[aw-doctor:compiler-security] Compiler exit 1: actionlint expression errors, zizmor github-app findings, grype/grant container security failures

Compiling all 45 gh-aw workflows in `githubnext/gh-aw-cao` failed with exit code 1. Findings span 4 categories: 2 actionlint expression errors, 35 zizmor High-severity `github-app` findings, 9 container images with grype High-severity Go stdlib CVEs, and grant reporting 1250 container-image license policy violations (strict-mode failure). Highest severity: zizmor `[High] github-app` (dangerous use of GitHub App tokens) across 35 lock files, tied with grype `[High]` Go stdlib vulnerabilities in `ghcr.io/github/gh-aw-mcpg:v0.4.18`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | `steps.safe-outputs-app-token` referenced but not defined as a step output in that job context | Fix the Markdown workflow source's `GIT_TOKEN` expression/step id so the referenced step output actually exists, then recompile |
| zizmor | 35 lock files (e.g. `aw-doctor.lock.yml`, `dependabot.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care-*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens | Review token-minting steps per zizmor's `github-app` audit guidance; scope/rotate App tokens and avoid unsafe reuse patterns |
| zizmor | `eu-cra-compliance-vulnerability-handling-auditor.lock.yml` (representative; recurs across compliance workflows) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block per zizmor guidance |
| zizmor | multiple compliance workflows | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` | Add explanatory comments to `permissions:`, name workflow/job definitions, avoid ad-hoc package installs |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` combined with an externally-triggerable event (`pull_request_target`/`issue_comment`-class trigger) | Reduce permissions to least privilege or move the write-requiring steps to a separate, non-externally-triggered job |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | High | 15 unique Go stdlib CVEs (GO-2026-4970, 5026, 5037, 5039, 5856, 5932, 5942, 5970, 5972, 6089, 6090, 6091, 6218, 6354, 6355) — fixed in Go 1.25.13/1.26.6/1.27.0-rc.3 | Rebuild/upgrade the `gh-aw-mcpg` base image to a Go release ≥ the listed fix versions |
| grant | `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*` (agent, api-proxy, cli-proxy, squid), `alpine:latest` | error | 1250 license policy violations across container images (dominant licenses: ISC 365, MIT 285, Apache-2.0 69, GPL-2.0-only 62, BlueOak-1.0.0 55, BSD-2-Clause 32; also GPL/LGPL copyleft licenses present) | Review `.grant.yml`/license policy against actual base-image package licenses; either adjust policy for accepted permissive licenses or replace/rebuild images to avoid disallowed copyleft packages |

Poutine reported no findings in this run (clean).

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary: 45 workflow sources, 45 compiled locks, total size 6.6 MB, 267 jobs, 5669 steps.

Actionlint summary: checked 45 workflow(s), found 2 issue(s) (2 error(s), category: expression).

```
.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
2283 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
.github/workflows/self-care-pages-health.lock.yml:2189:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

grype summary: scanned 9 container images (agent, api-proxy, cli-proxy, squid ``@0``.28.14; gh-aw-mcpg v0.4.18; gh-aw-node; github-mcp-server v1.11.0; alpine:latest; node:lts-alpine); only `gh-aw-mcpg:v0.4.18` reported High vulnerabilities (Go stdlib CVEs listed above, duplicated across go1.26.3/go1.26.4 layers).

grant summary: `strict mode: grant found 1250 license policy finding(s) in container images` — run exited non-zero (`✗ grant failed`). Top license tags by frequency: ISC (365), MIT (285), Apache-2.0 (69), GPL-2.0-only (62), BlueOak-1.0.0 (55), BSD-2-Clause (32), GPL-3.0-or-later (18), GPL-2.0-or-later (15), LGPL-2.1-or-later (14). Long tail of multi-license package combinations also present (hundreds of distinct license-string combinations).

git status after run: `?? .poutine.yml` (untracked file left by the deterministic step; not a code finding).

Control plane context

- Correlation ID: `34201274800-630`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34201274800

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34201274800) · copilot · auto · 44.4 AIC · ⌖ 8.7 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 8:08 AM UTC

Start with the compiler and security scan output, then inspect the affected .github/workflows/*.md sources, especially agentic_commands.yml and the sources for the two actionlint failures. Use the gh-aw MCP server's fix and compile tools rather than editing generated .lock.yml files. Done means strict compilation and the listed actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft checks pass.

Written by the indexing model from the issue text.