[aw-doctor:compiler-security] Compiler & security scan findings: 2 actionlint errors, zizmor high/medium findings, Critical CVEs, license policy violations

Compilation of all 51 GitHub Agentic Workflows in `githubnext/gh-aw-cao` completed with **exit code 1** (findings, not clean). Breakdown: 2 actionlint expression errors, 796 zizmor findings (49 High / 447 Medium / 323 Low / 311 Informational), 1 poutine/runner-guard medium warning, 34 Critical + 172 High container CVEs (grype), and 1250 license policy violations across 9 container images (grant, strict mode fail). Highest-severity supported finding: **Critical CVEs** (e.g. CVE-2026-19931, CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-5450) in the pinned firewall/proxy/node/mcp-server base images. Recommended next action: assign to Copilot to fix the two actionlint expression errors and re-pin/rebuild affected container images; triage license and zizmor findings separately since many require accepted-risk policy decisions rather than code changes.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|------------------|----------|---------|--------------|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step-output property referenced but not defined in the step outputs type (expression type-check failure) | Fix the `.md` source's `GIT_TOKEN` expression so it only references step outputs that actually exist on the `safe-outputs-app-token` step, then recompile |
| zizmor | 41 workflow lock files | High | `github-app`: dangerous use of GitHub App tokens | Review App-token usage in each affected workflow source; ensure tokens are scoped to a dedicated environment/step and not exposed to untrusted contexts |
| zizmor | 55 workflow lock files (418 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into `environment:`-scoped jobs where feasible, or document why not applicable |
| zizmor | multiple (29 occurrences, e.g. dashboard-authoring-corpus, dependabot-release-train-updater, design-decision-gate) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts via `actions/checkout` | Review checkout steps that persist credentials into uploaded artifacts; set `persist-credentials: false` where not needed |
| zizmor | 51 workflow lock files (294 occurrences) | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments | Add short comments explaining each granted permission (informational hardening, no functional risk) |
| zizmor | multiple (26 occurrences) | Low | `adhoc-packages`: ad-hoc installation of packages (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor installs or accept as documented risk |
| zizmor | optimization-ai-credit-auditor, optimization-ai-credit-optimizer, self-care-docs-build-time-investigator | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Review flagged expressions for clarity |
| zizmor | pr-reviewer, self-care-primer-brand-checker (9 occurrences) | Informational | `template-injection`: code injection via template expansion | Low-risk informational; confirm no untrusted input reaches the flagged expression |
| zizmor | 51 workflow lock files (302 occurrences) | Informational | `anonymous-definition`: workflow/action definition without a `name:` | Cosmetic; add names if desired |
| poutine / runner-guard | agentic_commands.yml | Medium | `RGS-005`: Excessive Permissions on Untrusted Trigger — write permissions combined with an externally-triggerable event | Review whether `design-decision-gate`, `mattpocock-skills-reviewer`, `pr-sous-chef` command workflows truly need write permissions on this trigger, or narrow the trigger/permissions |
| grype | ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.28.15, gh-aw-mcpg:v0.4.20, gh-aw-node, github-mcp-server:v1.12.1, alpine:latest, node:lts-alpine | Critical | 34 Critical CVEs, notably CVE-2026-19931 & CVE-2026-18924 (curl/libcurl), CVE-2026-63073 & CVE-2026-75803 (openssl/libssl3/libcrypto3), CVE-2026-5450 (libc6) | Rebuild/re-pull affected images once upstream Alpine/Debian fixed packages are published (fixes shown: curl 8.22.0-r0, openssl 3.5.8-r0); re-pin image digests |
| grype | all 9 scanned images | High | 172 High-severity CVEs across bind9-libs, python3.10, and others | Track via routine base-image refresh; re-scan after rebuild |
| grant | all 9 scanned container images | error | 1250 license policy violations (strict mode) — mostly GPL/LGPL/ISC/BSD components not on `.grant.yaml` allow-list | Update `.grant.yaml` allow-list for accepted OSS licenses actually shipped in these images, or exclude vendor-provided base images from strict license enforcement if not redistributed |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Actionlint summary**
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

**Zizmor severity totals**: High 49, Medium 447, Low 323, Informational 311 (total 1130 findings across 51 files; rule breakdown above).

**Poutine / runner-guard**: 1 finding (RGS-005, medium, `agentic_commands.yml`).

**Syft**: SBOMs generated for 9 container images (567–16 packages each): `gh-aw-firewall/agent:0.28.15`, `gh-aw-firewall/api-proxy:0.28.15`, `gh-aw-firewall/cli-proxy:0.28.15`, `gh-aw-firewall/squid:0.28.15`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`.

**Grype severity totals**: Critical 34, High 172, Medium 341, Low 54, Negligible 27, Unknown 18.

**Grant**: `✗ grant failed — strict mode: grant found 1250 license policy finding(s) in container images.` Current allow-list (`.grant.yaml`) restricts to `metadata: read, contents: read, actions: read` and does not enumerate accepted licenses, so nearly all non-trivial licenses in the scanned images (GPL-2.0, LGPL-2.1, ISC, Artistic, HPND-sell-variant, etc.) are flagged.

**Yamllint**: no findings surfaced in the report (0 warnings/errors matched).

**Shellcheck**: ran on 2905 run-step resources; findings are limited to `SC2034` (appears-unused variable) warnings in numerous `*-operational-value.sh` grader scripts (informational, non-blocking).

**Working tree note**: the deterministic compile run left git working-tree changes (55 modified files including 51 regenerated `.lock.yml` files, `actions-lock.json`, several `.md` sources, and an untracked `.poutine.yml`); those diffs reflect this compile run's regenerated artifacts and are not part of this report's findings.

Control plane context

- Correlation ID: `34624153604-1145`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34624153604`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34624153604) · copilot · auto · 47.4 AIC · ⌖ 9.49 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 5:08 PM UTC

Start with the two actionlint findings in self-care-dashboard-performance.md and self-care-pages-health.md, then review the related generated lock files without editing them. Inspect the affected workflow sources, agentic_commands.yml, container image references, and .grant.yaml alongside the scan output. Done means the permitted compiler and security scans pass, or unresolved policy findings are explicitly documented.

Written by the indexing model from the issue text.