4. **Fix and gate.** Add a minimal fix/regression. Compile current source with `--dry-run`: strict, staged, source validation, shellcheck and model checks, warnings as errors. Docker-based checks are optional; Docker unavailability does not block the gate. When Docker is available, recommend `gh aw validate WORKFLOW` for source checks and `gh aw compile WORKFLOW --dry-run --zizmor --actionlint --poutine` for scanner checks. Run these scanners if possible; `validate` itself skips them. Unsupported `--dry-run`, missing required checks or failed compilation blocks live testing, not local diagnosis. Existing/generated locks need a successful gate for current hashes. Never downgrade required checks, suppress findings, substitute `strict: true`, use `--approve`, or commit to erase warnings.

gh aw validate WORKFLOW

gh aw compile WORKFLOW --dry-run --zizmor --actionlint --poutine

Docker-based scanners and `--validate-images` are opt-in, not dry-run gate

requirements. Run zizmor, actionlint and poutine when possible; report unavailable

checks as unverified, not passed. Without Docker, use a native `shellcheck` binary

for the required run-step linting. Findings or failures from requested checks still

fail the dry-run gate.

`validate` uses `--no-emit`, which skips zizmor, actionlint and poutine. Only the

scanner-enabled compile command above runs them; a passing `validate` command

does not establish scanner coverage.

When Docker is available, recommend both commands: `validate` checks source

func TestCompileDevelopmentAllowsOptionalDockerChecks(t *testing.T) {

t.Parallel()

for _, value := range []string{"false", "true"} {

t.Run(value, func(t *testing.T) {

t.Parallel()

cmd := &cobra.Command{}

cmd.Flags().Bool("dry-run", false, "")

scanners := []string{

"validate-images", "zizmor", "actionlint", "poutine", "runner-guard",

"syft", "grype", "grant", "yamllint",

}

args := []string{"--dry-run"}

for _, name := range scanners {

cmd.Flags().Bool(name, false, "")

args = append(args, "--"+name+"="+value)

}

if err := cmd.ParseFlags(args); err != nil {

t.Fatal(err)

}

opts := getCompileCmdOptions(cmd)

if err := cli.ValidateDevelopmentCompileFlags(opts.dryRun, opts.explicitBoolFlags); err != nil {

t.Fatalf("Docker checks must remain optional in dry-run mode: %v", err)

}

config := opts.toCompileConfig(nil)

for _, actual := range []bool{

config.ValidateImages, config.Zizmor, config.Actionlint, config.Poutine,

config.RunnerGuard, config.Syft, config.Grype, config.Grant, config.Yamllint,

} {

if actual != (value == "true") {

t.Fatalf("optional Docker check value %q was not preserved", value)

}

}

})

}

}

compileCmd.Flags().Bool("dry-run", false, "Compile with strict validation, shellcheck, and model checks; Docker-based scanners are opt-in; disable compiler-managed GitHub mutations, stage safe outputs, and record dry_run in aw_info.json; custom scripts and external MCP effects remain unverified; does not upload or dispatch workflows")

Use local compilation and bounded component reproduction as the first debugging steps. `gh aw compile --dry-run` enables strict source validation, staging, shellcheck, and model checks, rejecting bypass options and explicitly disabled required flags. Docker-based scanners and required image validation remain opt-in so Docker unavailability does not block the gate; native shellcheck is required without Docker. When Docker is available, recommend `gh aw validate WORKFLOW` for source checks and `gh aw compile WORKFLOW --dry-run --zizmor --actionlint --poutine` for scanner checks. `validate` uses `--no-emit` and skips these scanners; its success does not establish scanner coverage. Run the scanners when possible. MCP callers opt into required image validation with `validate_images: true`. Unavailable optional checks remain unverified. Warnings and requested scanner failures become failures; workflow-local diagnostics remain attached to their workflow, while batch diagnostics are reported separately. Dry-run disables compiler-managed GitHub mutations, including push jobs, memory/cache persistence, reusable safe-output calls, work-queue operations, reactions, comments/issues, label removal, and issue locking. `aw_info.json` records `dry_run`. Diagnostic handlers, summaries, and run artifacts remain enabled. No memory-tool staging fields are added. Custom scripts/jobs, agent shell commands, external MCP servers, and custom credentials remain explicitly unverified rather than being rejected.

- One flag (`--dry-run`) requests the required development check set without dispatch or a Docker dependency. Additional Docker-based checks are opt-in. Local diagnostics do not replace hosted CI or runtime verification.

**`--dry-run` flag:** Compile with strict source validation, staged safe outputs, shellcheck, model checks, and warnings as errors. Docker-based image validation and scanners are opt-in. Without Docker, required run-step linting uses native shellcheck. Missing required checks or model inventory block compilation. Compiler-managed GitHub mutations are disabled, including push jobs, memory/cache persistence, work-queue operations, reusable safe-output calls, reactions, comments/issues, label removal, and issue locking. The runtime records `dry_run` in `aw_info.json` and warns that custom scripts/jobs, agent shell commands, external MCP servers, and custom credentials remain unverified. Explicitly disabling a required check is rejected; `--no-emit`, `--watch`, `--approve`, and `--allow-action-refs` are incompatible. This flag does not upload or execute workflows and is distinct from `--action-mode dev`. The compile MCP input is `dry_run`; `validate_images: true` opts into required image validation. See [Development Testing Mode](/gh-aw/reference/compilation-process/#development-testing-mode).

"strict", "staged", "validate", "shellcheck", "models",