[aw-doctor:compiler-security] Compiler security scan: 152 actionlint errors across 32 workflow lock files (strict mode failure)

gh-aw compiled all 43 workflow sources into 43 lock files for `githubnext/gh-aw-cao`, but strict-mode actionlint validation failed with exit code 1: **152 errors** (118 `expression`, 34 `shellcheck`) spread across **32** generated `.lock.yml` files. No vulnerable container images, license findings, or additional scanner categories were reported. The errors reduce to 4 recurring root causes (undefined expression properties in 3 shapes, plus one recurring shellcheck style warning), all deduplicated below. Highest-severity/most numerous: `github.aw.import-inputs.role` property-not-defined (33 occurrences). Recommended next action: assign to Copilot to fix the underlying `.md` workflow sources and recompile until clean.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `43`
- **Generated lock files checked**: `43`
- **Result**: `findings`

| Tool | Workflow(s) affected | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | 22 lock files incl. `aw-doctor`, `aw-failures-investigator`, `uk-ai-advisory*` | unknown (strict-mode error) | `steps.github-mcp-app-token.outputs.token` referenced but `github-mcp-app-token` step id not defined in the step outputs object at that point in the job (22 occurrences) | Ensure the `github-mcp-app-token` step is declared (with that id) earlier in the same job before it is referenced, or fix the generating template so the id matches an actual step |
| actionlint (expression) | 33 lock files incl. `aw-doctor`, `aw-failures-investigator`, `software-development-practices*`, `uk-ai-advisory*` | unknown (strict-mode error) | `github.aw.import-inputs.role` used in an `if:` condition, but `aw` is not a defined property of the `github` context (33 occurrences) | Replace `github.aw.import-inputs.role` with a supported context path (e.g. an `env.` or `inputs.` reference set explicitly in the workflow), or update shared control template to stop relying on a non-existent `github.aw` namespace |
| actionlint (expression) | 26 lock files (orchestrator dispatch workflows) | unknown (strict-mode error) | `github.event.inputs.max_repos` / `.rollout_percent` referenced but not declared in the `workflow_dispatch.inputs` schema for the object type used at that step (26 occurrences each) | Add `max_repos` and `rollout_percent` to the `workflow_dispatch: inputs:` block of the affected `.md` sources, or remove the references if unused |
| actionlint (expression) | 7 lock files (worker dispatch env blocks) | unknown (strict-mode error) | `github.event.inputs.central_repo`, `.control_plane_run_url`, `.correlation_id` referenced but not declared in the same `workflow_dispatch.inputs` object type (7 occurrences each) | Add these three input names to the relevant `workflow_dispatch: inputs:` declaration, matching the standard control-envelope contract used elsewhere |
| actionlint (shellcheck SC2129) | 32 lock files, one `run:` block per file (style) | unknown (strict-mode error, shellcheck style) | Multiple individual `>>` redirects in a shell script; shellcheck recommends `{ cmd1; cmd2; } >> file` grouping | Update the shared shell script template to group sequential appends into a single `{ ...; } >> file` redirect |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Findings to address, all from actionlint strict mode (152 total errors, 32 affected lock files):
1. `steps.github-mcp-app-token.outputs.token` referenced where that step id is not defined at that point in the job (22 occurrences).
2. `github.aw.import-inputs.role` used in `if:` conditions but `github.aw` is not a valid context property (33 occurrences) — likely needs to come from shared control template `.github/workflows/shared/control.md`.
3. `github.event.inputs.max_repos` and `.rollout_percent` referenced but missing from `workflow_dispatch.inputs` (26 occurrences each).
4. `github.event.inputs.central_repo`, `.control_plane_run_url`, `.correlation_id` referenced but missing from `workflow_dispatch.inputs` (7 occurrences each).
5. Shellcheck SC2129 style warning: replace repeated `>>` redirects with a single grouped `{ ...; } >> file` block (32 occurrences, one per lock file, likely from one shared script template).

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 43
Compiled locks: 43
```

Result metadata:
```json
{
"targetRepo": "githubnext/gh-aw-cao",
"targetSha": "6487acbb1b981f5177f6c81f083fe381ce0afec6",
"exitCode": 1,
"scanComplete": true,
"clean": false,
"reportDigest": "07f04787964cdd915daec8083e1e60956269e11dd49019ba1f401a05642357dd"
}
```

Sample actionlint output (representative errors; full report is 106KB and available in the workflow run's compiler-security artifact):

```
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {set-runtime-paths: ...; setup: ...}
github-token: ${{ steps.github-mcp-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/aw-doctor.lock.yml:1187:29: error: [expression] property "aw" is not defined in object type {action: string; ...}
if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}

.github/workflows/aw-doctor.lock.yml:1505:9: error: [shellcheck] SC2129:style:7:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects

.github/workflows/aw-doctor.lock.yml:1628:39: error: [expression] property "central_repo" is not defined in object type {aw_context: string; max_repos: string; rollout_percent: string; safe_output_mode: string; safe_output_repo: string; target_repo: string}
CAO_CENTRAL_REPOSITORY: ${{ github.event.inputs.central_repo || '' }}

Final: actionlint found 152 errors in workflows - workflows must have no actionlint errors in strict mode
```

No secret/token-like values observed in the tool output; none redacted beyond this note.

Control plane context

- Correlation ID: `34049641775-386`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34049641775`

(/body)

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34049641775) · copilot · auto · 29.6 AIC · ⌖ 7.54 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 20, 2026, 5:51 PM UTC

Read .github/workflows/shared/control.md and the affected .github/workflows/*.md sources; do not edit generated .lock.yml files. First run the compiler/security scan or inspect its artifact, then trace the recurring findings to shared templates and workflow_dispatch declarations. Done means recompilation passes strict actionlint and the listed checks are clean.

Written by the indexing model from the issue text.