[aw-doctor:compiler-security] gh-aw compiler & security scan findings across 51 workflows (grant license policy, zizmor, grype)

The gh-aw compiler and its full lint/security suite found real issues in **githubnext/gh-aw-cao** (51 workflow sources, 51 compiled locks). Compiler exit code 1 was caused by `grant` failing its strict license policy (1250 findings across all 9 scanned container base images), with additional actionlint errors (2), zizmor security findings (49 High `github-app`, plus Medium/Low/Info), a runner-guard Medium taint warning, 646 grype container CVEs (34 Critical), and 69 Low shellcheck SC2034 warnings in grader scripts. Poutine and yamllint reported no findings. Highest-severity supported finding: **Critical** grype CVEs (e.g. `CVE-2026-19931`, `CVE-2026-18924`, `CVE-2026-63073`, `CVE-2026-75803`) in `curl`/`libcurl`/`openssl` packages inside `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `alpine:latest`, and `node:lts-alpine`. Recommended next action: assign to Copilot to update pinned base image digests, bump the App-token action reference flagged by zizmor, and clean up SC2034 grader script warnings; the license policy findings for `grant` need a maintainer decision (they mostly affect vendored base-image packages, not first-party code) since the scanner cannot auto-remediate third-party package licensing.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token.outputs.token` referenced but step id not defined in that job's step outputs | Fix the source `.md` template so the `GIT_TOKEN` expression only references step ids that exist in the compiled job, then recompile |
| zizmor | 49 lock files (`aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, and others) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` (v3.2.0) | Review App-token usage per zizmor's `github-app` guidance; scope/rotate as recommended, pin to a reviewed SHA |
| zizmor | 418 occurrences across most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret-dependent jobs into a declared GitHub Environment |
| zizmor | 29 occurrences | Medium | `artipacked`: credential persistence through Actions artifacts (e.g. checkout before artifact upload) | Ensure `actions/checkout` runs with `persist-credentials: false` or reorder steps per zizmor docs |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent@0.85.1`) | Pin/vendor installs through a reviewed dependency manifest where feasible |
| zizmor | 294 occurrences | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add comments justifying each granted permission |
| zizmor | 302 occurrences | Informational | `anonymous-definition` | No action required (informational) |
| zizmor | 9 occurrences | Informational | `template-injection` | Review flagged expressions for injection risk; informational only |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` combined with an untrusted trigger (`pull_request_target`/`issue_comment`-style) | Reduce permissions to read-only for the untrusted-trigger job or move privileged steps to a separate, trusted-trigger job |
| grype | `gh-aw-firewall/api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `alpine:latest`, `node:lts-alpine` | Critical | `CVE-2026-19931`, `CVE-2026-18924` (curl/libcurl), `CVE-2026-63073`, `CVE-2026-75803` (openssl/libssl3/libcrypto3), `CVE-2026-5450` (glibc in `github-mcp-server`) | Bump pinned image digests to versions carrying the fixed package builds (e.g. curl 8.22.0-r0, openssl 3.5.8-r0) |
| grype | multiple images | High | 172 findings incl. `GHSA-rgw5-rvv9-x895`/`GHSA-mh99-v99m-4gvg` (`brace-expansion`) and numerous CVE-2026-* entries in `bind9-libs`, `python3.10`, `curl` stacks | Update base images / vendored npm deps to patched versions |
| grype | multiple images | Medium/Low/Negligible | 341/54/27 additional package CVEs, mostly in Ubuntu/Alpine base packages | Track via image update cadence; no first-party code change needed |
| grant | all 9 scanned images | error (strict mode) | 1250 license policy violations (GPL/LGPL/CC-BY/ad-hoc licenses in vendored OS and npm packages) | Requires maintainer license-policy decision; not auto-fixable by editing workflow sources |
| shellcheck | 16 `.github/graders/*-operational-value.sh` scripts | Low (SC2034) | Environment variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) assigned but appear unused | Add `# shellcheck disable=SC2034` with justification, or export the variables if consumed externally |
| poutine | — | none | No findings | — |
| yamllint | — | none | No findings | — |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary: checked 51 workflow(s), found 2 issue(s) (2 expression errors).

Zizmor: 51 files scanned; findings grouped by rule above (total 1130 finding lines).

Poutine: 0 findings. Runner-guard: 1 Medium finding (RGS-005) in `agentic_commands.yml`.

Syft: SBOMs generated for 9 images (`gh-aw-firewall/agent` 567 pkgs, `api-proxy` 193, `cli-proxy` 347, `squid` 63, `gh-aw-mcpg` 288, `gh-aw-node` 177, `github-mcp-server` 41, `alpine:latest` 16, `node:lts-alpine` 165).

Grype: 646 total finding lines (341 Medium, 172 High, 54 Low, 34 Critical, 27 Negligible, 18 Unknown) across the 9 images.

Grant: strict mode reported 1250 license policy findings across the same 9 images, causing the overall compiler exit code 1.

Yamllint: 51 files, 0 findings. Shellcheck: 2905 run-step resources scanned; 69 SC2034 "appears unused" warnings, all in `.github/graders/*-operational-value.sh` files.

No secret-like or token-like values were present in the raw tool output reviewed for this report.

Control plane context

- Correlation ID: `34645709337-171`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34645709337

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34646078444) · copilot · auto · 67.8 AIC · ⌖ 6.96 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 9:08 PM UTC

Start with the affected .github/workflows/*.md sources, especially the templates for self-care-dashboard-performance and self-care-pages-health, then review agentic_commands.yml and the .github/graders/*-operational-value.sh scripts. Run the gh-aw compiler and its full security suite against the 51 workflows and 9 images. Done requires the reported findings to be resolved or a maintainer decision documented for license-policy findings.

Written by the indexing model from the issue text.