Overview

Daily cross-repo compatibility audit run on 2026-04-22 against gh-aw 27e6b35. Compiled 20 public repositories (ranked by stars) that use gh-aw lock files. 17/20 pass, 3 fail after gh aw fix --write, 1 fixed by codemod.

Summary

Failures

1. storybookjs/storybook — 89,764 ⭐

Error: import file not found after codemod migration of tools.serena

The gh aw fix --write codemod correctly rewrites tools.serena to:

imports:
  - uses: shared/mcp/serena.md
    with:
      languages: ["typescript"]

...but does not create the target file shared/mcp/serena.md, leaving the workflow broken post-fix.

Full error:

.github/workflows/duplicate-code-detector.md:24:11: error: import file not found
  - uses: shared/mcp/serena.md

Suggested remediation: The Serena migration codemod should also scaffold shared/mcp/serena.md (or verify it exists) before writing the import reference.

2. vercel/vercel — 15,347 ⭐

Error: workflow_run trigger missing branch restrictions (strict mode)

.github/workflows/ci-doctor.md:1:1: error: workflow_run trigger should include branch
restrictions for security and performance.

gh aw fix --write does not address this. The repo's ci-doctor.md uses workflow_run without a branches: filter. This is a strict-mode security validation.

Suggested remediation: Add a codemod (or documentation) that auto-injects a safe default branch restriction (e.g., branches: [main, master]) into bare workflow_run triggers. Or, provide a clear diagnostic that links to the fix in the error output.

3. Azure/azure-sdk-for-js — 2,289 ⭐

Error: Missing required permission for dependabot toolset

.github/workflows/dexter.md:1:1: error: Missing required permissions for GitHub toolsets:
  - vulnerability-alerts: read (required by dependabot)

gh aw fix --write does not auto-inject this permission. The workflow uses the dependabot toolset but the frontmatter lacks vulnerability-alerts: read.

Suggested remediation: A codemod that auto-injects required permissions when a known toolset is declared (e.g., dependabot → vulnerability-alerts: read).

Successfully Fixed by Codemod

microsoft/pylance-release — roles: all was at workflow top-level instead of under on:. gh aw fix --write successfully applied the Move roles to on.roles codemod:

Before: roles: all  (top-level)
After:  on:
          roles: all

Potential Codemod Gaps

Note: Each gap appears in 1 repository (below the 2-repo threshold for a dedicated codemod proposal issue).

References:

• §24774431371

Generated by Daily AW Cross-Repo Compile Check · ● 408K · ◷

• expires on Apr 29, 2026, 11:05 AM UTC