[aw-doctor:compiler-security] Strict-mode actionlint failures across 34 compiled workflow lock files (156 errors)

Compiling all 44 workflow sources in `githubnext/gh-aw-cao` (target sha `7a2201841cea362a055a9a72b4c83f2e7b74a0dc`) succeeded for 44/44 lock files, but strict-mode `actionlint` (1.7.12, with shellcheck) reported **156 errors across 34 generated `.lock.yml` files**, causing the compiler to exit non-zero. No container/license/security scanner (zizmor, poutine, runner-guard, grant, grype, syft) output appears in the report because the run halted at the actionlint gate. Highest-return fix: correct the shared workflow-generation template(s) that emit these expression/shellcheck patterns, since the same 5 error signatures repeat almost identically across all affected workflows — this is one systemic root cause, not 156 independent bugs.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | 34 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `software-development-practices.lock.yml`, `uk-ai-advisory.lock.yml`, ...) | unknown (actionlint hard error) | `property "aw" is not defined` on `if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}` — `github.aw` is not a recognized context property to actionlint's type checker (34 occurrences) | Update the shared workflow-generation source (control.md / shared templates) to avoid referencing `github.aw.*` directly in `if:` expressions, or add an actionlint-recognized indirection (e.g. resolve via a prior step output) so strict-mode type-checking passes |
| actionlint (expression) | Same 34 files | unknown | `property "github-mcp-app-token" is not defined` on `steps.github-mcp-app-token.outputs.token` fallback expressions (11 occurrences) | Ensure the referenced step id `github-mcp-app-token` exists in the same job before this expression, or adjust the generated step-output typing so actionlint recognizes it |
| actionlint (expression) | Same 34 files | unknown | `property "central_repo"`, `"control_plane_run_url"`, `"correlation_id"` not defined on `github.event.inputs.*` (7 each = 21 occurrences) | These `workflow_dispatch` inputs are referenced but not declared in the compiled workflow's `inputs:` schema — add them to the generated `on.workflow_dispatch.inputs` block or compiler input-schema template |
| actionlint (expression) | Same 34 files | unknown | `property "max_repos"`, `"rollout_percent"` not defined on `github.event.inputs.*` (27 each = 54 occurrences) | Same root cause as above — declare these dispatch inputs in the generated schema |
| actionlint (shellcheck SC2129) | 35 lock files | style | "Consider using `{ cmd1; cmd2; }` >> file instead of individual redirects" in a generated `run:` block | Update the shared shell script template that appends multiple lines to a file to batch redirects, or add a targeted shellcheck disable comment in the generated script |

Total: 121 `[expression]` errors + 35 `[shellcheck]` errors = 156.

No zizmor, poutine, runner-guard, grant, grype, syft, or yamllint findings were present in the evidence — the compiler pipeline stopped at the actionlint gate (`✗ actionlint failed`, `strict mode: actionlint found 156 errors in workflows`).

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files (e.g. `.github/workflows/shared/control.md` and its dependencies); never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. The 156 actionlint errors repeat across 34 files with only 5 distinct root causes: (1) `github.aw.import-inputs.role` referenced in `if:` expressions where actionlint does not recognize the `aw` context property, (2) `steps.github-mcp-app-token.outputs.token` referenced where actionlint does not see that step id declared, (3)-(5) `github.event.inputs.central_repo` / `control_plane_run_url` / `correlation_id` / `max_repos` / `rollout_percent` referenced without being declared in the workflow's `workflow_dispatch.inputs` schema, plus one recurring shellcheck SC2129 style warning about combining redirects in a generated `run:` block. Fix each root cause once in the shared template(s) so it resolves across all 34 affected workflows simultaneously. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 44
Compiled locks: 44
```

Guard policy dry-run notes (informational, not blocking):
- `push-to-pull-request-branch: target: "*"` in `pr-sous-chef.md` allows pushing to any PR branch with no additional constraints; consider adding `required-title-prefix:` or `required-labels:` restrictions.
- Includes-entry ignore warning: `.github/workflows/aw.json` in `target/aw.yml` is ignored by the compiler (informational only).

Error category counts:
```
121 error: [expression]
35 error: [shellcheck] (all SC2129, style severity)
```

Distinct expression-error signatures and occurrence counts:
```
34 property "aw" is not defined
27 property "max_repos" is not defined
27 property "rollout_percent" is not defined
11 property "github-mcp-app-token" is not defined
7 property "central_repo" is not defined
7 property "control_plane_run_url" is not defined
7 property "correlation_id" is not defined
(+ 1 additional expression variant not separately tallied above)
```

Final compiler line:
```
✗ actionlint failed
strict mode: actionlint found 156 errors in workflows - workflows must have no actionlint errors in strict mode
```

No credential-like or token-like values were present in the evidence reviewed.

Control plane context

- Correlation ID: `34112977511-65`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34112977511`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34113381878) · copilot · auto · 36.4 AIC · ⌖ 9.05 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 10:55 AM UTC

Start with .github/workflows/shared/control.md and the related .github/workflows/*.md sources; do not edit generated .lock.yml files. Use the gh aw MCP server's fix and compile tools, then rerun strict validation and the listed security scans. Done means the shared-template changes resolve the repeated findings and the full compiler pipeline passes cleanly.

Written by the indexing model from the issue text.