[aw-doctor:compiler-security] Compiler & Security Scan Findings — 45 Workflows (exit code 1)

githubnext/gh-aw-cao: the gh-aw compiler and its full validation/lint/scanner suite exited with code 1 across all 45 workflow sources (45 lock files). Findings span 2 actionlint expression errors, 41 zizmor High "dangerous use of GitHub App tokens" findings, 1 zizmor Medium artipacked credential-persistence warning (25 occurrences), 393 zizmor Medium secrets-outside-env warnings, 1 runner-guard Medium excessive-permissions warning, 20 Critical + 79 High grype CVEs across container images (mainly `openssl`/`libssl3`/`libcrypto3` in the firewall squid image and stale `alpine`/`node` base images), and a `grant` license-policy failure with 1250 findings. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803) in `ghcr.io/github/gh-aw-firewall/squid:0.28.14`. Recommended next action: assign remediation to Copilot per the agent prompt below.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in expression context | Fix expression referencing undefined `safe-outputs-app-token` field in workflow source |
| zizmor | 41 workflow `.lock.yml` files (e.g. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-compiler-security`, `aw-maintenance-upgrade`, `eu-cra-compliance-vulnerability-handling-auditor`) | High | `github-app`: dangerous use of GitHub App tokens | Review App-token generation/usage steps for scope minimization; follow zizmor guidance |
| zizmor | `dashboard-authoring-corpus.lock.yml` (+ 24 more occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid persisting credentials in uploaded artifacts (e.g. `actions/checkout` with `persist-credentials: false`) |
| zizmor | 45 workflow `.lock.yml` files (393 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block per zizmor guidance |
| zizmor | 45 workflow `.lock.yml` files | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` | Add explanatory comments for `permissions:`, name workflow/job definitions, avoid ad-hoc package installs |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Excessive permissions (write-level) combined with untrusted trigger (`issue_comment`/similar) | Reduce permissions to minimum required for the command-triggered job |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical/High | CVE-2026-63073, CVE-2026-75803, CVE-2026-18798, CVE-2026-63076, CVE-2026-14457, CVE-2026-14456, CVE-2026-63072, CVE-2026-54874, CVE-2026-63075 in `openssl`/`libssl3`/`libcrypto3@3.5.7-r0` | Upgrade base image / packages to `3.5.8-r0` or later |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/github-mcp-server:v1.11.0`, `alpine:latest`, `node:lts-alpine` | High (partial, remainder in raw evidence) | Additional CVEs in `libcrypto3`/`libssl3`/`openssl` and other packages | Rebuild/upgrade referenced images to patched versions |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` | Medium | Multiple CVEs in `bind9-libs`, `perl` (Ubuntu 22.04 packages) | Track for next base-image refresh; no immediate action required at Medium severity |
| grant | 9 scanned container images | error (policy) | 1250 license policy findings (e.g. GPL/LGPL-family licenses in `libnettle8`, `git`, `libxtables12`; also flagged permissive licenses like MIT/ISC in some deps) | Review repository license policy allowlist vs. actual dependencies in firewall/agent images; adjust policy or images |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Bounded excerpts from the deterministic compiler run (`/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt`, 9270 lines total, `reportDigest: 1a2ca0c43a2766673fb1c6d5da722cb894225319c2488a41826b2c33263dc588`):

```
Actionlint Summary
✓ Checked 45 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2

.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2189:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

```
Running runner-guard taint analysis scanner
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

```
Running grype vulnerability scanner on 9 container images
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: openssl@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-75803: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
(20 Critical, 79 High total across scanned images)
```

```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: license policy violation: libnettle8@3.7.3-1build2 (GPL-family)
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: license policy violation: git@1:2.34.1-1ubuntu1.17 (GPL/Apache/Artistic mix)
```

Diff-stat: none (no source changes in this scan run). Git status: one untracked file `.poutine.yml` generated by the scanner (not committed).

Control plane context

- Correlation ID: `34196756522-85`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34196756522`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34197029166) · copilot · auto · 38.9 AIC · ⌖ 8.7 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 7:17 AM UTC

Start with the .github/workflows/*.md sources that generate the reported lock files, especially the workflows corresponding to self-care-dashboard-performance, self-care-pages-health, and agentic_commands.yml. Use the gh-aw MCP server's fix and compile tools, and do not edit generated .lock.yml files. Done means the full compiler and security scan passes, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.