[aw-doctor:compiler-security] Compiler/security scan findings: 78 lint issues, Critical/High CVEs, and license-policy violations across all 52 workflows

Compiling all 52 workflows in `githubnext/gh-aw-cao` at `36f36876` succeeded, but the full validation/lint/container/security suite failed (exit code 1). Findings span actionlint (78 issues: 2 expression, 76 shellcheck), zizmor (51 High "dangerous use of GitHub App tokens" plus Medium/Low/Info style findings across all 52 lock files), grype (34 Critical / 223 High CVEs in 9 scanned container images, mostly OpenSSL/libssl/libcrypto CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931 and Node.js supply-chain packages), and grant (1250 license-policy findings across container images, `strict mode` failure). No poutine findings and runner-guard reported 1 Medium finding (`RGS-005` on `agentic_commands.yml`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `52`
- **Generated lock files checked**: `52`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` not defined in `needs.*.outputs` object type | Fix the `.md` source's step-output reference/typo so the referenced output key matches what the upstream job actually emits |
| actionlint (shellcheck, SC1003) | 19 lock files incl. aw-doctor.lock.yml, eu-cra-compliance*.lock.yml, self-care-*.lock.yml, software-development-practices*.lock.yml, uk-ai-advisory*.lock.yml | error | "Want to escape a single quote?" in an embedded example string (`echo 'This is how it'\''s done'`) inside generated Bash heredocs | Locate the shared prompt/template text containing that example and properly escape the embedded single quote, then recompile |
| zizmor | 51 of 52 lock files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/usage per zizmor's `github-app` audit guidance; likely a shared control/activation template pattern |
| zizmor | all 52 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Add a dedicated GitHub Environment for jobs referencing secrets, or accept as a known/suppressed pattern |
| zizmor | all 52 lock files | Low/Info | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` | Add explanatory comments to `permissions:` blocks, name workflow/job definitions, prefer pinned package installs |
| runner-guard | agentic_commands.yml | Medium (RGS-005) | Job has write-level `permissions:` while triggered by `issue_comment`/`pull_request_review_comment` (untrusted trigger) | Narrow `permissions:` to least privilege for the untrusted-trigger job, or gate write steps behind an authorization check |
| grype | alpine:latest, node:lts-alpine, gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, gh-aw-mcpg, gh-aw-node, github-mcp-server | Critical (5 unique CVEs) / High (223) / Medium (766) / Low (386) / Unknown (18) | OpenSSL/libssl/libcrypto CVE-2026-63073, CVE-2026-75803 (Critical); curl/libcurl CVE-2026-18924, CVE-2026-19931 (Critical, firewall images); Node ecosystem High findings incl. `brace-expansion`, `tar`, `ip-address` GHSAs in `node:lts-alpine` | Rebuild/repin base images (alpine, node:lts-alpine) to patched releases and bump firewall/mcpg image tags to versions built on updated bases |
| grant (license scanner) | all 9 scanned container images | error | 1250 license-policy violations (strict mode failure), e.g. `gcc-12-base` (GPL-2.0-or-later + others) in `gh-aw-firewall/agent` | Review `grant` policy allow-list vs. actual base-image licenses; either adjust policy to accept common base-OS license combinations or swap base images |
| poutine | — | — | No findings reported | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary:
```
✓ Checked 52 workflow(s)
⚠ Found 78 issue(s) (78 error(s))
Issues by type:
• expression: 2
• shellcheck: 76
```

Grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Sample zizmor High finding:
```
./.github/workflows/aw-doctor.lock.yml:1537:15: error: [High] github-app: dangerous use of GitHub App tokens ((docs.zizmor.sh/redacted)
```

Sample shellcheck finding:
```
.github/workflows/aw-doctor.lock.yml:1040:9: error: [shellcheck] shellcheck reported issue in this script: SC1003:info:37:839: Want to escape a single quote? echo 'This is how it'\''s done'
```

Sample expression finding:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2339:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
```

Sample grype Critical finding:
```
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
```

Full report: 10,639 lines (52 workflow sources, 52 lock files, 9 scanned container images). Report digest: `cceaaab6220e8babe7733384cb5f85076a856c378cf96a61fe97c8f9ac3ce735`. No tokens or credential-like values were present in tool output.

Control plane context

- Correlation ID: `34717953318-195`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34717953318`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34718183235) · copilot · auto · 69.5 AIC · ⌖ 7.32 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 26, 2026, 9:10 PM UTC

Start with the `.github/workflows/*.md` sources and the reported `agentic_commands.yml` entry, then use the `gh aw` MCP server's `fix` and `compile` tools rather than editing generated `.lock.yml` files. Re-run the full compiler, lint, security, license, and container scan suite; done means all findings are resolved or any requiring human action is clearly reported.

Written by the indexing model from the issue text.