[aw-doctor:compiler-security] gh-aw compiler strict-mode: 152 actionlint errors across 33 lock files

gh-aw compiler strict-mode validation failed for `githubnext/gh-aw-cao` with 152 actionlint errors across 33 of 43 compiled `.lock.yml` files (compiler exit code 1). All findings are actionlint expression/shellcheck errors — no container, license, or dedicated security-scanner (zizmor/poutine/runner-guard/grype/syft) findings appear in the captured report. Highest-impact and most common categories: undefined `github.aw.import-inputs` expression access (33 occurrences), undefined dispatch-envelope inputs (`rollout_percent`/`max_repos`/`correlation_id`/`central_repo`/`control_plane_run_url`, ~86 occurrences combined), undefined `github-mcp-app-token`/`safe-outputs-app-token` step outputs (12 occurrences), and shellcheck SC2129 style warnings (34 occurrences).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `43`
- **Generated lock files checked**: `43`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|------|-------------|----------|---------|-------------|
| actionlint | 33 lock files (e.g. aw-doctor, aw-maintenance-upgrade, aw-failures-investigator, uk-ai-advisory*, self-care*, eu-cra-compliance*, optimization*, software-development-practices*, dependabot*) | unknown | `property "aw" is not defined in object type {...}` — `github.aw.import-inputs.role` accessed in an `if:` expression on a job/step context where `github.aw` is not a recognized property (33 occurrences) | Replace the `github.aw.import-inputs.*` expression with a supported context (e.g. an explicit env/output propagated from the shared control workflow) or declare the custom property via workflow schema so actionlint recognizes it |
| actionlint | ~26 lock files (orchestrator/worker dispatch-envelope workflows) | unknown | `property "rollout_percent"` / `property "max_repos"` not defined in `github.event.inputs` object type (26 occurrences each) | Add `rollout_percent` and `max_repos` to the `workflow_dispatch.inputs` schema of the affected `.md` sources so the generated lock file's input type includes them |
| actionlint | 7 lock files | unknown | `property "correlation_id"` / `"central_repo"` / `"control_plane_run_url"` not defined in `github.event.inputs` object type (7 occurrences each) | Add these three fields to the `workflow_dispatch.inputs` schema for the affected worker `.md` sources |
| actionlint | 11 lock files | unknown | `property "github-mcp-app-token"` not defined on prior step's `outputs` object — referenced before the step is registered in the type, or the step id/output name is stale (11 occurrences) | Confirm the `github-mcp-app-token` step id and output name match the shared control template step that provides it; regenerate via `gh aw compile` |
| actionlint | 1 lock file | unknown | `property "safe-outputs-app-token"` not defined on prior step's `outputs` object (1 occurrence) | Same as above — verify step id/output naming in the safe-outputs app-token step |
| shellcheck | 34 lock files | style (SC2129) | "Consider using `{ cmd1; cmd2; } >> file` instead of individual redirects" (34 occurrences) | Update the corresponding shell heredoc/run blocks in the `.md` sources to group appended redirects, then recompile |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 43
Compiled locks: 43
```

Final compiler verdict line:
```
✗ actionlint failed
strict mode: actionlint found 152 errors in workflows - workflows must have no actionlint errors in strict mode
```

Guard/network policy lines observed (informational, not blocking):
```
⚠ push-to-pull-request-branch: target: "*" allows pushing to any PR branch with no additional constraints.
Consider adding required-title-prefix: or required-labels: to restrict which PRs can receive pushes.
```

No zizmor, poutine, runner-guard, grant, grype, or syft findings were present in the captured report output — only actionlint (including its integrated shellcheck check) reported issues.

Control plane context

- Correlation ID: `33999400199-30`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33999400199`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33999559639) · copilot · auto · 37.3 AIC · ⌖ 10.7 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 19, 2026, 11:53 PM UTC

Start with the affected .github/workflows/*.md sources rather than generated .lock.yml files, focusing on the workflow inputs, shared control templates, step outputs, and shell run blocks described in the report. Run gh aw compile with strict validation and review the generated lock-file diffs. Done means compilation and the requested actionlint, shellcheck, and security scans pass without findings.

Written by the indexing model from the issue text.