Overview
Follow-up to the daily compatibility audit. These codemod proposals are sourced from repeated patterns across the 20-repo sample (see companion audit summary). Listed in priority order: gating impact first, then noise reduction.
1. Apply checkout: false codemod even when strict: false is set
Priority: high — gating (1 of 20 repos)
Observed in Azure/azure-sdk-for-js (★2293). gh aw fix --write correctly added checkout: false to 6 of 10 workflows but skipped mgmt-review.md — the only file with strict: false in frontmatter. When the user then ran gh aw compile --strict (CLI flag overrides frontmatter), mgmt-review.md failed with the pwn-request security error. End state: no way to make --strict pass without the user hand-editing.
Proposal: The pwn-request checkout: false codemod should apply unconditionally to any workflow using pull_request_target without checkout: false, regardless of frontmatter strict:. The strict knob governs which checks the compiler enforces; the codemod is just normalizing source to match the recommended-secure shape.
Alternative: emit a clear gh aw fix warning that says "skipped (file) because strict: false — remove strict:false or add checkout:false manually".
2. Strip built-in jobs from engine.env.needs
Priority: high — silent footgun (2 of 20 repos)
Observed in dotnet/sdk (★3122) and dotnet/skills (★1675). Warning text:
engine.env references built-in job 'pre_activation' in a needs expression. Built-in jobs are managed by the compiler and cannot be added as direct agent dependencies; this expression will silently evaluate to an empty string at runtime.
Proposal: Add a codemod that strips pre_activation (and any other built-in job names enumerated by the compiler) from engine.env.needs lists. If the list becomes empty, remove the key entirely. This eliminates an at-runtime silent-failure footgun.
3. Normalize fixed-daily crons to fuzzy schedules (opt-in)
Priority: medium — noise + scheduling fairness (3 of 20 repos)
Observed in dotnet/aspnetcore (★37921), Z3Prover/z3 (★12238), dotnet/skills (★1675). Warning text:
Schedule uses fixed daily time (6:0 UTC). Consider using fuzzy schedule 'daily' instead to distribute workflow execution times and reduce load spikes.
Proposal: Add an opt-in codemod gh aw fix --schedule-fuzzy that rewrites recognisable fixed daily/hourly cron patterns to gh-aw's fuzzy schedule shortcuts. Opt-in because the user may have intentionally chosen a specific time. If full rewrite is too aggressive, even a deterministic per-repo minute jitter would be valuable.
4. Auto-rewrite bash tool single-quoted args
Priority: medium — silent truncation (1 repo, 40 occurrences)
Observed in YousefHadder/markdown-plus.nvim (★245). Each bash tool entry containing single quotes (e.g. grep -rn 'pattern' --include='*.lua') emits a warning and is silently truncated to a prefix (e.g. grep -rn) for shell prefix-matching. The user loses precision they thought they had configured.
Proposal: Add a codemod that auto-rewrites bash tool list entries with single-quoted arguments into either double-quoted form or POSIX-safe escapes (preferring whichever round-trips identically through Copilot CLI). Even if a clean rewrite isn't always possible, surfacing this in gh aw fix rather than only as a compile warning gives users a fixable signal.
5. Lowercase discussion-category values in source
Priority: low — silent source drift (1 repo, 11 occurrences)
Observed in Z3Prover/z3 (★12238). gh-aw normalizes Agentic Workflows → agentic workflows at compile time silently. Over time the source file drifts from what the workflow actually matches.
Proposal: Codemod that lowercases discussion-category strings in the source file, so source equals runtime.
Aggregated impact
| Proposal |
Sample repos affected |
Severity |
checkout: false ignores strict: false |
1 |
Gates compilation |
Strip built-in jobs from engine.env.needs |
2 |
Silent runtime breakage |
| Fuzzy schedule rewrite |
3 |
Operational/fairness |
| Bash single-quote rewrite |
1 |
Silent truncation |
| Discussion-category lowercase |
1 |
Silent source drift |
The first two are clear correctness/gating wins. The remaining three reduce warning noise that almost every gh-aw consumer in the sample sees.
References:
- Audit data:
/tmp/gh-aw/cache-memory/aw-compat/runs/2026-05-12-09-30-39-742/missing-codemods.json
- §25725783675
Generated by Daily AW Cross-Repo Compile Check · ● 21.7M · ◷
Overview
Follow-up to the daily compatibility audit. These codemod proposals are sourced from repeated patterns across the 20-repo sample (see companion audit summary). Listed in priority order: gating impact first, then noise reduction.
1. Apply
checkout: falsecodemod even whenstrict: falseis setPriority: high — gating (1 of 20 repos)
Observed in Azure/azure-sdk-for-js (★2293).
gh aw fix --writecorrectly addedcheckout: falseto 6 of 10 workflows but skippedmgmt-review.md— the only file withstrict: falsein frontmatter. When the user then rangh aw compile --strict(CLI flag overrides frontmatter),mgmt-review.mdfailed with the pwn-request security error. End state: no way to make--strictpass without the user hand-editing.Proposal: The pwn-request
checkout: falsecodemod should apply unconditionally to any workflow usingpull_request_targetwithoutcheckout: false, regardless of frontmatterstrict:. Thestrictknob governs which checks the compiler enforces; the codemod is just normalizing source to match the recommended-secure shape.Alternative: emit a clear
gh aw fixwarning that says "skipped (file) because strict: false — remove strict:false or add checkout:false manually".2. Strip built-in jobs from
engine.env.needsPriority: high — silent footgun (2 of 20 repos)
Observed in dotnet/sdk (★3122) and dotnet/skills (★1675). Warning text:
Proposal: Add a codemod that strips
pre_activation(and any other built-in job names enumerated by the compiler) fromengine.env.needslists. If the list becomes empty, remove the key entirely. This eliminates an at-runtime silent-failure footgun.3. Normalize fixed-daily crons to fuzzy schedules (opt-in)
Priority: medium — noise + scheduling fairness (3 of 20 repos)
Observed in dotnet/aspnetcore (★37921), Z3Prover/z3 (★12238), dotnet/skills (★1675). Warning text:
Proposal: Add an opt-in codemod
gh aw fix --schedule-fuzzythat rewrites recognisable fixed daily/hourly cron patterns to gh-aw's fuzzy schedule shortcuts. Opt-in because the user may have intentionally chosen a specific time. If full rewrite is too aggressive, even a deterministic per-repo minute jitter would be valuable.4. Auto-rewrite bash tool single-quoted args
Priority: medium — silent truncation (1 repo, 40 occurrences)
Observed in YousefHadder/markdown-plus.nvim (★245). Each bash tool entry containing single quotes (e.g.
grep -rn 'pattern' --include='*.lua') emits a warning and is silently truncated to a prefix (e.g.grep -rn) for shell prefix-matching. The user loses precision they thought they had configured.Proposal: Add a codemod that auto-rewrites bash tool list entries with single-quoted arguments into either double-quoted form or POSIX-safe escapes (preferring whichever round-trips identically through Copilot CLI). Even if a clean rewrite isn't always possible, surfacing this in
gh aw fixrather than only as a compile warning gives users a fixable signal.5. Lowercase discussion-category values in source
Priority: low — silent source drift (1 repo, 11 occurrences)
Observed in Z3Prover/z3 (★12238). gh-aw normalizes
Agentic Workflows→agentic workflowsat compile time silently. Over time the source file drifts from what the workflow actually matches.Proposal: Codemod that lowercases discussion-category strings in the source file, so source equals runtime.
Aggregated impact
checkout: falseignoresstrict: falseengine.env.needsThe first two are clear correctness/gating wins. The remaining three reduce warning noise that almost every gh-aw consumer in the sample sees.
References:
/tmp/gh-aw/cache-memory/aw-compat/runs/2026-05-12-09-30-39-742/missing-codemods.json