[aw-doctor:compiler-security] 51-workflow compile clean but strict scan finds High zizmor github-app, Critical grype CVEs, and grant license-policy failures

Compiling all 51 gh-aw workflows in `githubnext/gh-aw-cao` succeeded (all 51 sources produced lock files), but the compiler's strict validation and security-scanner suite reported findings across five categories: **2 actionlint expression errors**, **49 High-severity zizmor `github-app` findings** (plus 418 Medium `secrets-outside-env`, 29 Medium `artipacked`, and lower-severity informational/low findings) across 41 lock files, **1 Medium runner-guard finding** (excessive permissions on untrusted trigger in `agentic_commands.yml`), **34 Critical / 172 High grype container CVEs** (201 unique CVEs across 9 images — most critical items are outdated `curl`/`libcurl`, `openssl`/`libssl3`/`libcrypto3`, and `libc6` in the firewall/mcpg/node/github-mcp-server/alpine images), and **1250 grant license-policy violations** driven by license-allowlist gaps (GPL-2.0-only, GPL-3.0-or-later, and similar copyleft licenses flagged in `node:lts-alpine` and other images) that caused `grant` to fail and the overall run to exit non-zero. Highest-severity supported finding: Critical CVE-2026-63073/CVE-2026-75803 (OpenSSL) and CVE-2026-18924/CVE-2026-19931 (curl) present in multiple base/firewall images, plus 49 High zizmor `github-app` dangerous-token-use findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `steps.safe-outputs-app-token` referenced but not a declared step output in the job's `needs` context (undefined property) | Fix the safe-outputs app-token step reference or job dependency in the `.md` source so the generated step id/output matches |
| zizmor | 41 lock files (aw-doctor, aw-failures-investigator, aw-maintenance-*, cao-evolution*, dependabot*, eu-cra-compliance*, optimization*, self-care*, software-development-practices*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Scope token permissions/expression usage per zizmor guidance; review token exposure in downstream steps |
| zizmor | 418 occurrences, most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a step/job `env:` block instead of inline expressions |
| zizmor | 29 occurrences | Medium | `artipacked`: risky artifact/credential persistence pattern | Review artifact upload/checkout steps for credential persistence |
| zizmor | 302 occurrences | Informational | `anonymous-definition`: workflow/job without a `name:` | Add descriptive `name:` fields (cosmetic, low priority) |
| zizmor | 294 occurrences | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml, self-care.lock.yml (9 total) | Informational | `template-injection`: code injection via template expansion | Review flagged expressions for untrusted input interpolation |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g`) | Pin/vendor installs where feasible |
| zizmor | optimization-ai-credit-auditor/optimizer.lock.yml, self-care-docs-build-time-investigator.lock.yml | Low | `obfuscation`: obfuscated GitHub Actions usage | Review flagged expressions for clarity |
| runner-guard | agentic_commands.yml | Medium | RGS-005: write-level `permissions:` on a job reachable by untrusted `pull_request_target`/`issue_comment`-style trigger | Restrict write permissions or gate them behind trusted-actor checks |
| grype | 9 container images (201 unique CVEs) | Critical (34), High (172) | Outdated `curl`/`libcurl` (CVE-2026-18924, CVE-2026-19931), `openssl`/`libssl3`/`libcrypto3` (CVE-2026-63073, CVE-2026-75803), `libc6` (CVE-2026-5450) in firewall/mcpg/node/github-mcp-server/alpine base images | Bump pinned base/tool image digests to versions with patched packages |
| grant | 9 container images | error (strict mode) | 1250 license-policy violations (predominantly ISC, MIT, Apache-2.0 flagged plus GPL-2.0-only/GPL-3.0-or-later/LGPL copyleft licenses) in `node:lts-alpine` and related images | Update the grant license allowlist/policy to reflect accepted licenses, or replace non-compliant dependencies in the affected base images |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiled 51 workflow sources into 51 lock files. Exit code 1 due to `grant` strict-mode failure (1250 license policy findings) after actionlint (2 errors), zizmor (49 High / 447 Medium / 323 Low / 311 Informational), runner-guard (1 Medium), and grype (34 Critical / 172 High / 341 Medium / 54 Low / 27 Negligible across 570 total / 201 unique CVEs) all ran to completion. No token-like or credential-like values were present in the scanned output.

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type: expression: 2
```

Grant failure line:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Full per-tool detail (redacted of any secrets) is available in the workflow run's deterministic compiler-security evidence artifacts (`report.txt`, `summary.txt`, `exit-code.txt`) for this run.

Control plane context

- Correlation ID: `34659311647-1187`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34659311647`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34659311647) · copilot · auto · 52.8 AIC · ⌖ 7.78 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 26, 2026, 12:06 AM UTC

Start with the .github/workflows/*.md sources and run the gh aw MCP server's compile tool with strict validation; use the actionlint findings for self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml as entry points, without editing generated locks. Done means the full compiler and security suite passes, including actionlint, zizmor, runner-guard, grant, grype, and syft, with reviewed generated lock-file diffs.

Written by the indexing model from the issue text.