[aw-doctor:compiler-security] Compiler security scan: actionlint errors, high-severity zizmor findings, critical container CVEs, and grant misconfiguration

Target `githubnext/gh-aw-cao` compiler run exited **1** (findings). Across 45 workflow sources / 45 compiled locks: 2 actionlint errors (invalid `safe-outputs-app-token` step reference), 41 zizmor High "github-app: dangerous use of GitHub App tokens" findings, 20 Critical + 160 High grype container CVEs across 5 images (`alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/github-mcp-server:v1.11.0`), 1 runner-guard Medium finding (RGS-005 excessive permissions on `agentic_commands.yml`), and a failed `grant` license scan due to a missing `.grant.yaml`. No fix is safe to attempt without human review of the App-token pattern and image pinning strategy.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2283`, `self-care-pages-health.lock.yml:2189` | error | `safe-outputs-app-token` step output referenced but not defined in that job's step map | Fix the source `.md` template so the `GIT_TOKEN` fallback references a step id that actually exists in the compiled job graph; recompile |
| zizmor | 41 lock files (aw-doctor, aw-failures-investigator, aw-maintenance-*, dependabot*, eu-cra-compliance*, optimization*, self-care*, software-development-practices*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` (v3.2.0) in `cao_pre_activation_app_token` step | Review whether the generated App-token step scopes/exposes the token more broadly than needed; confirm intended by design (shared `control.md`) or add zizmor suppression with justification |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18` | Critical | `CVE-2026-63073`/`CVE-2026-75803`: libcrypto3/libssl3/openssl 3.5.7-r0 (fix 3.5.8-r0) | Bump base images / rebuild upstream `gh-aw-firewall` and `gh-aw-mcpg` images with patched Alpine openssl; upstream `alpine:latest`/`node:lts-alpine` need refresh |
| grype | `github-mcp-server:v1.11.0` | Critical | `CVE-2026-5450` (libc6), `CVE-2026-75803` (libssl3 3.0.20) | Update to newer `github-mcp-server` release with patched Debian base |
| grype | `github-mcp-server:v1.11.0`, `gh-aw-mcpg:v0.4.18` | High | Go stdlib CVEs (`GO-2026-6090`, `GO-2026-6089`, `GO-2026-5972`, `GO-2026-5942`, `GO-2026-5026`, `GO-2026-5970`) | Rebuild with Go ≥1.26.6/1.27.0-rc.3 |
| grype | `node:lts-alpine` | High | npm-ecosystem GHSAs: `brace-expansion` (2×), `tar`, `ip-address` | Upgrade base image / bump vulnerable packages |
| runner-guard | `.github/workflows/agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a workflow triggered by an externally-initiable event | Review trigger/permission combination; scope down write permissions or gate by authorization check |
| grant | repository root | n/a | `grant` scan failed: missing `.grant.yaml` | Add `.grant.yaml` at repo root to enable license scanning, or accept the gap is untracked |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Severity distribution across full report: Critical 20, High 160, Medium 765, Low 341, Informational 276.

Actionlint (2 errors):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2189:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Sample zizmor High finding (repeated per workflow with the shared `control.md` App-token step):
```
./.github/workflows/aw-doctor.lock.yml:1512:15: error: [High] github-app: dangerous use of GitHub App tokens
1510 | id: cao_pre_activation_app_token
1511 | if: ${{ env.CAO_GITHUB_APP_ID != '' && env.CAO_GITHUB_APP_PRIVATE_KEY != '' }}
1512 | uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
```

Sample grype Critical findings:
```
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-mcpg:v0.4.18:1:1: error: [Critical] CVE-2026-63073: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/github-mcp-server:v1.11.0:1:1: error: [Critical] CVE-2026-5450: libc6@2.36-9+deb12u14
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
node:lts-alpine:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
```

runner-guard:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

grant:
```
✗ grant failed
grant requires .grant.yaml at the repository root (create it or run compile without --grant)
```

No token-like or credential-like values were found in the tool output beyond public action SHAs and version tags.

Control plane context

- Correlation ID: `34171155497-576`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34171155497`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34171155497) · copilot · auto · 38.2 AIC · ⌖ 8.62 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 12:04 AM UTC

Start with the source .md templates corresponding to self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, plus the shared control.md; do not edit generated locks. Review .github/workflows/agentic_commands.yml and whether the repository needs a root .grant.yaml, then use the gh-aw MCP server's fix and compile tools. Done means the full compiler and security scan passes, or any unsafe App-token or image-pinning decision is documented for human review.

Written by the indexing model from the issue text.