[aw-compat] gh aw fix: reports "✓ No fixes needed" (exit 0) while a guided-error codemod says "Manual fix required"

[github-actions]

gh aw fix reports "✓ No fixes needed" (exit 0) while a guided-error codemod prints "Manual fix required"

Discovered during a cross-repo compile audit against a fresh local build (gh aw version 3ea90c7).

When a workflow triggers the top-level-env-secrets-guided-error codemod (a guided/manual-fix codemod), gh aw fix prints the error and the "no fixes needed" success line, and exits 0. Automation that pipes gh aw fix cannot detect that a manual remediation is required.

Reproduction

Repo github/gh-aw-firewall, file .github/workflows/smoke-copilot-byok-aoai-entra.md (top-level env: holds AZURE_CLIENT_ID / AZURE_TENANT_ID):

$ gh aw fix smoke-copilot-byok-aoai-entra
✗ Error processing smoke-copilot-byok-aoai-entra.md: codemod top-level-env-secrets-guided-error failed: top-level env: contains secrets that will be leaked to the agent container. Found: ${{ secrets.AZURE_CLIENT_ID }}, ${{ secrets.AZURE_TENANT_ID }}. Manual fix required: move the secret into engine-specific secret configuration.

i ✓ No fixes needed
$ echo $?
0

Why it matters

• The ✗ Error processing ... line and the ✓ No fixes needed summary contradict each other.
• Exit code 0 means CI/automation treats the run as fully successful, silently dropping a required manual action.
• Guided-error codemods exist specifically to surface manual-fix conditions; that signal is lost at the command boundary.

Suggested fix

• When any codemod emits a guided/manual-fix error, gh aw fix should not print ✓ No fixes needed; print e.g. ✗ 1 file needs a manual fix instead.
• Return a non-zero exit code (distinct from crash) so automation can branch on "manual fix required".
• Optionally add a --strict/--error-on-manual flag to make the manual-fix condition fail hard.

Environment

• Binary: local build at commit 3ea90c7.
• Reproduced deterministically (2/2 runs), both in bulk fix --write and single-file dry-run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• models.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "models.dev"

See Network Configuration for more information.

Generated by 🔧 Daily AW Cross-Repo Compile Check · 334.2 AIC · ⌖ 33 AIC · ⊞ 6.6K · ◷

• expires on Jul 10, 2026, 2:01 AM UTC-08:00