[aw-compat] Daily AW compat audit (2026-08-19): 8/20 repos fail after fix, gh search code unavailable

[github-actions]

Overview

Daily cross-repo compilation audit of gh-aw against real-world repositories.
Build under test: gh aw version 0368d98 (commit 0368d98).

⚠️ Discovery method deviation: gh CLI authentication was broken in this
run (invalid sandbox GH_TOKEN), and GitHub's code-search API requires auth
even for public content — so the specified discovery method (gh search code
over .lock.yml content) was completely unavailable. This run substituted
unauthenticated search/repositories metadata queries (10 req/min limit),
filtered and verified against real *.lock.yml files via the Contents API.
That surfaced 34 verified gh-aw-using repos (vs. a 60+ candidate target) —
biased toward repos that mention "gh-aw" in their README/description/topics.
Numbers below should be read with that smaller, biased sample in mind.

Key metrics

Metric	Value
Repos selected (by stars)	20
Clone success	20/20
Failed compile --strict (before fix)	11/20
Fixed automatically by gh aw fix --write	4/20
Still failing after fix	8/20

Repos still failing after gh aw fix --write

Repository	Stars	Root cause
github/gh-aw-firewall	130	gvisor+privileged codemod gap; private-to-public-flows: allow in strict mode
github/gh-aw-mcpg	159	gvisor+privileged codemod gap; strict-mode test fixtures (intentional)
githubnext/gh-aw-workshop	37	Generated GH_AW_TOOLS_META_JSON expression exceeds GitHub Actions' 21KB template-expression limit
chrizbo/agentics-beyond-code	21	tools.bash must be explicit when min-integrity: none
verkyyi/github-agent-runner	10	tools.bash must be explicit when min-integrity: none
githubnext/gh-aw-test	8	strict-mode test fixtures (intentional, sandbox.agent: false)
githubnext/self-hosted-aw	4	engine: opencode used directly instead of imported as a shared definition
zircote-plugins/github-agentic-workflows	2	Agent job calls write gh commands (gh pr merge/edit/ready) instead of safe-outputs

Fixed automatically (fix pipeline working correctly)

• githubnext/ado-aw — added explicit cli-proxy: false when tools.bash disabled
• pelikhan/github-agentic-workflows — upload-assets→upload-asset, allowed-repos: current→${{ github.repository }}, anonymous bash syntax, on.command→on.slash_command
• githubnext/agentics-template — roles moved under on.roles
• githubnext/gh-aw-trial-oxpecker-test — timeout_minutes→timeout-minutes, tools.github.toolset→toolsets, deprecated add-comment.discussion removed

These confirm the existing codemod registry handles common renames/moves well.

Repos that already compiled cleanly

githubnext/agentics, github/gh-aw-actions, github/gh-aw-threat-detection,
elbruno/weekly-ai-news-digest, joshjohanning-org/agents-and-agentic-workflows,
clientfirsttech/github-agentic-workflow-power-bi-mcp-example,
rshade/gh-aw-fleet, github/gh-aw-harness — 8/20 repos, no action needed.

Notable non-issue

gh aw fix logged Failed to fetch .github/aw markdown file list from github/gh-aw: github API returned 403 Forbidden. Falling back to embedded list on nearly every repo. This is caused by this run's broken GH_TOKEN
(see deviation note above), not a gh-aw defect — the fallback to the embedded
list worked correctly in every case.

Possible compiler regression to investigate

githubnext/gh-aw-workshop's workshop-builder.md fails compilation because
the compiler's own generated GH_AW_TOOLS_META_JSON inline template
expression (24.9 KB) exceeds GitHub Actions' hard 21KB limit for ${{ }}
expressions. This is compiler-generated output, not user error, and would
affect any workflow whose tool metadata grows large enough. Worth checking
whether the generator can split this into multiple run: blocks as the error
message suggests.

See the separate missing-codemods issue for the two recurring codemod gaps
(gvisor+privileged sandbox combo, and tools.bash required when
min-integrity: none).

Generated by 🔧 Daily AW Cross-Repo Compile Check · agent · 165.4 AIC · ⌖ 7.88 AIC · ⊞ 7.3K · ◷

• expires on Aug 26, 2026, 1:16 AM UTC-08:00