[aw-maintenance:compiler-security] gh-aw compiler strict-mode validation failing across 31 generated lock files (144 actionlint errors)

**githubnext/gh-aw-cao**: `gh aw compile` (strict mode) exits with code 1 across all 38 workflow sources. Actionlint reports 144 errors in 31 generated `.lock.yml` files, so the compile/scan pipeline halts before zizmor, poutine, runner-guard, grant, grype, or syft run. No container/license/security-scanner findings are available this run because the pipeline never reached those stages.

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `38`
- **Generated lock files checked**: `38`
- **Result**: `findings`

### Findings

| Tool | Workflow (lock file) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | 31 files (e.g. `ambient-context-agents-md-curator.lock.yml`, `ambient-context.lock.yml`, `aw-failures-investigator.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `software-development-practices.lock.yml`, `uk-ai-advisory*.lock.yml`) | unknown | 31 occurrences: `${{ steps.github-mcp-app-token.outputs.token }}` references an undefined step output `github-mcp-app-token` in the generated job context | Regenerate the token/auth step in the `.md` source (shared control import) so the referenced step id exists, then recompile |
| actionlint | 31 files | unknown | 31 occurrences: `${{ github.aw.import-inputs.role == 'orchestrator' }}` references undefined `github.aw` property | Fix the generated `if:` expression source (control-role gating) to use a defined context path instead of `github.aw.*` |
| actionlint | 23 files | unknown | `${{ github.event.inputs.max_repos }}` — `max_repos` not defined on `workflow_dispatch.inputs` for these workflows | Add `max_repos` to the `on.workflow_dispatch.inputs` schema in source, or remove the reference if not applicable to that workflow |
| actionlint | 23 files | unknown | `${{ github.event.inputs.rollout_percent }}` — `rollout_percent` not defined on `workflow_dispatch.inputs` | Add `rollout_percent` to `on.workflow_dispatch.inputs`, or remove the reference |
| actionlint | 8 files (e.g. `ambient-context.lock.yml`, `uk-ai-advisory.lock.yml`, `software-development-practices.lock.yml`) | unknown | `${{ github.event.inputs.central_repo }}`, `.control_plane_run_url`, `.correlation_id` — undefined inputs | Add `central_repo`, `control_plane_run_url`, `correlation_id` to `on.workflow_dispatch.inputs` for these worker-dispatch workflows |
| actionlint (shellcheck SC2129) | 32 occurrences across files | style | Consider using `{ cmd1; cmd2; } >> file` instead of individual `>>` redirects in a `run:` step | Rewrite the affected shell block to group redirects, or accept the style ruling if intentional |

Root cause pattern: the dispatch-envelope inputs (`max_repos`, `rollout_percent`, `central_repo`, `control_plane_run_url`, `correlation_id`) and the `github.aw.import-inputs`/`github-mcp-app-token` step reference are emitted by shared control/import compilation logic but are inconsistently declared per workflow, producing type errors under actionlint strict mode. This affects the compiler's own generated code, not hand-written workflow logic, so the fix is likely in the shared import/control template rather than each individual `.md` file.

### Local fixing loop

1. Install or update the gh-aw extension, then configure the coding agent's MCP client to launch `gh aw mcp-server` over stdio from the target repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files.
3. Require the agent to repeat the same full compiler validation and security scan until it passes, or stop and explain any finding that needs human action.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files (including `.github/workflows/shared/control.md` and its shared import dependencies, since the actionlint errors point to generated code coming from shared import logic); never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw compiler summary

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 38
Compiled locks: 38
strict mode: actionlint found 144 errors in workflows - workflows must have no actionlint errors in strict mode
```

Error breakdown by category (raw counts)

```
31 property "aw" is not defined (github.aw.import-inputs.role)
23 property "rollout_percent" is not defined
23 property "max_repos" is not defined
11 property "github-mcp-app-token" is not defined (step output)
8 property "correlation_id" is not defined
8 property "control_plane_run_url" is not defined
8 property "central_repo" is not defined
32 shellcheck SC2129 style findings (redirect grouping)
```

### Control Plane
- Correlation ID: `33830801885-36`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33830801885

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33830801885) · copilot · auto · 31.3 AIC · ⌖ 9.61 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 18, 2026, 2:53 AM UTC

Read .github/workflows/shared/control.md and its shared import dependencies, then run gh aw compile in strict mode for the 38 workflow sources. Trace the undefined inputs, github.aw expression, and github-mcp-app-token output back to shared control/import logic rather than editing generated .lock.yml files. Done means strict compilation has no actionlint or shellcheck findings and the listed security scans can run.

Written by the indexing model from the issue text.