[aw-doctor:compiler-security] Compiler strict-mode validation: 156 actionlint errors across 34 workflows

Compiling all 44 gh-aw workflow sources in `githubnext/gh-aw-cao` succeeded, but actionlint strict validation failed with exit code 1: **156 errors across 34 generated `.lock.yml` files** (121 `[expression]` type errors, 35 `[shellcheck]` script findings). No vulnerable-container, license, or dedicated security-scanner findings were produced because only actionlint ran in this pass. Highest-value fix: the `github.aw.import-inputs.*` and `github.event.inputs.{max_repos,rollout_percent,central_repo,control_plane_run_url,correlation_id}` expression errors are the same root-cause pattern repeated across nearly every orchestrator/worker workflow and account for the bulk of failures.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44`
- **Result**: `findings`

| Tool | Workflow(s) / pattern | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | 34 lock files (e.g. `aw-doctor`, `optimization*`, `self-care*`, `eu-cra-compliance*`, `uk-ai-advisory*`, `software-development-practices*`, `dependabot*`) | unknown | `property "aw" is not defined` — 34 occurrences of `github.aw.import-inputs.role` used in `if:` conditions where the generated job-outputs context type has no `aw` property | Regenerate the orchestrator/worker step conditions in the `.md` sources so the import-inputs role check uses a context actually defined on the compiled job (e.g. a `needs.*.outputs` reference or a documented `env` var) instead of `github.aw.*` |
| actionlint | 27 lock files | unknown | `property "rollout_percent" is not defined` / `property "max_repos" is not defined` on `github.event.inputs.*` — dispatch input schema in workflow source is missing these `workflow_dispatch` inputs even though downstream steps read them | Add `rollout_percent` and `max_repos` to the `on.workflow_dispatch.inputs` (or dispatch-workflow tool schema) in the shared control source so the generated inputs object includes these properties |
| actionlint | 11 lock files (dispatch/worker workflows using `github-mcp-app-token`) | unknown | `property "github-mcp-app-token" is not defined` referencing a step-outputs object that doesn't declare that step | The referenced step id `github-mcp-app-token` is missing or renamed in the compiled job; verify the step exists before this reference or fix the step id/typo in the `.md` source |
| actionlint | 7 lock files | unknown | `property "central_repo"` / `"control_plane_run_url"` / `"correlation_id"` not defined on `github.event.inputs` | Add these three dispatch-envelope inputs to the `workflow_dispatch` input schema wherever workers consume them (same root cause as `max_repos`/`rollout_percent`) |
| actionlint/shellcheck | `dependabot-release-train-updater.lock.yml` | style | SC2129: "Consider using `{ cmd1; cmd2; }` >> file instead of individual redirects" (2 occurrences) | Group the consecutive redirects into a single `{ ...; } >> "$GITHUB_STEP_SUMMARY"` block in the underlying shell script |
| actionlint/shellcheck | `uk-ai-advisory.lock.yml`, `uk-ai-advisory-operational-resilience.lock.yml`, `software-development-practices.lock.yml`, `software-development-practices-nist-ssdf.lock.yml`, `software-development-practices-github-well-architected.lock.yml` (1 each) | style | SC2129 same redirect-grouping style finding | Same fix pattern as above, applied per workflow's generated script block |
| actionlint | `aw-maintenance-compiler-security.lock.yml` (this workflow) | unknown | 3 `[expression]` errors (same `aw`/dispatch-input root causes) | Fix propagates from the shared control source; no workflow-specific change needed beyond the shared fix |

No yamllint, zizmor, poutine, runner-guard, grant, grype, or syft output was present in the collected evidence — only actionlint ran in this deterministic pass, so container, license, and dedicated security-scanner coverage for this run is `not applicable`.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 44
Compiled locks: 44
```

Error breakdown by actionlint tag (from `report.txt`, 833 lines total):
```
121 [expression]
35 [shellcheck]
```

Root-cause message frequency (deduplicated):
```
34 property "aw" is not defined
27 property "rollout_percent" is not defined
27 property "max_repos" is not defined
22 mentions of "github-mcp-app-token" (11 distinct errors)
7 property "correlation_id" is not defined
7 property "control_plane_run_url" is not defined
7 property "central_repo" is not defined
35 SC2129 shellcheck style findings
1 property "safe-outputs-app-token" is not defined
```

Example error (representative):
```
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {set-runtime-paths: {conclusion: string; outcome: string; outputs: {string => string}}; setup: {conclusion: string; outcome: string; outputs: {string => string}}}
478 | github-token: ${{ steps.github-mcp-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
```

`git-status.txt` and `diff-stat.txt` were empty (no working-tree changes were made during compilation).

Control plane context

- Correlation ID: `34108015532-64`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34108015532`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34108432196) · copilot · auto · 34.5 AIC · ⌖ 8.49 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 9:58 AM UTC

Start with the shared `.github/workflows/*.md` sources named in the findings rather than editing generated `.lock.yml` files. Use the repository's `gh aw mcp-server` with its `fix` and `compile` tools, then inspect the generated lock-file diffs and rerun the requested compiler and security checks. Done means the strict validation and listed scans pass without changing existing behavior.

Written by the indexing model from the issue text.