[aw-doctor:compiler-security] Compiler strict-mode failure: 156 actionlint errors across all 44 workflows

Compiling all 44 workflows in `githubnext/gh-aw-cao` with the gh-aw compiler's strict validation exited with code 1: actionlint reported 156 errors across all 44 generated lock files, blocking clean strict-mode compilation. No container/license/security scanners (grype, syft, poutine, zizmor, runner-guard, grant) ran because actionlint failed first. Findings fall into two categories: (1) 121 "expression" errors where generated workflows reference undefined context properties (`github.aw.*`, `github.event.inputs.max_repos/rollout_percent/correlation_id/control_plane_run_url/central_repo`, `steps.github-mcp-app-token.outputs.token`, `steps.safe-outputs-app-token.outputs.token`) — a systemic issue in the shared control/orchestrator templates, not workflow-specific; and (2) 35 shellcheck SC2129 style findings (multiple redirects instead of a grouped block) repeated across nearly every workflow. Highest-severity/highest-return fix: the expression-schema mismatch, since it affects every orchestrator/worker-dispatch workflow and fully blocks strict compilation.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|------|-------------|----------|---------|--------------|
| actionlint | 34 workflows (orchestrator role-gated `if:` steps) | unknown (build-blocking) | `property "aw" is not defined` — `github.aw.import-inputs.role` referenced but `github.aw` is not part of actionlint's known `github` context schema | Use a supported context path (e.g. an intermediate step output/env var) instead of `github.aw.*` in generated `if:` conditions, or add an actionlint context extension for the `aw` field in the compiler |
| actionlint | 27 workflows (dispatch envelope `env:` blocks) | unknown (build-blocking) | `property "max_repos" is not defined` on `github.event.inputs.max_repos` | Declare `max_repos` as a `workflow_dispatch` input in the shared control template, or read it from a source already typed in the inputs schema |
| actionlint | 27 workflows | unknown (build-blocking) | `property "rollout_percent" is not defined` on `github.event.inputs.rollout_percent` | Same as above — add to `workflow_dispatch.inputs` schema |
| actionlint | 11 workflows | unknown (build-blocking) | `property "github-mcp-app-token" is not defined` on `steps.github-mcp-app-token.outputs.token` — referenced before/without the step existing in that job | Ensure the `github-mcp-app-token` step is defined in every job that references its output, or guard the reference |
| actionlint | 7 workflows | unknown (build-blocking) | `property "correlation_id" is not defined` on `github.event.inputs.correlation_id` | Add to `workflow_dispatch.inputs` schema |
| actionlint | 7 workflows | unknown (build-blocking) | `property "control_plane_run_url" is not defined` on `github.event.inputs.control_plane_run_url` | Add to `workflow_dispatch.inputs` schema |
| actionlint | 7 workflows | unknown (build-blocking) | `property "central_repo" is not defined` on `github.event.inputs.central_repo` | Add to `workflow_dispatch.inputs` schema |
| actionlint | 1 workflow | unknown (build-blocking) | `property "safe-outputs-app-token" is not defined` | Ensure step exists / guard reference |
| actionlint (shellcheck SC2129) | 35 occurrences across nearly all workflows | style | "Consider using `{ cmd1; cmd2; } >> file` instead of individual redirects" in generated shell script | Group repeated `>>` redirects into a single `{ ...; } >> file` block in the shared shell-script template used by the compiler |

All findings originate from `.github/workflows/shared/control.md` and its generated dispatch-envelope/orchestrator templates, since the same property names and line patterns recur nearly identically across every affected workflow.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler exit code: `1`. Summary: `Target: githubnext/gh-aw-cao; Workflow sources: 44; Compiled locks: 44`. Full actionlint tail:

```
✗ actionlint failed
strict mode: actionlint found 156 errors in workflows - workflows must have no actionlint errors in strict mode
```

Representative error samples (full text preserved verbatim from tool output; no credential-like values observed):

```
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {set-runtime-paths: {...}; setup: {...}}
github-token: ${{ steps.github-mcp-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/uk-ai-advisory.lock.yml:1083:29: error: [expression] property "aw" is not defined in object type {action: string; ...}
if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}

.github/workflows/uk-ai-advisory.lock.yml:1401:9: error: [shellcheck] shellcheck reported issue in this script: SC2129:style:7:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects

.github/workflows/uk-ai-advisory.lock.yml:1524:39: error: [expression] property "central_repo" is not defined in object type {aw_context: string; max_repos: string; rollout_percent: string; safe_output_mode: string; safe_output_repo: string; target_repo: string}
CAO_CENTRAL_REPOSITORY: ${{ github.event.inputs.central_repo || '' }}
```

Full per-file error counts (44 files, 156 total errors): optimization-ai-credit-auditor (6), aw-maintenance-upgrade (6), aw-failures-investigator (6), aw-doctor (6), uk-ai-advisory (5), uk-ai-advisory-operational-resilience (5), software-development-practices (5), self-care (5), self-care-dashboard-performance (5), optimization (5), optimization-skills-curator (5), optimization-ai-credit-optimizer (5), optimization-agents-md-curator (5), eu-cra-compliance (5), dependabot (5), dependabot-release-train-updater (5), and 18 further workflows each with 4 errors (software-development-practices-nist-ssdf, software-development-practices-github-well-architected, self-care-primer-brand-checker, self-care-open-source-failures, self-care-glossary, self-care-docs-build-time-investigator, self-care-data-acquisition-audit, self-care-dashboard-review, self-care-dashboard-language-refactor, self-care-code-improvement, self-care-accessibility-checker, eu-cra-compliance-vulnerability-handling-auditor, eu-cra-compliance-supply-chain-sbom-auditor, eu-cra-compliance-security-requirements-auditor, eu-cra-compliance-scope-classifier, eu-cra-compliance-conformity-release-evidence, eu-cra-compliance-article-14-reporting-readiness, aw-maintenance-compiler-security).

No container image, SBOM, or license-scanner (grype/syft/grant/poutine/zizmor/runner-guard) output was present in the evidence — those tools did not run because actionlint failed the strict-mode gate first.

Control plane context

- Correlation ID: `34118464049-502`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34118464049`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34118464049) · copilot · auto · 41.2 AIC · ⌖ 7.13 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 11:53 AM UTC

Start with .github/workflows/shared/control.md and the generated dispatch-envelope/orchestrator templates; use the gh-aw MCP server's compile tool with strict validation to reproduce the actionlint failures. Update only the named workflow sources, never generated .lock.yml files, and consider the work done when compilation and the listed security and shell checks pass cleanly.

Written by the indexing model from the issue text.