[aw-doctor:compiler-security] Compiler security scan: 152 actionlint errors across generated lock files

Compiling all 43 workflow sources in `githubnext/gh-aw-cao` succeeded, but strict-mode actionlint validation of the generated lock files failed with 152 errors, so the compiler run exited non-zero (exit code 1). No container, license, or later-stage security scanners ran because actionlint failed first in the pipeline.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `43`
- **Generated lock files checked**: `43`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | 33 lock files (e.g. `aw-doctor.lock.yml:1187`, `aw-failures-investigator.lock.yml:1275`, `dependabot.lock.yml:1161`, `eu-cra-compliance*.lock.yml`, `uk-ai-advisory*.lock.yml`, `software-development-practices*.lock.yml`) | unknown (actionlint hard error in strict mode) | `github.aw.import-inputs.role` referenced in `if:` expressions, but `github.aw` is not a valid property of the GitHub context schema actionlint checks against | Source the imported-workflow role from a step output or `env` variable instead of a synthetic `github.aw.*` context path, or update the shared control import template that injects this `if:` condition |
| actionlint (expression) | 11 lock files (`aw-doctor.lock.yml:478`, `aw-failures-investigator.lock.yml:551,556`, `aw-maintenance-upgrade.lock.yml:540,545`, `uk-ai-advisory-operational-resilience.lock.yml:529`, others) | unknown | `steps.github-mcp-app-token.outputs.token` referenced, but no step with id `github-mcp-app-token` exists in that job — the step producing the app token was likely renamed or removed from the shared control template | Fix the step id / output reference in `.github/workflows/shared/control.md` (or wherever the GitHub App token step is defined) so `github-token:`/`GH_TOKEN:` lines resolve to the actual step id |
| actionlint (expression) | 33 lock files, ~5 properties each (`max_repos`, `rollout_percent`, `central_repo`, `control_plane_run_url`, `correlation_id`) not defined on `github.event.inputs` | unknown | `workflow_dispatch.inputs` schema in these workflow `.md` sources doesn't declare all five orchestrator/worker envelope inputs consistently, so `github.event.inputs.` is flagged as an unknown property in several lock files | Ensure every workflow that reads `github.event.inputs.max_repos`, `.rollout_percent`, `.central_repo`, `.control_plane_run_url`, `.correlation_id` also declares matching `workflow_dispatch.inputs:` entries (or the shared orchestrator input template is applied uniformly) |
| actionlint (expression) | 1 lock file | unknown | `steps.safe-outputs-app-token.outputs.token` referenced but step not defined in that job | Same class of fix as the `github-mcp-app-token` issue above — correct the step id reference |
| actionlint (shellcheck SC2129, style) | 33 lock files | style/low | Multiple individual `>>` redirects to the same file instead of a single grouped `{ ...; } >> file` redirect | Low priority; can be fixed by refactoring the generated shell block source (likely a shared script snippet) to use a single redirect group |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Specifically:
- Resolve all `github.aw.import-inputs.role` actionlint errors (33 occurrences) by sourcing the role check through a supported mechanism instead of an undefined `github.aw` context property.
- Resolve all `steps.github-mcp-app-token`/`steps.safe-outputs-app-token` output reference errors (12 occurrences) by correcting the referencing step id to match the actual token-issuing step id in the shared control workflow.
- Resolve all `github.event.inputs.{max_repos,rollout_percent,central_repo,control_plane_run_url,correlation_id}` undefined-property errors (26/26/7/7/7 occurrences) by declaring matching `workflow_dispatch.inputs` consistently across affected workflow sources.
- Optionally address the 33 shellcheck SC2129 style findings by consolidating shell redirects.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 43
Compiled locks: 43
```

Finding counts by actionlint rule (152 total errors):
```
33 [expression] property "aw" is not defined
26 [expression] property "max_repos" is not defined
26 [expression] property "rollout_percent" is not defined
11 [expression] property "github-mcp-app-token" is not defined
7 [expression] property "central_repo" is not defined
7 [expression] property "control_plane_run_url" is not defined
7 [expression] property "correlation_id" is not defined
1 [expression] property "safe-outputs-app-token" is not defined
33 [shellcheck] SC2129 style: prefer grouped redirect over individual redirects
```

Final compiler message: `✗ actionlint failed — strict mode: actionlint found 152 errors in workflows`.

No non-actionlint scanner output (container image, license, or vulnerability findings) is present in the evidence, because the strict-mode actionlint gate failed before those checks executed.

Control plane context

- Correlation ID: `33966987991-19`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33966987991`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33967202685) · copilot · auto · 36.9 AIC · ⌖ 10.8 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 19, 2026, 12:57 PM UTC

Start with the affected .github/workflows/*.md sources and .github/workflows/shared/control.md, then run the gh-aw compiler with strict validation to reproduce the actionlint findings. Trace the shared templates and token step references rather than editing generated .lock.yml files. Done means the sources compile and the full listed security and quality scan passes cleanly.

Written by the indexing model from the issue text.