[aw-compat] Daily AW compatibility audit (2026-08-06): 13/20 repos compile, 5 failure clusters

[github-actions]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Overview

Daily cross-repo compatibility audit compiled the latest local gh-aw build (59aefcf) against the top 20 public repositories found to be using gh-aw, then ran gh aw fix --write and recompiled to measure how much automatic upgrade tooling closes the gap.

Note on discovery method: gh search code (content-based lock-file search) was not usable in this run's sandbox — even unrelated control queries returned results scoped only to github/gh-aw itself. Discovery fell back to gh api search/repositories (README/description/topic matches) plus per-repo verification of actual .github/workflows/*.lock.yml files via the git trees API. This is a reasonable substitute but likely misses adopters that don't mention "gh-aw" in their README/description.

Key metrics

Metric	Value
Repositories audited	20
Compile succeeded (before fix)	11 / 20
Compile succeeded (after fix --write)	13 / 20
Net improvement from fix pass	+2
Still failing after fix	7 / 20
Total files changed by fix --write across all repos	336

Failure clusters

1. Strict-mode guardrails correctly rejecting insecure config (expected-by-design) — github/gh-aw-mcpg, github/gh-aw-firewall, githubnext/gh-aw-test (26 workflows total). These are gh-aw's own smoke-test/negative-test fixture repos deliberately exercising insecure configurations (secrets in top-level env, sandbox.mcp.container override, sudo: true, sandbox.agent: false) under --strict. This is not a compatibility bug — it confirms the strict-mode guardrails and the existing "guided-error" codemod (which intentionally refuses to auto-rewrite security-sensitive secret placement) are working as intended.
2. allowed-repos: current rejected — pelikhan/github-agentic-workflows, evoskill.md. Only all, public, or ${{ github.repository }} are accepted; no codemod migrates the older/friendlier current alias.
3. toolset: (singular) typo not auto-fixed — githubnext/gh-aw-trial-oxpecker-test, daily-test-improver.md. The compiler already emits "Did you mean 'toolsets'?" but no codemod applies that exact, unambiguous rename.
4. engine: opencode unsupported — githubnext/self-hosted-aw, local-macrunner-qwenollama.md. Valid engines are claude, codex, copilot, gemini, pi. This isn't a typo — it looks like a reference to a removed/experimental engine integration rather than something fix can resolve.
5. Write gh commands called directly in agent job steps — zircote-plugins/github-agentic-workflows (3 workflows: copilot-pr-lifecycle.md, daily-intelligence.md, weekly-develop-merge.md), calling gh pr ready, gh pr edit, gh pr merge. Agent jobs run read-only by design; this is a recurring user misunderstanding of the safe-outputs model rather than a parser bug.

Per-repo results (20 repos)

Repo	Stars	Compile (before)	Fix	Compile (after)	Files changed
githubnext/agentics	885	ok	ok	ok	6
github/gh-aw-mcpg	153	fail	ok	fail	24
github/gh-aw-firewall	120	fail	3 manual-fix-required	fail	54
githubnext/autoloop	57	ok	ok	ok	2
github/gh-aw-actions	42	ok	ok	ok	2
githubnext/gh-aw-workshop	31	ok	ok	ok	26
githubnext/agentic-ops	18	ok	ok	ok	7
githubnext/ado-aw	18	ok	ok	ok	28
github/gh-aw-threat-detection	11	ok	ok	ok	11
githubnext/agentics-template	9	fail	ok	ok (fixed)	4
pelikhan/github-agentic-workflows	9	fail	ok	fail	14
githubnext/gh-aw-test	8	fail	ok	fail	126
clientfirsttech/github-agentic-workflow-power-bi-mcp-example	4	ok	ok	ok	1
githubnext/self-hosted-aw	4	fail	ok	fail	5
joshjohanning-org/agents-and-agentic-workflows	4	ok	ok	ok	13
rshade/gh-aw-fleet	3	ok	ok	ok	5
github/gh-aw-harness	3	ok	ok	ok	2
githubnext/gh-aw-trial-oxpecker-test	3	fail	ok	fail	1
zircote-plugins/github-agentic-workflows	2	fail	ok	fail	2
githubnext/gh-aw-trial-FSharpStats-copilot-cli	2	fail	ok	ok (fixed)	3

Codemods successfully applied this run

• Move engine.model to top-level model
• Migrate timeout_minutes to timeout-minutes
• Remove deprecated add-comment.discussion field
• Add persist-credentials: false to checkout steps
• Migrate on.command to on.slash_command
• Migrate upload-assets to upload-asset
• Replace anonymous bash tool syntax with explicit true
• Transform activation outputs to sanitized step
• Rewrite single-quoted bash tool args
• Move roles to on.roles
• Rename deprecated safe-outputs title-prefix constraints
• Move engine.max-turns to top-level max-turns
• Migrate install script URL from githubnext/gh-aw to github/gh-aw

These all worked correctly and account for the 336 changed files / +2 net compile fixes.

Missing-codemod candidates (below the 2-repo threshold)

Two credible, low-risk codemod candidates were identified but each appeared in only 1 of the 20 repos this run, so no standalone "missing codemod" issue was filed. Logging them here to accumulate signal across future runs:

• allowed-repos: current → allowed-repos: ${{ github.repository }} (or similar legacy-alias mapping) — seen in pelikhan/github-agentic-workflows.
• toolset: → toolsets: under tools/github (and possibly other MCP tool blocks) — the compiler's own suggestion is exact and unambiguous — seen in githubnext/gh-aw-trial-oxpecker-test.

Suggested follow-ups

• Consider whether engine: opencode should emit a clearer "removed/unsupported engine" error (vs. the generic invalid-engine list) if it was previously supported.
• Consider a gh aw doctor-style lint hint when agent-job steps call known write gh subcommands (pr merge, pr edit, pr ready, etc.), pointing directly at the matching safe-output.

References:

• githubnext/agentics
• pelikhan/github-agentic-workflows
• githubnext/gh-aw-trial-oxpecker-test

Generated by 🔧 Daily AW Cross-Repo Compile Check · agent · 201.3 AIC · ⊞ 7K · ◷

• expires on Aug 13, 2026, 2:12 AM UTC-08:00