[aw-doctor:compiler-security] Compiler security scan: 156 actionlint errors block strict-mode compilation

Target `githubnext/gh-aw-cao` failed compiler validation: actionlint (strict mode) found **156 errors** across 44 compiled workflow lock files — 121 `[expression]` type errors and 35 `[shellcheck]` SC2129 style errors. No compiler crash; exit code 1 is from `actionlint failed`. No container/image scanners (grype/syft/grant), zizmor, poutine, or runner-guard output appears in the evidence — only actionlint (with shellcheck) ran.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | 34 lock files (e.g. `uk-ai-advisory.lock.yml`, `aw-doctor.lock.yml`, `self-care*.lock.yml`) | error | `property "aw" is not defined` — `if: ${{ always() && github.aw.import-inputs.role == '...' }}` references `github.aw`, which actionlint's static GitHub-context type does not model. | Rework the shared control logic (`.github/workflows/shared/control.md`) to avoid depending on `github.aw.import-inputs.*` directly in `if:`/expression contexts that actionlint type-checks, or use a form actionlint recognizes (e.g. read via `env`/step output rather than `github.aw`). |
| actionlint (expression) | Same 34+ lock files | error | `property "max_repos"`/`"rollout_percent"`/`"correlation_id"`/`"control_plane_run_url"`/`"central_repo"` not defined on `github.event.inputs` object — the compiled `workflow_dispatch.inputs` schema for these workers lacks these fields even though `github.event.inputs.` is referenced. | Ensure every workflow importing the worker/control-plane envelope declares all consumed `workflow_dispatch.inputs` (`max_repos`, `rollout_percent`, `correlation_id`, `control_plane_run_url`, `central_repo`, `safe_output_mode`, `safe_output_repo`, `target_repo`) consistently, likely by fixing the shared input-declaration template so it matches what `control.md` emits. |
| actionlint (expression) | 11 lock files including `aw-doctor.lock.yml`, `uk-ai-advisory-operational-resilience.lock.yml` | error | `property "github-mcp-app-token" is not defined` on step outputs object — `steps.github-mcp-app-token.outputs.token` referenced where no step with id `github-mcp-app-token` exists in that job's prior steps (or step ordering/id mismatch). | Verify the `github-mcp-app-token` step id is defined earlier in the same job for each affected workflow, or fix the generated step id in the shared MCP-token-acquisition include. |
| shellcheck (SC2129) | 35 lock files, one per workflow (e.g. `dependabot-release-train-updater.lock.yml`, `uk-ai-advisory.lock.yml`) | style | "Consider using `{ cmd1; cmd2; } >> file` instead of individual redirects" in a generated `run:` bash block. | Refactor the shared bash script template that appends multiple lines to a file with repeated `>>` redirects into a single grouped redirect block. |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 44
Compiled locks: 44
```

Tool invocation line from report:
```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 44 files
...
✗ actionlint failed
strict mode: actionlint found 156 errors in workflows - workflows must have no actionlint errors in strict mode
```

Finding-type counts (from `report.txt`, deduplicated by category):
- `error: [expression]`: 121 occurrences
- `error: [shellcheck]`: 35 occurrences (all `SC2129`)

Property-name breakdown for `[expression]` errors:
- `property "aw" is not defined`: 34
- `property "rollout_percent" is not defined`: 27
- `property "max_repos" is not defined`: 27
- `property "github-mcp-app-token" is not defined`: 11
- `property "correlation_id" is not defined`: 7
- `property "control_plane_run_url" is not defined`: 7
- `property "central_repo" is not defined`: 7
- `property "safe-outputs-app-token" is not defined`: 1

No zizmor, poutine, runner-guard, grype, syft, or grant output was present anywhere in the 833-line `report.txt`; only actionlint (with embedded shellcheck) executed in this deterministic run.

Control plane context

- Correlation ID: `34102714558-63`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34102714558`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34103210511) · copilot · auto · 36.9 AIC · ⌖ 6.98 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 9:01 AM UTC

Start with .github/workflows/shared/control.md and the shared MCP-token-acquisition and bash script templates named in the findings; inspect how they compile into the affected lock files. Run strict compilation with actionlint and shellcheck first, then the requested security scans. Done means the 44 workflows compile without the 156 reported findings and the full scan passes.

Written by the indexing model from the issue text.