[aw-doctor:compiler-security] gh-aw compiler/security suite failed: critical container CVEs, license-policy violations, and github-app findings across all 51

gh-aw compiled all 51 workflows in `githubnext/gh-aw-cao` but the full validation/lint/container/security suite **exited 1** (grant license-policy scan failed in strict mode, plus actionlint, zizmor, grype, and runner-guard findings). Highest-severity supported finding: **34 Critical** grype CVEs in container images (curl/OpenSSL/libc6 in `gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`), plus 49 High-severity zizmor `github-app` findings (dangerous GitHub App token usage pattern) repeated across all 51 lock files, and 1250 grant license-policy violations (GPL/LGPL family licenses in container image dependencies) that caused the strict-mode failure. No code changes are recommended without human triage since most findings stem from base image choice and template-generated GitHub App token usage across every workflow.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | self-care-dashboard-performance.lock.yml:2314, self-care-pages-health.lock.yml:2220 | error | `steps.safe-outputs-app-token` referenced but not a defined step output in that job context | Fix the `.md` source template that emits `GIT_TOKEN` fallback expression so the referenced step id exists in the same job, then recompile |
| grant (license, strict mode) | 9 container images (all) | policy failure | 1250 license-policy violations (GPL-2.0-only ×62, GPL-3.0-or-later ×18, LGPL family ×18, plus ISC/MIT/BSD/Apache noted as informational) causing the run to fail | Review `.poutine.yml`/grant policy allow-list; either accept these licenses explicitly in policy or pin to images without copyleft-licensed system packages |
| zizmor | all 51 lock files | High (49×) | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) in a pattern repeated in every compiled workflow | Review shared `control.md`/token-issuance template for scoping; confirm token permissions are minimal and short-lived, add zizmor suppression with justification if intentional |
| zizmor | all 51 lock files | Medium (418×) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-referencing steps into declared `environment:` blocks in the shared workflow templates |
| zizmor | multiple lock files | Medium (29×) | `artipacked`: credential persistence through GitHub Actions artifacts | Audit artifact upload steps for token/credential leakage; scrub before upload |
| runner-guard | agentic_commands.yml:1 | Medium | `RGS-005` excessive write permissions on a workflow triggered by an untrusted event (`issue_comment`/`pull_request_target`-class trigger) | Narrow `permissions:` for the `agentic_commands` job to least privilege for its trigger context |
| gh-aw guard (advisory) | pr-sous-chef.md | info | `push-to-pull-request-branch` target `"*"` has no `required-title-prefix`/`required-labels` constraint | Add `required-title-prefix` or `required-labels` to restrict which PRs can receive pushes |
| grype | gh-aw-firewall/api-proxy, cli-proxy, squid, gh-aw-mcpg, github-mcp-server, alpine, node:lts-alpine | Critical (34×) | CVE-2026-19931 / CVE-2026-18924 (curl/libcurl), CVE-2026-63073 / CVE-2026-75803 (openssl/libcrypto3/libssl3), CVE-2026-5450 (libc6) | Rebuild/pull updated base images once upstream patches (curl 8.22.0-r0, openssl 3.5.8-r0, libc6 fix) are available |
| grype | gh-aw-firewall/agent, gh-aw-node | High (172×, incl. `GHSA-rgw5-rvv9-x895`, `GHSA-mh99-v99m-4gvg` brace-expansion) | Node `brace-expansion` prototype-pollution advisories and other High CVEs (bind9-libs, curl, python3.10) | Bump `brace-expansion` to ≥5.0.9 in image dependency tree; track upstream base-image updates for the rest |
| zizmor | all 51 lock files | Low/Informational (629×) | `undocumented-permissions` (294), `anonymous-definition` (302), `adhoc-packages` (26), `template-injection` info (9), `obfuscation` (3) | Lower priority; add permission comments and job `name:` fields in shared templates when convenient |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action (e.g. accepting a license policy, or images needing an upstream vendor fix), require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely (for example, CVEs that require an upstream base-image update, or license-policy findings that require an explicit policy decision rather than a code change).

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51

Actionlint: 2 errors (expression: safe-outputs-app-token undefined property), 51 files checked.

Zizmor (51 files): 49 High (github-app), 447 Medium (secrets-outside-env 418, artipacked 29),
323 Low (undocumented-permissions 294, adhoc-packages 26, obfuscation 3), plus 311 Informational
(anonymous-definition 302, template-injection 9).

runner-guard: 1 Medium finding — RGS-005 Excessive Permissions on Untrusted Trigger
(.github/workflows/agentic_commands.yml:1).

gh-aw guard dry-run advisory: push-to-pull-request-branch target "*" with no
required-title-prefix/required-labels constraint (pr-sous-chef.md).

syft: scanned 9 container images (567/193/347/63/288/177/41/16/165 packages respectively):
ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.15,
ghcr.io/github/gh-aw-mcpg:v0.4.20, ghcr.io/github/gh-aw-node,
ghcr.io/github/github-mcp-server:v1.12.1, alpine:latest, node:lts-alpine.

grype (9 images): 34 Critical, 172 High, 341 Medium, 54 Low, 27 Negligible.
Critical CVEs: CVE-2026-19931, CVE-2026-18924 (curl/libcurl, multiple images),
CVE-2026-63073, CVE-2026-75803 (openssl/libcrypto3/libssl3, multiple images),
CVE-2026-5450 (libc6, github-mcp-server).
High: GHSA-rgw5-rvv9-x895 and GHSA-mh99-v99m-4gvg (brace-expansion) plus bind9-libs/curl/python3.10 CVEs.

grant (license policy, strict mode): FAILED — 1250 findings across all 9 images.
Top licenses flagged: ISC (365), MIT (285), Apache-2.0 (69), GPL-2.0-only (62),
BlueOak-1.0.0 (55), BSD-2-Clause (32), BSD-3-Clause (22), GPL-3.0-or-later (18),
GPL-2.0-or-later (15), LGPL-2.1-or-later (14), plus smaller counts of
HPND-sell-variant, Zlib, curl, X11, Expat, CC0-1.0, CC-BY-3.0, Artistic-2.0,
LGPL-2.0-or-later, MPL-2.0, and a handful of ad-hoc/blessing/public-domain entries.

yamllint / shellcheck (2905 run-step resources): shellcheck SC2034 (unused variable)
warnings in ~15 grader scripts under .github/graders/*-operational-value.sh
(WORKFLOW_NAME, SOURCE_PATH, TITLE_PREFIX, DOMAIN/FRAMEWORK, OPERATIONAL_VALUE,
OPPORTUNITY, ACCEPTED, METRIC_ID reported unused — likely intentional template
placeholders sourced by consuming scripts).

Experimental features in use: graders (16 workflows), gh-aw-detection (2 workflows).
Total: 51 workflows, 7.6 MB, 302 jobs, 6373 steps, 2889 scripts (1.6 MB).
```

No token-like or credential-like values were present in the tool output beyond `${{ secrets.* }}` / `${{ vars.* }}` expression references, which are redacted-by-design (they are GitHub Actions context expressions, not literal secret values).

Control plane context

- **Correlation ID**: 34629223814-168
- **Central repository**: githubnext/gh-aw-cao
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/34629223814

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34629814516) · copilot · auto · 53.2 AIC · ⌖ 13.8 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 6:11 PM UTC

Start with the compiler and security suite for the 51 workflow sources, then inspect the mentioned .github/workflows/*.md templates, especially agentic_commands.yml and pr-sous-chef.md. Review shared control.md, token-issuance behavior, and .poutine.yml without editing generated lock files. Done means the full validation and security scan passes, or remaining upstream CVEs and license-policy decisions are clearly documented.

Written by the indexing model from the issue text.