[aw-doctor:compiler-security] Compiler and security scan findings — action needed

The gh-aw compiler failed (exit code 1) on `githubnext/gh-aw-cao` (45 workflow sources, 45 lock files). Findings: 2 actionlint expression errors (invalid `safe-outputs-app-token` references), 41 zizmor High "dangerous use of GitHub App tokens" findings across 34 workflows, 1 poutine/runner-guard medium finding (excessive permissions on untrusted trigger), 12 shellcheck warnings (unused vars in grader scripts), and container vulnerability scans (grype) reporting 20 Critical and 119 High CVEs/GHSAs across 9 base images (alpine, node, gh-aw-firewall, gh-aw-mcpg, gh-aw-node, github-mcp-server). The `grant` license scanner could not run (missing `.grant.yaml`). Highest severity supported finding: grype Critical CVEs in `gh-aw-mcpg`/`gh-aw-firewall/squid` images plus the two blocking actionlint compile errors, which prevent a clean compile.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` property not defined in step-outputs context (invalid expression) | Fix the generating `.md` source's safe-outputs app-token step reference so the compiled expression matches a defined step output; recompile |
| zizmor | 34 workflows (aw-doctor, aw-failures-investigator, aw-maintenance-*, dependabot*, eu-cra-compliance*, optimization*, self-care*, software-development-practices*, uk-ai-advisory*) — 41 occurrences | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scope/lifetime handling per (docs.zizmor.sh/redacted) scope down permissions or add explicit justification |
| poutine / runner-guard | agentic_commands.yml (RGS-005) | Medium | Job specifies write-level `permissions:` while triggered by an untrusted event (`issue_comment`/`pull_request_target`-class trigger) | Reduce to least-privilege permissions for untrusted-trigger jobs |
| shellcheck | 12 grader scripts under `.github/graders/*-operational-value.sh` | warning (SC2034) | Unused variables (WORKFLOW_NAME, SOURCE_PATH, TITLE_PREFIX, DOMAIN, OPERATIONAL_VALUE, OPPORTUNITY, ACCEPTED, METRIC_ID, etc.) | Export or remove unused grader script variables |
| grype | alpine:latest | High/Critical (multiple) | 18 High, several Critical CVEs in base packages | Update/pin alpine base image |
| grype | node:lts-alpine | High/Critical (multiple) | 22 High CVEs | Update node base image |
| grype | ghcr.io/github/gh-aw-mcpg:v0.4.18 | High/Critical (multiple, 50 High) | Largest CVE surface of scanned images | Update gh-aw-mcpg image to a patched version |
| grype | ghcr.io/github/gh-aw-firewall/squid:0.28.14 | High/Critical (27 High) | bind9-libs and related CVEs | Update firewall/squid image |
| grype | ghcr.io/github/gh-aw-firewall/agent:0.28.14 | High (brace-expansion, tar, ip-address GHSAs) | GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, GHSA-r292-9mhp-454m, GHSA-mwp4-54f8-5fhr | Bump vulnerable npm deps (brace-expansion, tar, ip-address) in image |
| grype | ghcr.io/github/gh-aw-firewall/api-proxy, cli-proxy:0.28.14 | High (4 each) | Package CVEs in shared base | Update image |
| grype | ghcr.io/github/gh-aw-node | High (2) | Package CVEs | Update image |
| grype | ghcr.io/github/github-mcp-server:v1.11.0 | High (8) | Package CVEs | Update image |
| grant | (repository) | incomplete | `.grant.yaml` missing at repo root; license scan did not run | Add `.grant.yaml` or run compile without `--grant` if license scanning is not required |

Totals: 20 Critical + 119 High grype findings across 9 images (deduplicated by CVE/GHSA per image); 41 zizmor High findings (all `github-app` rule); 2 actionlint errors; 1 poutine/runner-guard medium finding; 12 shellcheck script warnings.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Full compiler/scanner output: 8021 lines saved at `report.txt` in the deterministic evidence directory (`/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt`), digest `62cadbd58a766bb0b5b06d9d97f0ef101d2c1301fe9b40011f0dda1771ae7241`.
- `git-status.txt`: `?? .poutine.yml` (untracked poutine config generated during scan; no source diffs produced — `diff-stat.txt` empty).
- No token-like or credential-like values were present in the excerpted output.

Control plane context

- Correlation ID: `34181493814-597`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34181493814`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34181493814) · copilot · auto · 42.7 AIC · ⌖ 15.2 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 3:10 AM UTC

Start with report.txt in the cited evidence directory, then inspect the affected .github/workflows/*.md sources and .github/graders/*-operational-value.sh scripts; do not edit generated lock files. Use the gh aw MCP server's fix and compile tools, reviewing image references and scanner output. Done means the full compiler and security scan passes without the listed findings.

Written by the indexing model from the issue text.