[aw-doctor:compiler-security] Compiler and security scan findings across all workflows

Compiling all 51 gh-aw workflows in `githubnext/gh-aw-cao` (target SHA `c2cde1c0e7c90de0a946c24e714a45cb08741287`) with the full validation, lint, container, and security-scanner suite failed (`gh aw compile` exit code 1). Findings: 2 actionlint expression errors, 819 zizmor findings (5 Critical/High-severity `github-app` unsafe-token-use across 41 lock files, plus Medium `secrets-outside-env`/`artipacked` and Low `adhoc-packages`/`obfuscation` noise), 1 poutine/runner-guard Medium warning, ~1,507 grype CVEs in 9 container images (34 Critical, 130+ High, remainder Medium/Low), and 1,250 `grant` license-policy violations (blocking in strict mode). Highest-severity supported finding: Critical CVEs (e.g. CVE-2026-19931, CVE-2026-18924 in curl/libcurl, CVE-2026-63073 in libssl3/libcrypto3) in the `gh-aw-firewall` container images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `steps.safe-outputs-app-token` referenced but not defined in step outputs object | Fix the workflow source generating these steps so the referenced step id/output exists, then recompile |
| zizmor | 41 lock files (aw-doctor, aw-failures-investigator, cao-evolution*, eu-cra-compliance*, optimization*, self-care*, software-development-practices*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Review app-token scoping/lifetime per zizmor guidance; restrict token permissions and job scope |
| zizmor | most lock files | Medium | `secrets-outside-env` (418 findings): secrets referenced without a dedicated `environment:` | Move secret-consuming jobs/steps into a dedicated `environment:` block |
| zizmor | dashboard-authoring-corpus, dependabot-release-train-updater, others | Medium | `artipacked` (29 findings): checkout credential persistence risk with artifact upload after checkout | Set `persist-credentials: false` on `actions/checkout` before artifact upload steps, or scrub `.git` before upload |
| zizmor | multiple lock files | Low | `adhoc-packages` (26), `obfuscation` (3): ad-hoc package installs / obfuscated Action expression usage | Pin installs via lockfiles where feasible; simplify obfuscated expressions flagged by zizmor |
| poutine / runner-guard | agentic_commands.yml | Medium (RGS-005) | Job has write-level permissions while triggered by a comment/PR-target style event | Reduce permissions to read-only or restrict command triggers per runner-guard guidance |
| grype | ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15, cli-proxy:0.28.15 | Critical | CVE-2026-19931, CVE-2026-18924: curl/libcurl (fix: 8.22.0-r0) | Rebuild firewall images on a base with patched curl/libcurl |
| grype | ghcr.io/github/gh-aw-firewall/squid:0.28.15 | Critical | CVE-2026-63073: libssl3/libcrypto3 (fix: 3.5.8-r0) | Rebuild squid image on patched OpenSSL base |
| grype | 9 container images (agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, alpine, node:lts-alpine) | Critical/High | ~1,507 total CVEs (34 Critical, 130+ High CVE-*, plus GHSA-*/GO-* advisories) across OS packages, Go modules, and npm dependencies | Update/rebuild all 9 base images to latest patched releases; re-run grype until clean |
| grant | all 9 container images | error (strict) | 1,250 license-policy violations (GPL/LGPL/OpenLDAP/custom-licensed packages present in strict-mode policy) | Either adjust the `grant` license allowlist/policy for these known base-image packages or replace/trim images to remove disallowed-license packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Actionlint summary:** Checked 51 workflows, found 2 issues (2 errors, both `expression` type).

**Zizmor summary:** 51 files scanned; 819 total findings — 49 `github-app` (High), 418 `secrets-outside-env` (Medium), 294 `undocumented-permissions` (Low/info), 29 `artipacked` (Medium), 26 `adhoc-packages` (Low), 3 `obfuscation` (Low).

**Poutine/runner-guard:** 1 Medium finding (RGS-005 excessive permissions on untrusted trigger) in `agentic_commands.yml`.

**Grype:** 9 images scanned (agent 342 findings, api-proxy 34, cli-proxy 33, squid 54, gh-aw-mcpg 84, gh-aw-node 18, github-mcp-server 26, alpine 23, node:lts-alpine 32). 34 Critical, 130+ High CVE-prefixed, plus GHSA-*/GO-* advisories, remainder Medium/Low.

**Grant:** Strict mode failed with 1,250 license-policy findings across all 9 images (mostly GPL/LGPL-family and OpenLDAP/custom licenses in OS packages, plus a handful of ISC/ Apache-2.0/MIT/BSD entries flagged by policy).

**Yamllint/shellcheck:** No yamllint findings reported. Shellcheck flagged SC2034 (unused variable) warnings in ~16 `graders/*-operational-value.sh` scripts (unused `WORKFLOW_NAME`, `SOURCE_PATH`, etc. — likely intentional template variables).

No credential-like values were present in the raw tool output; none were redacted.

Control plane context

- **Correlation ID**: 34664062763-1194
- **Central repository**: githubnext/gh-aw-cao
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/34664062763

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34664062763) · copilot · auto · 54.6 AIC · ⌖ 7.99 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 26, 2026, 1:30 AM UTC

Start with the .github/workflows/*.md sources and the two workflows named in the actionlint findings, then run gh aw compile rather than editing generated .lock.yml files. Use the gh-aw MCP server's fix and compile entry points and review the generated lock-file diffs. Done means the full validation, security, license, and container scan suite passes without unresolved findings.

Written by the indexing model from the issue text.