[aw-doctor:compiler-security] githubnext/gh-aw-cao: 156 actionlint errors across 34 compiled workflows (strict mode failure)

Compiling `githubnext/gh-aw-cao` (target sha `7a2201841cea362a055a9a72b4c83f2e7b74a0dc`) with the gh-aw compiler's full validation suite (strict mode, actionlint, shellcheck, container/license/security scanners) exited with code 1. 44 workflow sources / 44 compiled locks were checked. actionlint reported **156 errors across 34 generated lock files**: 121 `[expression]` type errors (undefined properties in `workflow_dispatch` input/`github.aw` context objects — mostly `max_repos`, `rollout_percent`, `central_repo`, `control_plane_run_url`, `correlation_id`, `github-mcp-app-token`, and `github.aw`) and 35 `[shellcheck]` SC2129 style findings (multiple appended redirects that should use `{ } >>`). No container-image (grype/syft), license (grant), or security-scanner (zizmor/poutine/runner-guard) findings were reported. Highest supported severity: actionlint strict-mode error (build-breaking); no CVE/vulnerability severity applies.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `44`
- **Generated lock files checked**: `44`
- **Result**: `findings`

| Tool | Workflow(s) | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | aw-doctor, aw-failures-investigator, aw-maintenance-compiler-security, aw-maintenance-upgrade, dependabot-release-train-updater, dependabot, eu-cra-compliance* (7 variants), optimization* (5 variants), self-care* (12 variants), software-development-practices* (3 variants), uk-ai-advisory* (2 variants) | error (strict-mode, build-breaking) | Recurring `[expression]` errors: `property "aw" is not defined` (34), `property "rollout_percent" is not defined` (27), `property "max_repos" is not defined` (27), `property "github-mcp-app-token" is not defined` (11), `property "correlation_id" is not defined` (7), `property "control_plane_run_url" is not defined` (7), `property "central_repo" is not defined` (7), `property "safe-outputs-app-token" is not defined` (1) — steps reference `github.event.inputs.` or `github.aw.` for fields not declared in the compiled `workflow_dispatch` input schema or `github.aw` context type for that job | Align `on.workflow_dispatch.inputs` declarations (and any `github.aw` context typing) in the shared control-plane `.md` sources with the fields actually referenced in generated steps, so actionlint's static type-check for `github.event.inputs.*` and `github.aw.*` matches the declared schema |
| shellcheck (SC2129) | Same 34 lock files, in generated shell steps with multiple `>>` redirects | style (error under strict mode) | "Consider using `{ cmd1; cmd2; } >> file` instead of individual redirects" | Combine repeated `>>` appends into a single `{ ...; } >> file` block in the shared shell snippet that generates these steps |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files (e.g. `.github/workflows/shared/control.md` and its dependencies); never edit generated `.lock.yml` files. There are 156 actionlint errors across 34 compiled lock files: 121 `[expression]` errors where generated steps reference `github.event.inputs.*` or `github.aw.*` properties (`max_repos`, `rollout_percent`, `central_repo`, `control_plane_run_url`, `correlation_id`, `github-mcp-app-token`, `aw`, `safe-outputs-app-token`) that are not defined in the compiled input/context type for that job — align the shared control-plane workflow-dispatch input declarations and `github.aw` context typing with what is actually referenced downstream. Also fix 35 shellcheck SC2129 findings by combining repeated `>>` redirect appends into a single `{ cmd1; cmd2; } >> file` block in the shared shell snippet(s) that generate these steps. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 44
Compiled locks: 44
```

Sample errors (representative, full report is 833 lines / 34 affected files):
```
.github/workflows/aw-doctor.lock.yml:478:29: error: [expression] property "github-mcp-app-token" is not defined in object type {set-runtime-paths: ...; setup: ...}
.github/workflows/aw-doctor.lock.yml:1187:29: error: [expression] property "aw" is not defined in object type {...}
.github/workflows/uk-ai-advisory-operational-resilience.lock.yml:1101:29: error: [expression] property "aw" is not defined ...
if: ${{ always() && github.aw.import-inputs.role == 'orchestrator' }}
.github/workflows/uk-ai-advisory.lock.yml:1401:9: error: [shellcheck] SC2129:style:7:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects
✗ actionlint failed
strict mode: actionlint found 156 errors in workflows - workflows must have no actionlint errors in strict mode
```

No zizmor, poutine, runner-guard, grype, syft, grant, or yamllint findings appeared in the report. `git-status.txt` and `diff-stat.txt` were empty (no working-tree changes from the compile dry run).

Control plane context

- Correlation ID: `34124134132-67`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34124134132

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34124499137) · copilot · auto · 31.9 AIC · ⌖ 9.19 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 1:00 PM UTC

Start with .github/workflows/shared/control.md and its dependencies, then run the gh-aw compiler in strict mode to trace the generated findings without editing .lock.yml files. Align the shared workflow sources and shell snippets, review the generated diffs, and rerun the full compiler and security scan until all 156 findings are clear.

Written by the indexing model from the issue text.