Repository navigation
[aw-compat] Daily compatibility report: 9/17 repos fail strict-mode compile (2026-05-01) #29469
Description
Overview
Daily cross-repo compatibility audit completed on 2026-05-01 using gh-aw ca92916.
- Repos audited: 17 (all public repos confirmed to carry
.github/workflows/*.lock.ymlfiles) - Cloned OK: 17/17
- Compile PASS after
gh aw fix: 8/17 (47%) - Compile FAIL after
gh aw fix: 9/17 (53%)
Note: GitHub code search (/search/code) was rate-limited throughout this run. All repositories were discovered via gh search repos, topic search (gh-aw), and manual enumeration of known gh-aw consumers. Full code-search-based discovery was not possible.
Failed Repositories
| Repository | Stars | Error Cluster | Auto-fixed? |
|---|---|---|---|
github/gh-aw-mcpg |
123 | deprecated_sandbox_mcp_container, secret_expressions_in_agent_job |
No |
github/gh-aw-firewall |
62 | deprecated_sandbox_mcp_version |
No |
githubnext/gh-aw-test |
7 | deprecated_sandbox_agent_false (16 files) |
No |
githubnext/gh-aw-trial-oxpecker-test |
3 | missing_persist_credentials_false |
No |
githubnext/gh-aw-trial-FSharpStats-copilot-cli |
2 | missing_persist_credentials_false |
No |
AgentMeter/agentmeter-action |
2 | ✅ passed | — |
rshade/gh-aw-fleet |
2 | ✅ passed | — |
githubnext/gh-aw-trial-oxpecker-perf |
0 | missing_persist_credentials_false |
No |
githubnext/gh-aw-trial-FSarpStats-claude |
0 | missing_persist_credentials_false |
No |
githubnext/gh-aw-trial-hono-copilot-cli |
0 | missing_persist_credentials_false |
No |
az9713/gh-aw |
0 | deprecated_sandbox_mcp_container, invalid_engine_value, unknown_property_schema |
No |
Error Cluster Analysis
Cluster 1: missing_persist_credentials_false — 5 repos
Pattern: actions/checkout steps in the agent job without persist-credentials: false
All 5 affected repos are githubnext trial repos created from the same template. The fix command migrated other deprecated fields (e.g. timeout_minutes → timeout-minutes, removed add-comment.discussion) but did not add persist-credentials: false.
Error message:
.github/workflows/daily-test-improver.md:1:1: error: strict mode: actions/checkout step(s) without
'persist-credentials: false' detected in the agent job: 'Checkout repository'. Without this setting
the git token is stored in .git/config and leaked to the agent.
Affected files (one per repo):
daily-test-improver.mddaily-perf-improver.md
Before:
steps:
- name: Checkout repository
uses: actions/checkout@v5After (required):
steps:
- name: Checkout repository
uses: actions/checkout@v5
with:
persist-credentials: falseCluster 2: deprecated_sandbox_mcp_container — 2 repos, 11 occurrences
Pattern: sandbox.mcp.container key is set to a custom container image
Repos: github/gh-aw-mcpg (11 files), az9713/gh-aw (fork, 3 files).
Error message:
error: strict mode: 'sandbox.mcp.container' is not allowed because it is an internal implementation
detail. Remove 'sandbox.mcp.container' or set 'strict: false' to disable strict mode.
Before:
sandbox:
mcp:
container: "ghcr.io/github/gh-aw-mcpg"Workaround: Remove the key (container is auto-selected) or add strict: false.
Cluster 3: deprecated_sandbox_agent_false — 1 repo, 16 occurrences
Pattern: sandbox.agent: false disabling the sandbox firewall
Repo: githubnext/gh-aw-test (16 workflow files).
Error message:
error: strict mode: 'sandbox.agent: false' is not allowed because it disables the agent sandbox
firewall. This removes important security protections.
This test repo intentionally tests nosandbox scenarios. Suggested resolution: add strict: false per-workflow for legitimate testing workflows.
Cluster 4: deprecated_sandbox_mcp_version — 1 repo, 4 occurrences
Pattern: sandbox.mcp.version pinning an MCP server version
Repo: github/gh-aw-firewall (4 files).
Error message:
error: strict mode: 'sandbox.mcp.version' is not allowed because it is an internal implementation detail.
Before:
sandbox:
mcp:
version: v0.3.1Workaround: Remove sandbox.mcp.version (version is auto-managed).
Additional errors in az9713/gh-aw (fork)
engine: customis no longer a valid engine value. Valid engines:claude,codex,copilot,crush,gemini,opencode.error_patternsis an unknown property at top level.shared/*.mdfiles havestepsin wrong location (must be underon,secret-masking, orsafe-outputs).
This fork was likely created before several schema changes and has accumulated multiple compatibility issues.
Key Observations
gh aw fixdoes not fix the most common failure — Thepersist-credentials: falsegap affects 5/9 failing repos and is not auto-resolved.- Official GitHub repos also fail —
github/gh-aw-mcpgandgithub/gh-aw-firewallboth fail strict-mode compilation, suggesting these repos predate thesandbox.mcp.*strict-mode restriction. - Trial repo template has a security gap — All trial repos share the same
actions/checkoutwithout security hardening, indicating the template source needs updating.
Recommendations
- Add a
gh aw fixcodemod forpersist-credentials: false(see separate issue). - Add a
gh aw fixcodemod to removesandbox.mcp.containerandsandbox.mcp.versionwhen present. - Update the trial repo template to include
persist-credentials: falsein checkout steps. - Update
github/gh-aw-mcpg,github/gh-aw-firewall, andgithubnext/gh-aw-testto remove deprecated sandbox keys or addstrict: false.
References:
- §25206497318 — This workflow run
Generated by Daily AW Cross-Repo Compile Check · ● 688.8K · ◷
- expires on May 8, 2026, 8:30 AM UTC
Activity
github-actions commentedon May 1, 2026
This issue is being closed as outdated. A newer issue has been created: #29471
View newer issue
This action was performed automatically by the
Daily AW Cross-Repo Compile Checkworkflow.