[aw-maintenance:compiler-security] gh-aw compile strict-mode actionlint failures (144 errors, 30 workflows)

**Target repository**: `githubnext/gh-aw-cao`
**Compiler exit code**: `1`
**Workflow sources checked**: `38`
**Generated lock files checked**: `38`
**Result**: `findings`

`gh aw compile --strict` (actionlint 1.7.12, with shellcheck/pyflakes) found 144 errors across 30 generated `.lock.yml` files, blocking strict-mode compilation. No other scanner stage (container/vuln/license/security tools such as zizmor, poutine, runner-guard, grant, grype, syft) ran, because the pipeline stopped at the actionlint stage. Highest-severity supported finding: actionlint hard error (blocks build); shellcheck findings are style-level (SC2129). No CWE/CVE-graded severities were produced by any tool in this run.

### Findings

| Tool | Workflow(s) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | `uk-ai-advisory.lock.yml` and 7 others (8 files) | error | `property "correlation_id"/"control_plane_run_url"/"central_repo" is not defined` on `github.event.inputs.*` — dispatch envelope fields referenced in `env:` blocks aren't declared in the workflow's `workflow_dispatch.inputs` | Add these inputs to the `workflow_dispatch` trigger's `inputs:` schema (or the shared control import that defines it) in the corresponding `.md` source, then recompile |
| actionlint (expression) | orchestrator workflows, 23 files each for `rollout_percent`/`max_repos` | error | `property "rollout_percent" is not defined` / `property "max_repos" is not defined` on the dispatch input object | Same as above — declare `rollout_percent` and `max_repos` in the dispatch `workflow_dispatch.inputs` schema used by these orchestrators |
| actionlint (expression) | `ambient-context-agents-md-curator.lock.yml` and 10 others | error | `property "github-mcp-app-token" is not defined` — `steps.github-mcp-app-token.outputs.token` referenced but no step with that `id` exists in the same job | Ensure the GitHub MCP app-token step is emitted with `id: github-mcp-app-token` in that job, or fix the step reference in the shared control/workflow source |
| actionlint (expression) | multiple orchestrator workflows, 31 occurrences | error | `property "aw" is not defined` on `github.aw.import-inputs.role` — `github.aw` context property doesn't exist in actionlint's type model for `if:` conditions | Replace `github.aw.import-inputs.role` with a supported context path (e.g. an `env`/`steps.outputs` value set earlier in the job) in the workflow source, then recompile |
| shellcheck (via actionlint) | 30 files, 32 occurrences | style (SC2129) | `Consider using { cmd1; cmd2; } >> file instead of individual redirects` | Low priority; group consecutive `>> "$GITHUB_OUTPUT"`/summary redirects into a single `{ ...; } >> file` block in the shared shell snippet generating these steps |

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler summary

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 38
Compiled locks: 38
```

`git-status.txt` and `diff-stat.txt` were empty (no working-tree changes produced by the compile-only run).

Per-tool detail: actionlint error-property breakdown

```
31 property "aw" is not defined
23 property "rollout_percent" is not defined
23 property "max_repos" is not defined
11 property "github-mcp-app-token" is not defined
8 property "correlation_id" is not defined
8 property "control_plane_run_url" is not defined
8 property "central_repo" is not defined
32 SC2129 (shellcheck style)
```

Files with errors (30 total): `ambient-context-agents-md-curator`, `ambient-context-skills-curator`, `ambient-context`, `aw-failures-investigator`, `aw-maintenance-compiler-security`, `aw-maintenance-upgrade`, `aw-maintenance`, `dependabot-release-train-updater`, `dependabot`, `eu-cra-compliance-article-14-reporting-readiness`, `eu-cra-compliance-conformity-release-evidence`, `eu-cra-compliance-scope-classifier`, `eu-cra-compliance-security-requirements-auditor`, `eu-cra-compliance-supply-chain-sbom-auditor`, `eu-cra-compliance-vulnerability-handling-auditor`, `eu-cra-compliance`, `optimization-ai-credit-auditor`, `optimization-ai-credit-optimizer`, `optimization`, `self-care-accessibility-checker`, `self-care-code-improvement`, `self-care-dashboard-review`, `self-care-data-acquisition-audit`, `self-care-docs-build-time-investigator`, `self-care-primer-brand-checker`, `self-care`, `software-development-practices-github-well-architected`, `software-development-practices-nist-ssdf`, `software-development-practices`, `uk-ai-advisory-operational-resilience`, `uk-ai-advisory` (each with `.lock.yml` suffix).

No container/vulnerability/license/security-scanner stage (zizmor, poutine, runner-guard, grant, grype, syft) executed in this run — the pipeline halted after actionlint reported strict-mode errors.

### Control Plane
- Correlation ID: `33826939975-32`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33826939975`

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33827286417) · copilot · auto · 21.4 AIC · ⌖ 7.65 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 1:58 AM UTC

Start with the affected `.github/workflows/*.md` sources rather than the generated `.lock.yml` files, and review the listed actionlint properties and missing step reference. Configure the gh-aw MCP server, then use its `fix` and `compile` tools with strict validation to check the sources. Done means the workflows compile cleanly and the full requested validation scan passes, or remaining findings are documented as requiring human action.

Written by the indexing model from the issue text.