Summary
The gh-aw compiler emits if: conditions in generated .lock.yml files that reference needs.<job>.outputs.secret_verification_result, but the producing job never declares that output. This is a real compiler codegen defect — Tier B under UK AI Open Code Governance.
Evidence
From the 2026-07-20 static analysis report (#46721):
- Tool: actionlint
- Count: 69 generated workflows affected
- Error:
[expression] property "secret_verification_result" is not defined in object type {...}
- Historical trend: count crept from 109 → 114 over the past week, with this regression as the dominant contributor
Sample workflows affected: ab-testing-advisor, agent-performance-analyzer, archie, architecture-guardian, artifacts-summary, auto-triage-issues, brave, breaking-change-checker, ci-coach, cli-consistency-checker... (69 total)
Impact
Remediation
Fix the generator in pkg/workflow (search for secret_verification_result):
Option A: Declare the output on the producing job:
outputs:
secret_verification_result: ${{ steps.<step>.outputs.result }}Option B: If secret verification was removed, delete the dangling if: reference from the consuming job.
Then recompile all workflows and verify:
make recompile && actionlint .github/workflows/*.lock.yml 2>&1 | grep -c secret_verification_result
# must be 0
Add a compiler unit test asserting every emitted needs.*.outputs.* reference has a matching outputs: declaration.
Risk Scoring (UK AI Governance)
| Dimension |
Score |
| Exposure amplification (AI generates workflows) |
3/5 |
| Patchability |
2/5 (fix generator, then recompile) |
| Detectability |
2/5 |
| Operational fragility |
2/5 |
| Ownership confidence |
2/5 |
| Overall |
2.2 — Tier B |
SLA
High — resolve within 7 days.
References
Generated by UK AI Operational Resilience · 100.9 AIC · ⌖ 5.86 AIC · ⊞ 5.2K · ◷
Summary
The gh-aw compiler emits
if:conditions in generated.lock.ymlfiles that referenceneeds.<job>.outputs.secret_verification_result, but the producing job never declares that output. This is a real compiler codegen defect — Tier B under UK AI Open Code Governance.Evidence
From the 2026-07-20 static analysis report (#46721):
[expression] property "secret_verification_result" is not defined in object type {...}Sample workflows affected: ab-testing-advisor, agent-performance-analyzer, archie, architecture-guardian, artifacts-summary, auto-triage-issues, brave, breaking-change-checker, ci-coach, cli-consistency-checker... (69 total)
Impact
if:output reference evaluates to empty string — the intended guard may not behave as designedsecret_verification_resultoutput in 69 workflows #44870)Remediation
Fix the generator in
pkg/workflow(search forsecret_verification_result):Option A: Declare the output on the producing job:
Option B: If secret verification was removed, delete the dangling
if:reference from the consuming job.Then recompile all workflows and verify:
Add a compiler unit test asserting every emitted
needs.*.outputs.*reference has a matchingoutputs:declaration.Risk Scoring (UK AI Governance)
SLA
High — resolve within 7 days.
References
secret_verification_resultoutput in 69 workflows #44870 (closed)