[aw-doctor:compiler-security] Compiler strict-mode failure: undefined `safe-outputs-app-token` step reference (2 workflows)

Target `githubnext/gh-aw-cao`: `gh aw compile` (strict mode) exits non-zero. actionlint found 2 expression errors — both workflows reference `steps.safe-outputs-app-token.outputs.token`, but no step with id `safe-outputs-app-token` exists in the generated job. Category: **compiler/validation error** (actionlint), severity **error** (blocking, strict mode requires zero actionlint errors). No container, license, or additional security-scanner findings were reported.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2283 | error | `steps.safe-outputs-app-token.outputs.token` referenced but not defined in job's steps object (only `download-agent-output`, `setup`, `setup-agent-output-env` exist) | Fix the `.md` source (`self-care-dashboard-performance.md`) so the `GIT_TOKEN` env expression references a step id that actually exists in the compiled job, or add the missing `safe-outputs-app-token` step generation for this workflow's safe-outputs config |
| actionlint | self-care-pages-health.lock.yml:2189 | error | Same undefined `steps.safe-outputs-app-token` reference | Same fix as above, in `self-care-pages-health.md` |

Additionally, `git-status.txt`/`diff-stat.txt` show the compiler regenerated 3 lock files with diffs (`self-care-data-acquisition-audit.lock.yml`, `self-care-pages-health.lock.yml`, `self-care.lock.yml`), indicating these lock files are currently out of sync with their `.md` sources and must be recompiled after the fix.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Specifically: `self-care-dashboard-performance.md` and `self-care-pages-health.md` compile to lock files that reference `steps.safe-outputs-app-token.outputs.token` in a `GIT_TOKEN` env var, but no such step exists in the generated job (actionlint errors at lines 2283 and 2189 respectively). Locate the safe-outputs / token-generation configuration in these two `.md` sources causing this dangling reference and correct it so the referenced step is either generated or the reference is removed/replaced with a valid fallback (e.g. `secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN`), then recompile until actionlint reports zero errors.

Raw evidence

```
⚠ push-to-pull-request-branch: target: "*" allows pushing to any PR branch with no additional constraints.
Consider adding required-title-prefix: or required-labels: to restrict which PRs can receive pushes.

i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 45 files
.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {conclusion: string; outcome: string; outputs: {string => string}}; setup: {conclusion: string; outcome: string; outputs: {string => string}}; setup-agent-output-env: {conclusion: string; outcome: string; outputs: {string => string}}}
2283 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/self-care-pages-health.lock.yml:2189:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {conclusion: string; outcome: string; outputs: {string => string}}; setup: {conclusion: string; outcome: string; outputs: {string => string}}; setup-agent-output-env: {conclusion: string; outcome: string; outputs: {string => string}}}
2189 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

✗ actionlint failed
strict mode: actionlint found 2 errors in workflows - workflows must have no actionlint errors in strict mode
```

Diff summary (lock files regenerated by this scan, pending fix and recompile):
```
.../self-care-data-acquisition-audit.lock.yml | 2 +-
.github/workflows/self-care-pages-health.lock.yml | 128 +++++++++++++++------
.github/workflows/self-care.lock.yml | 2 +-
3 files changed, 96 insertions(+), 36 deletions(-)
```

Control plane context

- Correlation ID: `34152938007-73`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34152938007`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34153191296) · copilot · auto · 23.7 AIC · ⌖ 8.7 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 6:54 PM UTC

Start with .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, then inspect their generated lock files at the reported actionlint lines. Run gh aw compile in strict mode and review the resulting lock-file diffs; done means the dangling step references are resolved and actionlint reports zero errors across the workflows.

Written by the indexing model from the issue text.