[aw-doctor:compiler-security] Compiler & Security Findings: 2 expression errors, 41 High github-app findings, license/CVE violations across container imag [Co

**Compiler validation failed (exit code 1)** for `githubnext/gh-aw-cao` (45 workflow sources / 45 lock files). Findings span 2 compiler expression-type errors, 41 zizmor High-severity "dangerous GitHub App token" findings, 1250 base-image license-policy violations, and 575 container CVE entries (6 unique Critical, 48 unique High) plus 1 medium runner-guard taint finding. Highest severity: **Critical** — CVE-2026-63073/CVE-2026-75803 (`libssl3`/`libcrypto3`/`openssl`) affecting `alpine`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/squid`, `ghcr.io/github/gh-aw-mcpg`, and `ghcr.io/github/github-mcp-server` — all with available fixed versions. Recommended next action: assign to Copilot to fix the two compiler expression errors and bump/rebuild base images; license-policy violations require human policy review since they are third-party dependency licenses, not code changes.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `[expression]` property `safe-outputs-app-token` not defined in the referenced step-outputs object type | Fix the `.md` source expression referencing `safe-outputs-app-token`; recompile |
| zizmor | 34 workflow lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-*`, `eu-cra-compliance-*`, `self-care-*`) | High (41 findings) | `github-app`: dangerous use of GitHub App tokens | Review each App-token usage per zizmor guidance; scope token minimally or use recommended pattern |
| zizmor | many lock files (393 findings) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block |
| zizmor | `dashboard-authoring-corpus.lock.yml` and others (25) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Avoid persisting credentials in uploaded artifacts |
| zizmor | many lock files (259) | Low | `undocumented-permissions`: permissions without explanatory comments | Add comments explaining each granted permission |
| zizmor | many lock files (267) | Informational | `anonymous-definition`: workflow/action definition without a name | Add `name:` fields |
| zizmor | 3 lock files (25) | Low | `adhoc-packages`: ad-hoc installation of packages | Pin package installs / use lockfiles |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` (9) | Informational | `template-injection`: code injection via template expansion | Use intermediate env vars instead of direct `${{ }}` interpolation in run steps |
| zizmor | 3 lock files (3) | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify flagged expressions |
| grype | `alpine`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/squid`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/github-mcp-server` | Critical (6 unique CVEs) | CVE-2026-63073, CVE-2026-75803 in `libssl3`/`libcrypto3`/`openssl` 3.5.7-r0 | Rebuild/update base images to pull `libssl3`/`libcrypto3`/`openssl` 3.5.8-r0 |
| grype | multiple images | High (48 unique CVE/GHSA) | e.g. CVE-2026-18798, CVE-2026-63076, CVE-2026-14457/14456, GHSA-rgw5-rvv9-x895 (`brace-expansion`), GHSA-r292-9mhp-454m (`tar`), GHSA-mwp4-54f8-5fhr (`ip-address`) | Update affected packages to fixed versions listed in scan output |
| grype | multiple images | Medium (765) | Additional CVEs, mostly with available fixes | Track via routine base-image refresh |
| grant | `gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node` | error (1250 total, license policy) | Third-party OS/npm packages under GPL-2.0/GPL-3.0/LGPL/Artistic/HPND-sell-variant and other licenses flagged by `.poutine.yml` policy (new local `.poutine.yml` untracked in git status) | Requires human license-policy review: confirm policy scope, approve exceptions, or replace disallowed packages |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: job specifies write-level permissions while triggered by an event that can be initiated by external users | Reduce permissions or restrict trigger for this workflow |
| poutine | — | none reported | Poutine ran (no findings surfaced in report beyond the license section) | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Severity totals (zizmor + grype combined, from report.txt bracketed severities):
```
Critical: 20
High: 160
Medium: 765
Low: 341
Informational: 276
```

CVE totals: 575 CVE/GHSA occurrences across 9 scanned container images (`gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, plus base `alpine`/`node:lts-alpine` layers). Full per-package detail (677KB) is retained in the deterministic evidence artifact at `/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt` (not reproduced here in full to bound issue size). No secret-like or token-like values were observed in the excerpted output.

Repository working-tree note: `git-status.txt` shows one untracked file, `.poutine.yml` (new policy config used for the license scan), not yet committed.

Control plane context

- Correlation ID: `34191977552-618`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34191977552`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34191977552) · copilot · auto · 52 AIC · ⌖ 12.4 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 6:08 AM UTC

Start with the affected .github/workflows/*.md sources and the two compiler errors in self-care-dashboard-performance and self-care-pages-health; do not edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, then run the listed validation and security scans. Done means the compiler and scans pass, while any license-policy finding requiring human review is documented and escalated.

Written by the indexing model from the issue text.