology | Require human security review/approval before merge or rollout per compiler guidance; document approval in change process |
| gh-aw compile (safe update mode) | 44 workflows (e.g. `agent-job-health.md`, `agent-performance-analyzer.md`, `agentic-token-audit.md`, `workflow-normalizer.md`, ...) | warning | Unapproved action changes: `docker/build-push-action` and `docker/setup-buildx-action` removed from previously-approved set | Use `--approve` if the removal is intentional, or revert the unapproved changes; have an interactive agent review each case |
| gh-aw compile | 31 `workflow_dispatch` workflows (e.g. `agentic-token-trend-audit.md`, `technical-doc-writer.md`, `uk-ai-operational-resilience.md`, `video-analyzer.md`, ...) | warning | No `concurrency.job-discriminator`; generated concurrency group is shared across all dispatches | Add a discriminator, e.g. `${{ github.run_id }}`, to `concurrency` config |
| gh-aw compile | `test-quality-sentinel.md` | warning | Missing required `issues: read` permission for the `issues` toolset | Add `permissions: issues: read` to frontmatter, or remove the `issues` toolset |
| gh-aw compile | `smoke-copilot-aoai-entra.md` | warning | Workflow grants `id-token: write` permission | Confirm this is required (e.g. for OIDC/Entra auth) and scope it as narrowly as possible |

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt above and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Raw compiler summary

```
Target: github/gh-aw
Exit code: 1
Workflow sources: 298
Compiled locks: 298
```

298 lock files changed (net -20,527 lines: 15,119 insertions / 35,646 deletions across the full lock-file set), consistent with a compiler/template version bump rather than targeted logic changes. No credential or token-like strings observed in the evidence reviewed.

Per-category warning counts

- Total workflow-level warning lines: 218
- Unapproved action-change warnings: 44
- `sandbox.agent.runtime: cloud-hypervisor` warnings: 97
- Missing `concurrency.job-discriminator` warnings: 31
- `aw.json` schema warning: 1
- Zizmor strict-mode gate failure (0 findings reported): 1

### Control Plane
- Correlation ID: 33818396937-30
- Central repository: githubnext/gh-aw-cao
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33818396937

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33818734983) · copilot · auto · 36.3 AIC · ⌖ 9.53 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 11:51 PM UTC

Start with .github/workflows/aw.json and the .github/workflows/*.md sources; run gh aw compile with strict zizmor validation and inspect the raw zizmor output. Review the reported cloud-hypervisor, action-approval, concurrency, permission, and schema warnings without editing generated lock files. Done means the compiler and security checks pass, or unresolved human-review findings are clearly documented.

Written by the indexing model from the issue text.