[aw-doctor:compiler-security] githubnext/gh-aw-cao: compiler + security scan findings (2 actionlint, 41 zizmor High, grype Critical/High CVEs)

Compiling all 45 gh-aw workflows in `githubnext/gh-aw-cao` failed the strict validation suite (compiler exit code 1). Findings: 2 actionlint expression errors, 41 zizmor High-severity `github-app` findings, 1 poutine/runner-guard Medium finding (excessive permissions on untrusted trigger), and grype reports 20 Critical / 119 High / 347 Medium / 54 Low container vulnerabilities across all 9 scanned images (mostly `stdlib`, `brace-expansion`, `tar`, `openssl`/`libssl3`, `bind9-libs`). Grant license scan could not run (missing `.grant.yaml`). Highest severity: Critical CVEs in container base images. Recommended next action: assign remediation to Copilot for the actionlint/zizmor/runner-guard source-level fixes; track container-image CVE remediation separately since those come from upstream `ghcr.io/github/*` and `node:lts-alpine`/`alpine` base images and require upstream image updates, not workflow-source edits.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | `safe-outputs-app-token` step output referenced but not defined in job outputs type | Fix the referenced source `.md` workflow so the `safe-outputs-app-token` step id/output is correctly declared before use, then recompile |
| zizmor | 41 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `dependabot.lock.yml`, `self-care*.lock.yml`, `eu-cra-compliance*.lock.yml`, etc.) | High | `github-app`: dangerous use of `actions/create-github-app-token` for CAO App token minting | Review each flagged step per zizmor's `github-app` audit guidance; if the pattern is an accepted, intentional CAO control-plane pattern, document justification or apply zizmor `# zizmor: ignore[github-app]` only after security review — do not suppress without review |
| poutine/runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an event that can be initiated by external users (e.g. `issue_comment`) | Scope down `permissions:` to least privilege for that trigger, or gate write-permission jobs behind an authorization/activation check |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `node:lts-alpine` | Critical | `CVE-2026-63073`, `CVE-2026-75803`: `libssl3`/`libcrypto3`/`openssl` (fix: 3.5.8-r0) | Bump base image / rebuild upstream image with patched OpenSSL packages |
| grype | `ghcr.io/github/gh-aw-firewall/agent`, `api-proxy`, `cli-proxy` | High | `GHSA-rgw5-rvv9-x895`, `GHSA-mh99-v99m-4gvg`: `brace-expansion` (fix: 5.0.8/5.0.9); `GHSA-r292-9mhp-454m`: `tar` (fix: 7.5.21); `GHSA-mwp4-54f8-5fhr`: `ip-address` (fix: 10.3.1) | Update npm dependencies in upstream `gh-aw-firewall` images |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | High | Multiple `GO-2026-*` Go stdlib/`golang.org/x/crypto` advisories | Rebuild `gh-aw-mcpg` image with a patched Go toolchain/module versions |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical/High | `CVE-2026-75803`, `CVE-2026-5450`: `libssl3`/`libc6`; `GO-2026-5970`: `golang.org/x/text` | Rebuild image on updated Debian base with patched `libc6`/`libssl3` and patched Go module |
| grype | `ghcr.io/github/gh-aw-node`, `node:lts-alpine`, `alpine:latest` | High/Medium/Low | `CVE-2026-66046`, `CVE-2026-76641`: `libexpat` (fix: 2.8.4-r0); assorted `bind9-libs`, `busybox`, `perl` CVEs | Update to latest `node:lts-alpine`/`alpine` base image tags |
| grant | (repo root) | n/a | `grant failed`: missing `.grant.yaml` at repository root | Add a `.grant.yaml` license policy file at the repository root if license scanning is required, or accept this scan is skipped |

Container image findings (grype/syft) originate from upstream base images published outside this repository's `.github/workflows/*.md` sources and cannot be fixed by editing workflow markdown; they require upstream image maintainers to rebuild with patched dependencies.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: two findings (actionlint `safe-outputs-app-token` expression errors in `self-care-dashboard-performance` and `self-care-pages-health`) and the 41 zizmor `github-app` High findings and the 1 poutine/runner-guard `RGS-005` finding in `agentic_commands.yml` are source-fixable; container-image grype/syft findings are upstream base-image issues and should be reported back rather than worked around.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Actionlint summary: 2 issues (2 errors), both `expression`-type, referencing an undefined `safe-outputs-app-token` step output.

Zizmor summary: 45 files checked; 41 High `github-app` findings plus lower-severity `undocumented-permissions` (Low) and `secrets-outside-env` (Medium) informational findings not requiring immediate action.

Poutine/runner-guard: 1 Medium finding (`RGS-005`) in `agentic_commands.yml`.

Syft: scanned 9 container images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`), totaling ~1,730 packages.

Grype: 20 Critical, 119 High, 347 Medium, 54 Low findings across those 9 images. No secret-like or credential-like values were present in tool output; none redacted.

Grant: failed — `.grant.yaml` missing at repository root, so license scanning did not run for this cycle.

Untracked local file: `.poutine.yml` (created by this scan run, not committed).

Control plane context

- Correlation ID: `34184657947-82`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34184657947`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34184921314) · copilot · auto · 46.7 AIC · ⌖ 9.78 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 4:08 AM UTC

Start with the strict compiler and security scan, then read the affected `.github/workflows/*.md` sources, especially the workflows corresponding to the two actionlint errors and `agentic_commands.yml`. Use the gh-aw MCP server's `fix` and `compile` entry points without editing generated `.lock.yml` files. Done means source-level findings are resolved or justified, scans pass, and upstream container findings are reported rather than worked around.

Written by the indexing model from the issue text.