[aw-doctor:compiler-security] Compiler security findings: gh-aw-cao (45 workflows) — 41 zizmor High, 99 image CVEs, 2 actionlint errors

Compiler exit code 1 on `githubnext/gh-aw-cao`: 45 workflow sources / 45 lock files compiled with findings across 4 categories — 2 actionlint type errors, 41 zizmor High-severity `github-app` findings (dangerous GitHub App token use), 99 High/Critical container vulnerabilities across 9 base images (worst: `gh-aw-firewall/squid` 21 High + 6 Critical, `gh-aw-mcpg` 46 High + 4 Critical), and a `poutine`/`runner-guard` Medium finding on `agentic_commands.yml` (write permissions on an externally-triggerable trigger). `grant` did not run (missing `.grant.yaml`). Highest severity: Critical (image CVEs, e.g. CVE-2026-63073/CVE-2026-75803 in squid's openssl stack). Recommended next action: assign to Copilot to pin/upgrade vulnerable images and add `.grant.yaml`; the `github-app` and RGS-005 findings likely need human review of the shared control workflow design.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `[expression]` property `safe-outputs-app-token` not defined in `outputs` object type | Fix the generator/template that emits this expression reference in the shared control source, then recompile |
| zizmor | 34 workflow lock files (41 occurrences; some files hit twice) | High | `github-app`: dangerous use of GitHub App tokens | Review token scoping/exposure per zizmor docs; likely needs a shared-control fix, not per-workflow patches |
| poutine + runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a workflow triggerable by external users (`pull_request_target`/`issue_comment`-class trigger) | Restrict permissions or gate write access behind trusted-actor checks |
| grant | repo root | unknown (tool failure) | `grant requires .grant.yaml at the repository root` — scanner did not run | Add `.grant.yaml` at repo root or accept license-scan is skipped |
| grype/syft | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical (6), High (21) | OpenSSL/libcrypto/libssl CVEs (e.g. CVE-2026-63073, CVE-2026-75803) plus bind9-libs Medium CVEs | Bump base image / apk packages to patched versions |
| grype/syft | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | Critical (4), High (46) | Largest vulnerable-package surface of all scanned images | Upgrade `gh-aw-mcpg` image tag |
| grype/syft | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical (2), High (6) | Vulnerable dependencies | Upgrade to a patched `github-mcp-server` tag |
| grype/syft | `node:lts-alpine`, `alpine:latest` | Critical (4 each), High (18/14) | Base OS package CVEs | Pin to a more recent patched digest |
| grype/syft | `gh-aw-firewall/agent`, `api-proxy`, `cli-proxy` (0.28.14) | High (4 each) | `brace-expansion`, `tar`, `ip-address` npm advisories | Bump `gh-aw-firewall` image version |
| grype/syft | `ghcr.io/github/gh-aw-node` | High (2) | Vulnerable packages | Upgrade image tag |
| shellcheck | ~14 grader scripts under `.github/graders/*-operational-value.sh` | warning (SC2034) | Unused exported variables (e.g. `WORKFLOW_NAME`, `TITLE_PREFIX`) | Remove unused vars or mark intentional with `# shellcheck disable=SC2034` |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45

Summary counts:
- actionlint: 2 expression errors
- zizmor: 1023 total findings; 41 High (github-app); remainder Low/Medium/Informational (undocumented-permissions, anonymous-definition, secrets-outside-env, adhoc-packages)
- poutine/runner-guard: 1 Medium RGS-005 finding on agentic_commands.yml
- grant: failed — missing .grant.yaml at repo root
- grype (9 images scanned via syft SBOMs): 20 Critical + 160 High findings total
- shellcheck: SC2034 unused-variable warnings across ~14 grader scripts
- yamllint: ran on 45 files, no findings surfaced beyond above
```

Git status after compile (untracked artifact only, no source changes needed to reproduce): `?? .poutine.yml`

Control plane context

- Correlation ID: `34178168660-80`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34178168660

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34178442585) · copilot · auto · 47.7 AIC · ⌖ 9.66 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 2:16 AM UTC

Start with the 45 workflow source files under .github/workflows/*.md and the shared control source referenced by the actionlint findings; do not edit generated .lock.yml files. Inspect agentic_commands.yml, the container image references, .github/graders/*-operational-value.sh, and the repository root for .grant.yaml. Done means the source changes compile cleanly and the listed security and validation scans pass, or unresolved human-review findings are clearly explained.

Written by the indexing model from the issue text.