[aw-doctor:compiler-security] Compiler Security: actionlint strict-mode failures (156 errors, 34 workflows) in githubnext/gh-aw-cao

gh-aw compiled all 44 workflow sources into 44 lock files for `githubnext/gh-aw-cao`, but the compiler's strict-mode actionlint pass failed (compiler exit code 1) with 156 errors across 34 generated lock files. No vulnerable container images, license findings, or other scanner categories were reported — actionlint was the only tool invoked in this run's evidence. Highest-severity category: actionlint strict-mode `[expression]` type errors (unrecognized context properties) plus one recurring `[shellcheck]` SC2129 style issue, both blocking strict-mode compilation.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|------|-------------|----------|---------|-------------|
| actionlint | 34 lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `self-care*`, `uk-ai-advisory*`, `software-development-practices*`) | unknown (actionlint error, strict-mode blocking) | `property "aw" is not defined` — expressions reference `github.aw.import-inputs.role` which actionlint's static GitHub-context schema does not recognize (34 occurrences) | Regenerate source `.md` workflows using the compiler's supported context-access pattern for import inputs, or add an actionlint context extension if gh-aw supports one, then recompile |
| actionlint | Orchestrator-role workflows (multiple) | unknown | `property "rollout_percent"`/`"max_repos"` not defined on `github.event.inputs` object type (27 each) | Ensure `workflow_dispatch.inputs` in the `.md` frontmatter declares these input names so actionlint's inferred type includes them |
| actionlint | Same orchestrator-role workflows | unknown | `property "correlation_id"`, `"control_plane_run_url"`, `"central_repo"` not defined on `github.event.inputs` (7 each) | Same as above — declare these dispatch inputs in workflow frontmatter |
| actionlint | 11 workflows (e.g. `aw-doctor`, `aw-failures-investigator`, `uk-ai-advisory-operational-resilience`) | unknown | `property "github-mcp-app-token"` not defined on prior step outputs — step ID reference not recognized by actionlint | Verify the step ID `github-mcp-app-token` is emitted with matching `id:` in the same job before this reference, or fix a step-ID typo in the shared control source |
| actionlint | 1 workflow | unknown | `property "safe-outputs-app-token"` not defined | Same class of step-output reference fix as above |
| actionlint / shellcheck | 34 lock files (`.lock.yml:~1505` region) | style (unknown severity, blocks strict mode) | SC2129: repeated individual `>>` redirects instead of a single `{ ... ; } >> file` block | Fix the shared shell script template (likely in `.github/workflows/shared/control.md` or similar included source) to group redirects |

All findings originate from the shared `control.md` import used by every workflow, so a small number of source fixes should resolve the majority of the 156 reported errors across all 34 affected lock files.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Command exit code: `1`. Total error count reported by actionlint: `156` across `34` of `44` compiled lock files. Representative excerpt (line numbers refer to specific generated `.lock.yml` files, not source):

```
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {...}
478 | github-token: ${{ steps.github-mcp-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/aw-doctor.lock.yml:1187:29: error: [expression] property "aw" is not defined in object type {...}
1187 | if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}

.github/workflows/aw-doctor.lock.yml:1505:9: error: [shellcheck] shellcheck reported issue: SC2129:style:7:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects

.github/workflows/aw-doctor.lock.yml:1628:39: error: [expression] property "central_repo" is not defined in object type {...}
1628 | CAO_CENTRAL_REPOSITORY: ${{ github.event.inputs.central_repo || '' }}

✗ actionlint failed
strict mode: actionlint found 156 errors in workflows - workflows must have no actionlint errors in strict mode
```

No zizmor, poutine, runner-guard, grant, grype, or syft output was present in the captured report — only actionlint ran against the 44 compiled lock files in this pass. Guard policy dry-run diagnostics (informational `i` lines for `design-decision-gate.md`, `pr-reviewer.md`, and others) were reviewed and contain no actionable findings beyond one existing informational note about `push-to-pull-request-branch: target: "*"` lacking `required-title-prefix`/`required-labels` constraints, which is advisory (not a strict-mode blocker) and unchanged from prior runs.

No token-like or credential-like values were present in the captured output.

Control plane context

- Correlation ID: `34087977111-60`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34087977111`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34088239800) · copilot · auto · 33.4 AIC · ⌖ 9.5 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 5:54 AM UTC

Start with the affected .github/workflows/*.md sources, especially the shared control.md import, and use the gh-aw MCP server's fix and compile tools rather than editing generated .lock.yml files. Check the workflow frontmatter, step IDs, and shared shell template against the reported actionlint and SC2129 findings. Done means strict compilation and the requested security scan pass cleanly.

Written by the indexing model from the issue text.