[aw-doctor:compiler-security] gh-aw compiler & container security scan findings: 2 actionlint errors, critical CVEs, 1250 license violations

Compiled all 51 gh-aw workflows in `githubnext/gh-aw-cao` (commit `b97fa5d3`) with the full validation/lint/container/security-scanner suite. The compiler exited non-zero: 2 actionlint expression errors, 1250 container license-policy violations (grant, strict mode), and numerous grype vulnerabilities across 9 container images, including 4 unique **Critical**-severity CVEs (CVE-2026-63073, CVE-2026-75803, CVE-2026-18924/CVE-2026-19931 in curl/libcurl, CVE-2026-5450) repeated across the firewall, mcpg, node, and github-mcp-server images. zizmor also flagged 49 `github-app` (High) findings and 418 `secrets-outside-env` (Medium) findings. Highest-severity supported finding: **Critical** CVE-2026-63073/CVE-2026-75803 (OpenSSL libcrypto3/libssl3, multiple images) and **Critical** CVE-2026-18924/CVE-2026-19931 (curl/libcurl, 4 images) — all have vendor fixes available. Recommended next action: assign this issue to Copilot to update base images/pinned action versions and fix the two actionlint expression errors, then re-run the full compiler/scanner suite before merge.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step output referenced but not defined in the job's step-output type (GIT_TOKEN expression) | Recompile from `.md` sources after upgrading gh-aw compiler / fixing the step-output reference; do not hand-edit the `.lock.yml` |
| grype, grant | alpine:latest, node:lts-alpine, ghcr.io/github/gh-aw-mcpg:v0.4.20, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.15 | **Critical** | CVE-2026-63073, CVE-2026-75803 — OpenSSL `libcrypto3`/`libssl3` ``@3``.5.7-r0 (fix: 3.5.8-r0) | Bump base image / OpenSSL package to a patched build |
| grype | ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.28.15, ghcr.io/github/gh-aw-node | **Critical** | CVE-2026-18924, CVE-2026-19931 — `curl`/`libcurl` ``@8``.21.0-r0 (fix: 8.22.0-r0) | Bump base image / curl package to a patched build |
| grype | ghcr.io/github/github-mcp-server:v1.12.1 | **Critical** | CVE-2026-5450 (`libc6` ``@2``.36-9), CVE-2026-75803 (`libssl3` ``@3``.0.20-1) | Rebuild image on an updated Debian base with patched glibc/OpenSSL |
| grype | ghcr.io/github/gh-aw-mcpg:v0.4.20 | High | GO-2026-6090/6089/5972/5942/5026 — Go stdlib@go1.26.4 (fix: 1.25.13/1.26.6/1.27.0-rc.3) | Rebuild image with a patched Go toolchain |
| grant | node:lts-alpine and other images | High (policy) | 1250 total license-policy violations (strict mode), largely transitive npm packages in `node:lts-alpine` (ISC/MIT/BlueOak/GPL-2.0-only mix) | Review grant's license allow-list; update policy or replace GPL-2.0-only packages (e.g. `scanelf`, `ssl_client`) if disallowed |
| zizmor | 49 workflow lock files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Confirm token scoping is intentional per gh-aw design; document via zizmor ignore if accepted risk |
| zizmor | 49 workflow lock files | Medium | `secrets-outside-env` (418 occurrences): secrets referenced without a dedicated `environment:` | Move secret-referencing jobs into a scoped `environment:` where feasible |
| zizmor | multiple lock files | Medium | `artipacked` (29 occurrences) | Review checkout/artifact steps for credential persistence |
| runner-guard | agentic_commands.yml | Medium (RGS-005) | Job has write-level `permissions:` while triggered by an externally-initiable event (`issue_comment`/`pull_request_target`-class trigger) | Scope down permissions or restrict trigger to trusted actors |

Full raw tool output (721 KB) is condensed in Raw evidence below; only representative rows are shown here.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Command summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
i Issues by type:
• expression: 2
```

grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

zizmor rule counts (across 51 lock files):
```
418 [Medium] secrets-outside-env
302 [Informational] anonymous-definition
294 [Low] undocumented-permissions
49 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

grype critical/high image-count breakdown:
```
Image Critical High
ghcr.io/github/gh-aw-mcpg:v0.4.20 4 48
ghcr.io/github/gh-aw-firewall/squid:0.28.15 10 35
node:lts-alpine 4 18
ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.15 4 18
ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15 4 18
alpine:latest 4 14
ghcr.io/github/gh-aw-node 2 11
ghcr.io/github/github-mcp-server:v1.12.1 2 6
ghcr.io/github/gh-aw-firewall/agent:0.28.15 0 4
```

No token-like or credential-like strings were present in the retained evidence.

Control plane context

- Correlation ID: `34650683121-172`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34650683121`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34651133797) · copilot · auto · 65.1 AIC · ⌖ 9.03 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 10:09 PM UTC

Start with the 51 `.github/workflows/*.md` sources and compile them using the gh-aw MCP server's `fix` and `compile` tools; do not edit generated `.lock.yml` files. Inspect `agentic_commands.yml` and the two self-care workflow sources named in the actionlint findings, then rerun the full compiler and security scanner suite. Done means the compiler exits successfully and the required validation, lint, policy, and vulnerability scans pass.

Written by the indexing model from the issue text.