Replace ${{ '' }} with "" in activation job outputs to eliminate zizmor obfuscation warnings - #4398

---

This section details on the original issue you should resolve

<issue_title>[task] Fix zizmor obfuscation warning by using plain empty strings in activation job outputs</issue_title>
<issue_description>## Objective
Replace ${{ '' }} expressions with plain empty strings "" in the activation job outputs to eliminate 72 zizmor obfuscation warnings across compiled workflows.

Context

The static analysis report (discussion #4380) identified 72 low-severity zizmor obfuscation warnings caused by the pattern:

outputs:
  comment_id: ${{ '' }}
  comment_repo: ${{ '' }}

This pattern is generated by the gh-aw compiler in pkg/workflow/compiler_jobs.go lines 670-675. While functionally correct, zizmor's heuristics flag this unusual syntax as potentially obfuscated code because using expressions for empty values is atypical.

Root Cause

The compiler uses ${{ '' }} to ensure empty string type in YAML (not null), but plain empty strings "" achieve the same result without triggering security scanners.

Approach

Modify pkg/workflow/compiler_jobs.go to use plain empty strings instead of expression syntax:

Current code (lines 670-675):

if _, exists := outputs["comment_id"]; !exists {
    outputs["comment_id"] = "${{ '' }}"
}
if _, exists := outputs["comment_repo"]; !exists {
    outputs["comment_repo"] = "${{ '' }}"
}

Proposed change:

if _, exists := outputs["comment_id"]; !exists {
    outputs["comment_id"] = ""
}
if _, exists := outputs["comment_repo"]; !exists {
    outputs["comment_repo"] = ""
}

Files to Modify

• Update: pkg/workflow/compiler_jobs.go (lines 670-675)

Testing Requirements

1. Run existing unit tests to ensure no regressions: make test-unit
2. Compile several workflows and verify outputs are still valid: gh aw compile
3. Recompile all workflows: make recompile
4. Run zizmor scan to verify warnings are eliminated: gh aw compile --zizmor
5. Verify that workflows with reactions still function correctly (comment_id and comment_repo are properly populated when needed)

Acceptance Criteria

• compiler_jobs.go uses plain empty strings "" instead of ${{ '' }}
• All existing tests pass
• Compiled workflows have valid YAML syntax
• Zizmor obfuscation warnings are eliminated (72 → 0)
• Workflows with reactions continue to work correctly
• All 45+ workflows recompiled successfully

Expected Impact

• Reduces zizmor findings from 73 to 1 (only template-injection warning remains)
• Improves security scan signal-to-noise ratio
• No functional changes to workflow behavior
• Cleaner, more idiomatic YAML output

Priority

Low - This is a security scanner false positive, not an actual vulnerability. However, fixing it reduces noise in security scans and follows YAML best practices.

AI generated by Plan Command for discussion #4380</issue_description>

Comments on the Issue (you are @copilot in this section)