[aw-doctor:compiler-security] gh-aw compiler security scan: findings across actionlint, zizmor, runner-guard, grype, grant

Compiled all 52 gh-aw workflow sources and 52 generated lock files in `githubnext/gh-aw-cao` (compiler exit code 1, run not clean). The full validation/lint/container/security-scanner suite reported findings in every category: 78 actionlint issues (76 shellcheck-in-script, 2 expression-type errors), 1153 zizmor findings (51 High, 453 Medium, 332 Low, 317 Informational — the 51 High are all `github-app` dangerous-token-use, one per workflow), 1 runner-guard Medium finding (excessive write permissions on an untrusted-trigger workflow), 198 unique CVEs across 9 scanned container images (34 Critical / 172 High / 313 Medium / 54 Low / 27 Negligible via grype), and a `grant` license-policy failure with 1250 findings (many are plain MIT/ISC/BSD/Apache-2.0 packages misclassified by the current policy, but it also includes real GPL-2.0-only components in `node:lts-alpine`). Highest-severity supported finding: Critical CVEs (e.g. CVE-2026-19931/CVE-2026-18924 in curl/libcurl, CVE-2026-63073/CVE-2026-75803 in openssl/libssl3/libcrypto3, CVE-2026-5450 in libc6) present in the `gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, and `node:lts-alpine` container images used by these workflows. Recommended next action: assign the remediation issue to Copilot to fix workflow-source-fixable items (github-app token usage, secrets-outside-env, runner-guard permissions, shellcheck/actionlint issues) via `gh aw fix`/`gh aw compile`, and separately track base-image updates and the `grant` license-policy tuning, which require maintainer decisions outside workflow source edits.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `52`
- **Generated lock files checked**: `52`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | 76 workflows (shellcheck-in-script) | unknown | SC2034 unused-variable warnings in embedded grader/step scripts (e.g. `WORKFLOW_NAME`, `SOURCE_PATH` in `graders/*.sh`) | Export or remove unused shell variables in the referenced scripts |
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | `safe-outputs-app-token` not defined on job-outputs object type | Fix upstream workflow-source template that emits this step output/reference; recompile |
| zizmor | 51 workflows (one per lock file, e.g. `aw-doctor.lock.yml:1537`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/exposure per zizmor guidance; move token creation behind narrower permissions or a dedicated environment |
| zizmor | 51 workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (422 occurrences total) | Move secret-referencing jobs/steps into a dedicated `environment:` block |
| zizmor | 51 workflows | Low | `undocumented-permissions` (303), `adhoc-packages` (26), `artipacked` (31) | Add explanatory comments to `permissions:` blocks; pin/vendor ad-hoc package installs; review artifact-packing patterns |
| zizmor | multiple | Informational | `anonymous-definition` (308), `obfuscation` (3) | Add explicit `name:` fields to workflow/action definitions |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job declares write-level `permissions:` while triggered by an untrusted event (`pull_request_target`/`issue_comment`-class trigger) | Reduce to read-only permissions for this job or move privileged steps behind an authorization gate |
| grype | `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid` | Critical | CVE-2026-19931, CVE-2026-18924 in curl/libcurl@8.21.0-r0 (fix: 8.22.0-r0) | Bump base image / rebuild with patched Alpine packages |
| grype | `gh-aw-firewall/squid`, `gh-aw-mcpg`, `alpine:latest`, `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803 in libcrypto3/libssl3/openssl@3.5.7-r0 (fix: 3.5.8-r0) | Bump base image to a build including OpenSSL 3.5.8-r0 |
| grype | `github-mcp-server:v1.12.1` | Critical | CVE-2026-5450 (libc6), CVE-2026-75803 (libssl3) on Debian base | Track upstream `github-mcp-server` image update; no source-level fix available |
| grype | 9 images total | High/Medium/Low/Negligible | 198 unique CVEs across all scanned images (172 High, 313 Medium, 54 Low, 27 Negligible) | See raw evidence; prioritize Critical/High first via image bumps |
| grant | `node:lts-alpine` (and other images) | error | 1250 license-policy findings, dominated by common MIT/ISC/BSD/Apache-2.0/BlueOak-1.0.0 packages plus real `libapk`/`ssl_client` (GPL-2.0-only) | Maintainer should review/tune the `grant` license allow-list policy; confirm GPL-2.0-only components are acceptable or excluded from the shipped image |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 52
Compiled locks: 52
```

Actionlint: 78 issues (76 shellcheck, 2 expression). Zizmor: 1153 findings across 52 files (51 High / 453 Medium / 332 Low / 317 Informational). Runner-guard: 1 Medium finding (RGS-005 in `agentic_commands.yml`). Syft: scanned 9 container images (567/193/347/63/288/177/41/16/165 packages respectively). Grype: 198 unique CVEs (34 Critical / 172 High / 313 Medium / 54 Low / 27 Negligible). Grant: strict-mode license-policy failure with 1250 findings.

Full raw tool output (`report.txt`, 755 KB / 10,639 lines) is retained in the workflow's evidence artifact for this run; no token-like or credential-like values were observed in the scanned excerpts above.

Control plane context

- Correlation ID: `34723672905-1240`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34723672905`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34723672905) · copilot · auto · 47 AIC · ⌖ 9.44 AIC · ⊞ 12.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 26, 2026, 11:05 PM UTC

Start with the retained report.txt evidence and the 52 .github/workflows/*.md sources; do not edit generated .lock.yml files. Inspect graders/*.sh, agentic_commands.yml, and the self-care workflow sources, then run gh aw compile with the listed validation and security scanners. Done means workflow-source findings are resolved and the full scan passes, with maintainer decisions documented for image CVEs and grant policy findings.

Written by the indexing model from the issue text.