[aw-doctor:compiler-security] Strict-mode actionlint fails with 156 errors across 34 generated lock files (compiler/template defect)

Compiling all 44 workflow sources in `githubnext/gh-aw-cao` with strict-mode `gh aw compile` fails actionlint validation with exit code 1: **156 actionlint errors across 34 generated lock files** (121 `[expression]` type errors + 35 `[shellcheck] SC2129` style findings). No container/vulnerability scanners (zizmor, poutine, runner-guard, grype, syft, grant) ran because actionlint failed first, so their status is unknown/incomplete. All findings trace to shared/generated template expressions (`github.aw.*`, `github-mcp-app-token` step output, and dispatch-envelope `event.inputs.*` fields), not per-workflow authoring mistakes — this looks like a compiler/codegen defect.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44` (34 with findings)
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|--------------|
| actionlint | 34 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `uk-ai-advisory*.lock.yml`, ...) | error | `property "aw" is not defined` — `if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}` uses undeclared `github.aw` context (34 occurrences) | Declare/type the `github.aw` custom context in the compiler's expression schema, or rewrite the generated condition to reference a declared input/output instead of `github.aw.*` |
| actionlint | multiple lock files | error | `property "github-mcp-app-token" is not defined` — `steps.github-mcp-app-token.outputs.token` referenced where that step id isn't in the referencing job's step graph (11 occurrences) | Ensure the `github-mcp-app-token` step is emitted in the same job before it's referenced, or guard/rename the generated step id so the type-checker sees it |
| actionlint | dispatch/orchestrator lock files | error | `property "max_repos"`/`"rollout_percent"`/`"central_repo"`/`"control_plane_run_url"`/`"correlation_id"` not defined on `github.event.inputs` object type (27+27+7+7+7 = 75 occurrences) | Add these dispatch-envelope fields to the generated `workflow_dispatch.inputs` schema for every workflow that reads them via `github.event.inputs.*`, so the object type includes them |
| actionlint | 1 lock file | error | `property "safe-outputs-app-token"` is not defined (1 occurrence) | Same class as `github-mcp-app-token` above — fix step id/output reference |
| shellcheck (via actionlint) | 34 lock files | style (SC2129) | `Consider using { cmd1; cmd2; } >> file instead of individual redirects` (35 occurrences) | In the compiler's generated bash script template, batch consecutive `>> file` redirects into a single `{ ...; } >> file` group |
| zizmor / poutine / runner-guard / grype / syft / grant | n/a | unknown | Not run — actionlint failure halted the pipeline before scanner stages | Rerun full scan after actionlint errors are fixed; do not assume these are clean |

Highest-reported severity: `error` (actionlint, strict-mode blocking). No scanner-reported findings available (pipeline halted early).

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

`gh aw compile` summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 44
Compiled locks: 44
```

Final actionlint verdict (from `report.txt`):
```
✗ actionlint failed
strict mode: actionlint found 156 errors in workflows - workflows must have no actionlint errors in strict mode
```

Sample error entries (representative, full list is 156 lines in the deterministic evidence artifact):
```
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {...}
.github/workflows/aw-doctor.lock.yml:1187:29: error: [expression] property "aw" is not defined in object type {...}
.github/workflows/aw-doctor.lock.yml:1505:9: error: [shellcheck] shellcheck reported issue in this script: SC2129:style:7:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects
.github/workflows/aw-doctor.lock.yml:1628:39: error: [expression] property "central_repo" is not defined in object type {...}
.github/workflows/aw-doctor.lock.yml:1629:42: error: [expression] property "control_plane_run_url" is not defined in object type {...}
.github/workflows/aw-doctor.lock.yml:1630:35: error: [expression] property "correlation_id" is not defined in object type {...}
```
No secret-like or token-like values were present in the captured output.

Also noted (informational, non-blocking): guard policy dry-run reports for `design-decision-gate.md`, `pr-reviewer.md`, etc. (allowed-repos: all, min-integrity: approved), and one advisory: `push-to-pull-request-branch: target: "*"` in `pr-sous-chef.md` allows pushing to any PR branch with no additional constraints — consider `required-title-prefix:`/`required-labels:`.

Control plane context

- Correlation ID: `34077550410-57`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34077550410`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34077757270) · copilot · auto · 36.3 AIC · ⌖ 8.37 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 2:59 AM UTC

The issue names `.github/workflows/*.md` sources and generated `.lock.yml` files; start by running `gh aw compile` in strict mode and inspect the source templates behind the reported actionlint and shellcheck findings. Use the gh-aw MCP server's `fix` and `compile` tools without editing generated locks. Done means all 44 workflows compile and the listed validation and security scans pass.

Written by the indexing model from the issue text.