[aw-doctor:compiler-security] Compiler security scan findings for githubnext/gh-aw-cao (grant strict-mode failure, 39 critical/high CVEs, 49 High zizmor findi

The gh-aw compiler failed strict validation on `githubnext/gh-aw-cao` (exit code 1). Of 51 workflow sources and 51 compiled lock files, the scanner suite reported: 2 actionlint expression errors, 819 zizmor findings (49 High, 447 Medium, 323 Low/Info), 1 poutine/runner-guard medium finding, 39 unique Critical/High CVEs across container images (grype), and 1250 license policy violations across container images (grant, strict mode — the run-terminating failure). No poutine/zizmor errors blocked compilation itself; the hard failures were actionlint's 2 expression errors and grant's strict-mode license policy check. **Recommended next action:** assign the linked issue to Copilot to fix the two actionlint expression bugs and the High-severity github-app/zizmor findings first, then re-evaluate whether container base images can be pinned to lower-CVE/license-compliant tags.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step-output property not defined in referenced object type at `GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || ... }}` | Fix the source `.md` template so the step id/output referenced exists in the generated job, or gate the expression correctly; recompile until actionlint is clean |
| zizmor | aw-doctor.lock.yml, aw-failures-investigator.lock.yml, and 20+ other lock files | High | `github-app`: dangerous use of `actions/create-github-app-token` (49 occurrences) | Review each use for scope/least-privilege; ensure token is short-lived, minimally scoped, and not persisted beyond the job; suppress only if a documented false positive |
| zizmor | aw-doctor.lock.yml and most other lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` (418 occurrences) | Move secret-consuming jobs to use a GitHub Environment, or document why not applicable |
| zizmor | dashboard-authoring-corpus.lock.yml, dependabot-release-train-updater.lock.yml, and others | Medium | `artipacked`: credential persistence through Actions artifacts near checkout/upload steps (29 occurrences) | Ensure `persist-credentials: false` on checkout steps preceding artifact upload |
| zizmor | many lock files | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments (294 occurrences) | Add short comments justifying each permission scope in workflow source templates |
| zizmor | aw-doctor.lock.yml and others | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) (26 occurrences) | Pin/vendor installs or document why ad-hoc install is required |
| zizmor | optimization-ai-credit-auditor.lock.yml, optimization-ai-credit-optimizer.lock.yml | Low | `obfuscation`: obfuscated Actions feature usage (e.g. `${{ '' }}`) (3 occurrences) | Replace with a direct literal value where the expression adds no value |
| runner-guard | agentic_commands.yml | Medium | `RGS-005`: job declares write-level permissions while triggered by `pull_request_target`/`issue_comment`-style event | Confirm command-trigger jobs use minimal read-only default permissions and elevate only in trusted, gated steps |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15`, `cli-proxy:0.28.15` | Critical | `CVE-2026-19931`, `CVE-2026-18924`: Alpine `curl`/`libcurl` 8.21.0-r0 (fix 8.22.0-r0) | Bump base image / package versions to pull patched curl |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.15` | High | `GHSA-rgw5-rvv9-x895`, `GHSA-mh99-v99m-4gvg` (brace-expansion), `GHSA-r292-9mhp-454m` (tar), `GHSA-mwp4-54f8-5fhr` (ip-address) | Update npm dependencies to advised fixed versions in the image build |
| grype | 9 scanned images overall | Critical/High/Medium/Low | 34 Critical, 172 High, 341 Medium, 54 Low findings (39 unique CVE/GHSA IDs) across firewall/agent/proxy/mcp/node/alpine images | Track upstream base-image and dependency updates for each `ghcr.io/github/gh-aw-*` image |
| grant | `node:lts-alpine` and other images | error (strict mode) | 1250 license policy violations (dominant licenses: ISC 365, MIT 285, Apache-2.0 69, GPL-2.0-only 62, BlueOak-1.0.0 55, plus GPL-3.0 variants) | Review grant's license allow-list; either broaden the policy to accept common permissive/GPL licenses already vetted for these images, or exclude affected base images from strict license scanning |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler run summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Sample actionlint error:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2314:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...}
2314 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
```

zizmor rule counts (819 total findings):
```
418 [Medium] secrets-outside-env
294 [Low] undocumented-permissions
49 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
3 [Low] obfuscation
```

runner-guard finding:
```
agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

grype severity counts across 9 scanned images:
```
Critical: 34 High: 172 Medium: 341 Low: 54
```
(39 unique CVE/GHSA identifiers; sample: CVE-2026-19931, CVE-2026-18924 in api-proxy/cli-proxy `curl`/`libcurl`; GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, GHSA-r292-9mhp-454m, GHSA-mwp4-54f8-5fhr in `agent` image npm deps)

grant (license policy, strict mode — run-terminating):
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```
License distribution (top): ISC 365, MIT 285, Apache-2.0 69, GPL-2.0-only 62, BlueOak-1.0.0 55, BSD-2-Clause 32, BSD-3-Clause 22, GPL-3.0-or-later 18.

Uncommitted workflow diff from this compile run (git status): 3 workflow `.md`/`.json` sources and 51 `.lock.yml` files modified, 1 new `.poutine.yml` untracked (448 insertions, 438 deletions across 55 files) — these were compiler-produced local artifacts from this deterministic run and were not committed by this worker.

Control plane context

- Correlation ID: `34655505203-1183`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34655505203`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34655505203) · copilot · auto · 64.5 AIC · ⌖ 8.58 AIC · ⊞ 14.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 11:06 PM UTC

Start with the workflow sources that generate self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, plus agentic_commands.yml, and review the gh-aw MCP server's fix and compile entry points. Recompile with strict validation and the listed security scanners; done means the two actionlint errors and blocking security findings are resolved without editing generated .lock.yml files.

Written by the indexing model from the issue text.