[aw-doctor:compiler-security] Compiler security scan: 152 actionlint errors block strict-mode compilation (githubnext/gh-aw-cao)

Compiling `githubnext/gh-aw-cao` in strict mode failed (exit code 1). actionlint found 152 errors across 33 of 43 generated lock files — all `[expression]` (118) and `[shellcheck]` (34) findings; no crash, container, license, or vulnerability-scanner findings were produced because the report shows only actionlint ran (no zizmor/poutine/grype/syft/grant/runner-guard output present). Highest-impact pattern: 33 files reference `github.aw.*` context fields actionlint doesn't recognize as typed, and orchestrator/worker dispatch envelopes reference untyped `inputs.*` fields (`rollout_percent`, `max_repos`, `correlation_id`, `central_repo`, `control_plane_run_url`) in 7–26 files each. A config warning also flags `push-to-pull-request-branch: target: "*"` with no `required-title-prefix`/`required-labels` restriction.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `43`
- **Generated lock files checked**: `43`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | 33 lock files (e.g. aw-doctor, uk-ai-advisory, optimization-*, self-care-*) | unknown (actionlint error) | `property "aw" is not defined` — `github.aw.*` context access not recognized by actionlint's type model | Review whether `github.aw.import-inputs.*` usage needs an actionlint-compatible workaround (e.g. `env:` indirection or documented suppression) in the shared control/import templates |
| actionlint | 26 lock files | unknown | `property "rollout_percent"`/`"max_repos"` not defined on `github.event.inputs` object type for dispatched worker workflows | Ensure worker workflow `workflow_dispatch.inputs` declares these fields, or adjust the shared dispatch template that emits `CAO_*` env vars |
| actionlint | 11 lock files (e.g. aw-doctor.lock.yml) | unknown | `property "github-mcp-app-token"` not defined on prior step outputs object | Fix step ID reference / declare the step output in the source `.md` before referencing `steps.github-mcp-app-token.outputs.token` |
| actionlint | 7 lock files | unknown | `property "correlation_id"`/`"control_plane_run_url"`/`"central_repo"` not defined on `github.event.inputs` | Same root cause as rollout_percent/max_repos — add missing input declarations to worker dispatch inputs schema |
| actionlint | 1 lock file | unknown | `property "safe-outputs-app-token"` not defined | Same class of missing output declaration |
| actionlint (shellcheck SC2129) | 34 lock files | style | Multiple individual `>>` redirects to the same file instead of a single `{ ... } >> file` block | Low-risk style fix in generated shell steps; verify generating source template, not hand-edit lock files |
| gh-aw guard policy | pr-reviewer.md (config warning, not actionlint) | unknown | `push-to-pull-request-branch: target: "*"` has no `required-title-prefix`/`required-labels`, allowing pushes to any PR branch | Add `required-title-prefix` or `required-labels` scoping to this workflow's `push-to-pull-request-branch` config |

Note: the deterministic evidence only shows actionlint (with shellcheck/pyflakes) execution; there is no output from zizmor, poutine, runner-guard, grant, grype, or syft in `report.txt`, so container, SBOM, and vulnerability findings cannot be reported for this run — treat that coverage as not exercised rather than clean.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 43 files
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {set-runtime-paths: {...}; setup: {...}}
478 | github-token: ${{ steps.github-mcp-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/uk-ai-advisory.lock.yml:1083:29: error: [expression] property "aw" is not defined in object type {...}
1083 | if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}

.github/workflows/uk-ai-advisory.lock.yml:1401:9: error: [shellcheck] SC2129:style: Consider using { cmd1; cmd2; } >> file instead of individual redirects

.github/workflows/uk-ai-advisory.lock.yml:1544:39: error: [expression] property "central_repo" is not defined in object type {aw_context: string; max_repos: string; rollout_percent: string; safe_output_mode: string; safe_output_repo: string; target_repo: string}
1544 | CAO_CENTRAL_REPOSITORY: ${{ github.event.inputs.central_repo || '' }}

.github/workflows/uk-ai-advisory.lock.yml:1546:35: error: [expression] property "correlation_id" is not defined ...
1546 | CAO_CORRELATION_ID: ${{ github.event.inputs.correlation_id || '' }}

✗ actionlint failed
strict mode: actionlint found 152 errors in workflows - workflows must have no actionlint errors in strict mode
```

Diff stat: none (compile is dry-run; no files were modified). Git status: clean.

Finding tally: `[expression]` 118, `[shellcheck]` 34 = 152 total across 33/43 lock files.

Control plane context

- Correlation ID: `33996691342-29`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33996691342

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33996852267) · copilot · auto · 31.4 AIC · ⌖ 9.19 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 19, 2026, 10:51 PM UTC

Start with the .github/workflows/*.md sources, especially the shared control/import templates, worker dispatch inputs, and pr-reviewer.md; do not edit generated .lock.yml files. Run the gh-aw MCP server's fix and compile tools with strict validation, then rerun the full compiler and security scan. Done means the generated workflows pass the requested checks with no actionlint or shellcheck findings while preserving existing behavior.

Written by the indexing model from the issue text.