[aw-compat] Daily aw-compat report: 6/20 failures (2026-04-17) — compiler panic + secrets violations

[github-actions]

This is the daily automated compatibility audit for gh-aw against top public repositories using lock files.

Summary

Metric	Value
Repositories tested	20
Successful compilations	14
Failed compilations	6 (30%)
Compiler panics	1 🚨
gh-aw version	74d8068
Run timestamp	2026-04-17 10:52 UTC
Run ID	§24561385452

🚨 Critical: Compiler Panic

C-Ross/LlamaOfFate triggers a nil pointer dereference crash in gh-aw compile --strict when all workflow files are shared components (no on: field). This is a bug in the compiler itself.

panic: runtime error: invalid memory address or nil pointer dereference
github.com/github/gh-aw/pkg/workflow.scanWorkflowsForExpires(...)
    pkg/workflow/maintenance_workflow.go:206
github.com/github/gh-aw/pkg/workflow.GenerateMaintenanceWorkflow(...)
    pkg/workflow/maintenance_workflow.go:107

Root cause: scanWorkflowsForExpires does not guard against an empty/all-shared workflow slice. When there are no compilable workflows (all skipped as shared), the function receives nil or zero-length data and panics.

Fix required: Add nil/empty check in maintenance_workflow.go:206 before dereferencing workflow slice.

Failed Repositories

View all 6 failures

github/copilot-sdk (8,432 ⭐) — Secrets in steps (strict mode)

cross-repo-issue-analysis.md:1:1: error: strict mode: secrets expressions detected in
'steps' section may be leaked to the agent job.
Found: $\{\{ secrets.RUNTIME_TRIAGE_TOKEN }}

Pattern: git clone (xaccesstoken/redacted):$\{\{ secrets.TOKEN }}@github.com/... in a run: step.
Fix: Move the clone to a separate job or use env: binding at step level.

---

microsoft/FluidFramework (4,920 ⭐) — MCP server in tools section

duplicate-code-detector.md:1:1: error: tools.serena: unknown tool name.
If 'serena' is a custom MCP server, define it under 'mcp-servers' instead.

Pattern: tools:\n serena: ["typescript"]
Fix: Move serena from tools: to mcp-servers: with command/args definition.

---

AdaCore/z3 (0 ⭐) — Cross-repo include auth + unknown safe-output

6 of 6 workflows fail:

1. failed to fetch file content: authentication token not found for host github.com (5 workflows, referencing agentics/shared/* private includes)
2. Unknown property: push-to-pr-branch in safe-outputs section (pr-fix.md)

Fix for (2): push-to-pr-branch may be a removed/renamed safe-output property. Check current docs.

---

C-Ross/LlamaOfFate (0 ⭐) — Compiler panic (see Critical section above)

Exit code: 2. All 4 workflow files are shared components with no on: field.

---

Pierre-VF/oss4climate (0 ⭐) — Duplicate YAML mapping key

repo-assist.md:36:3: error: mapping key "allowed" already defined at [28:3]

Pattern: allowed: key appears twice in the network: section.
Fix: Merge both allowed: blocks into a single list.

---

TJKlein/mcpruntime (0 ⭐) — Secrets in engine.env (strict mode)

All 3 workflows fail:

engine.env section will be leaked to the agent container.
Found: $\{\{ secrets.AZURE_OPENAI_ENDPOINT }}

Pattern: Azure OpenAI credentials in engine.env for custom codex engine.
Fix: Use engine-specific secret configuration instead of inline engine.env.

Fix Pass Effectiveness

The gh aw fix --write pass resolved 0 of 6 failures. The fix codemods do not yet cover secrets-in-strict-mode violations, tools/mcp-servers confusion, auth-required includes, or compiler panics.

Recommendations

1. Bug fix (priority: high): Fix nil pointer in maintenance_workflow.go:206 — crashes on all-shared-workflow repos
2. Codemod: Add tools → mcp-servers migration codemod for fix --write
3. Documentation: Clarify push-to-pr-branch removal/rename in safe-outputs changelog
4. Recurring error: Secrets in strict mode (2 repos) — see companion issue

References:

• §24561385452

Generated by Daily AW Cross-Repo Compile Check · ● 681.5K · ◷

• expires on Apr 24, 2026, 11:04 AM UTC

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #26847

View newer issue

---

This action was performed automatically by the Daily AW Cross-Repo Compile Check workflow.