Summary
Across the 20 repos audited today, two deprecated-syntax patterns recurred across independent repositories and were reliably auto-corrected by gh aw fix --write. Reporting the frequency here in case it's useful signal for prioritizing compile-time guidance, doc updates, or eventually hard-deprecating the old syntax.
Pattern 1: engine.model instead of top-level model (4 repos)
Most common deprecation warning seen in the sample.
| Repo |
Occurrences |
| dotnet/runtime |
5 workflow files |
| microsoft/gctoolkit |
2 workflow files |
| jonathanpeppers/dotnes |
1 workflow file |
| royshil/obs-backgroundremoval |
1 workflow file |
gh aw fix --write's "Move engine.model to top-level model" codemod resolved every instance without issue — this is purely a warning today, never blocks compilation, but its frequency suggests many workflow authors are still following older documentation/examples that show the nested form.
Pattern 2: pull_request_target trigger without checkout: false (2 repos)
Under --strict mode this is a hard compile error (not just a warning), since pull_request_target without checkout: false is a well-known "pwn request" attack vector.
| Repo |
Occurrences |
| runhey/OnmyojiAutoScript |
2 workflow files |
| dotnet/runtime |
1 workflow file |
gh aw fix --write's "Add checkout: false for pull_request_target" codemod resolved every instance cleanly.
Suggestion
Both codemods already work correctly — no action needed on the fix side. Consider whether gh aw compile (non-strict mode) should also surface pattern 2 as a warning rather than only failing under --strict, since a repo running the non-strict default would ship a "pwn request"-vulnerable workflow without any signal at all until someone happens to run --strict.
Generated by 🔧 Daily AW Cross-Repo Compile Check · agent · 314.4 AIC · ⊞ 7K · ◷
Summary
Across the 20 repos audited today, two deprecated-syntax patterns recurred across independent repositories and were reliably auto-corrected by
gh aw fix --write. Reporting the frequency here in case it's useful signal for prioritizing compile-time guidance, doc updates, or eventually hard-deprecating the old syntax.Pattern 1:
engine.modelinstead of top-levelmodel(4 repos)Most common deprecation warning seen in the sample.
gh aw fix --write's "Move engine.model to top-level model" codemod resolved every instance without issue — this is purely a warning today, never blocks compilation, but its frequency suggests many workflow authors are still following older documentation/examples that show the nested form.Pattern 2:
pull_request_targettrigger withoutcheckout: false(2 repos)Under
--strictmode this is a hard compile error (not just a warning), sincepull_request_targetwithoutcheckout: falseis a well-known "pwn request" attack vector.gh aw fix --write's "Add checkout: false for pull_request_target" codemod resolved every instance cleanly.Suggestion
Both codemods already work correctly — no action needed on the fix side. Consider whether
gh aw compile(non-strict mode) should also surface pattern 2 as a warning rather than only failing under--strict, since a repo running the non-strict default would ship a "pwn request"-vulnerable workflow without any signal at all until someone happens to run--strict.