[aw-doctor:compiler-security] gh-aw compiler run found 819 zizmor, 547 grype, 1250 license findings across 51 workflows

The gh-aw compiler run against `githubnext/gh-aw-cao` exited with code `1` (not clean). Across 51 workflow sources / 51 compiled locks, the scanners reported: 2 actionlint expression errors, 819 zizmor findings (34 Critical, 221 High, 447 Medium, 377 Low — mostly `secrets-outside-env`, `undocumented-permissions`, `github-app` token usage), 1 poutine/runner-guard medium finding (excessive permissions on untrusted trigger in `agentic_commands.yml`), 547 grype container CVE findings (34 Critical, 172 High, 341 Medium) across 9 scanned images, 1250 grant license-policy violations across all 9 images, and 68 low-severity shellcheck `SC2034` (unused variable) warnings in grader scripts. yamllint reported no issues. Highest-severity supported findings: grype Critical CVEs (e.g. CVE-2026-19931, CVE-2026-18924 in `ghcr.io/github/gh-aw-node`) and zizmor Critical/High `github-app`/`secrets-outside-env` findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` property not defined in expression context (`steps.safe-outputs-app-token.outputs.token`) | Fix the referenced step id/output in the workflow source so the step context type includes `safe-outputs-app-token`, then recompile |
| zizmor | 49 lock files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review app-token usage scope/exposure per `docs.zizmor.sh/audits/#github-app` |
| zizmor | many lock files | Medium | `secrets-outside-env` (418 occurrences): secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block |
| zizmor | many lock files | Low/Medium | `undocumented-permissions` (294), `artipacked` (29), `adhoc-packages` (26), `obfuscation` (3) | Add permission comments; avoid ad-hoc package installs; document/justify flagged patterns |
| poutine / runner-guard | agentic_commands.yml | medium (RGS-005) | Write-level permissions (`contents: write` etc.) on workflow triggered by `pull_request_target`/`issue_comment`-class events | Reduce permissions or scope write access away from untrusted-trigger jobs |
| grype | ghcr.io/github/gh-aw-node | Critical | CVE-2026-19931, CVE-2026-18924 (libcurl@8.21.0-r0, fix 8.22.0-r0) | Bump base image / libcurl package |
| grype | ghcr.io/github/gh-aw-firewall/squid:0.28.15 | Critical (10) | Multiple CVEs (squid image) | Rebuild image on patched base |
| grype | ghcr.io/github/gh-aw-mcpg:v0.4.20 | High (48), Critical (4) | google.golang.org/grpc, alpine libmount/libblkid CVEs | Upgrade grpc dependency and alpine base packages |
| grype | node:lts-alpine, alpine:latest, gh-aw-firewall/{agent,api-proxy,cli-proxy}, github-mcp-server | Critical/High (various, see raw evidence) | Multiple OS/package CVEs | Rebuild/upgrade base images |
| grant | all 9 scanned images | error | 1250 license-policy violations (GPL/LGPL/other flagged licenses in OS + npm packages) | Review/allowlist licenses per policy or replace flagged packages |
| shellcheck | grader scripts (`.github/graders/*-operational-value.sh`) | Low (SC2034, 68 occurrences) | Unused variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) | Remove or export unused variables, or add `# shellcheck disable=SC2034` with justification |
| yamllint | — | — | No findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint: 2 errors (expression type).
Zizmor: 819 findings total — 34 Critical, 221 High, 447 Medium, 377 Low. Top rule types: `secrets-outside-env` (418), `undocumented-permissions` (294), `github-app` (49), `artipacked` (29), `adhoc-packages` (26).
Poutine/runner-guard: 1 medium finding (`RGS-005` excessive permissions on untrusted trigger, `agentic_commands.yml`).
Syft: 9 container images scanned (SBOM generated for each).
Grype: 547 findings — 34 Critical, 172 High, 341 Medium — across the 9 scanned images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`).
Grant: 1250 license-policy violations across all 9 scanned images (strict mode).
Yamllint: 51 files checked, no issues.
Shellcheck: 2905 run-step resources checked; 68 `SC2034` low-severity warnings, all in `.github/graders/*-operational-value.sh` scripts (unused shell variables).

Full raw scanner output (721 KB, 10027 lines) is retained in the run's compiler-security evidence artifact (`report.txt`) for this workflow run; not reproduced inline due to size. No token-like or credential-like values were observed in the reviewed excerpts.

Control plane context

- Correlation ID: `34640660845-1159`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34640660845`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34640660845) · copilot · auto · 57.9 AIC · ⌖ 12.4 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 8:07 PM UTC

Start with the gh-aw compiler run and its report.txt evidence, then inspect the workflow sources under .github/workflows/*.md, especially agentic_commands.yml, and the grader scripts under .github/graders/*-operational-value.sh. Use the gh aw MCP server's fix and compile tools while reviewing generated lock-file diffs. Done means the full compiler and security scan passes without editing generated .lock.yml files.

Written by the indexing model from the issue text.