[aw-doctor:compiler-security] Compiler & security scan findings: 2 actionlint errors, container CVEs, license violations, zizmor/runner-guard warnings

Compiler run for `githubnext/gh-aw-cao` exited with code 1 (not clean). 45 workflow sources / 45 lock files checked. Findings by category: 2 actionlint errors (undefined `safe-outputs-app-token` expression), 20 Critical + 160 High container CVEs across 9 scanned images (grype), 1250 license policy violations across container images (grant, strict mode → failed), 1 medium runner-guard finding (RGS-005 excessive permissions on untrusted trigger), and numerous zizmor informational/low/medium findings (secrets-outside-env, undocumented-permissions, anonymous-definition, artipacked, adhoc-packages, template-injection) plus 41 High-severity `github-app` findings for dangerous GitHub App token usage. Poutine reported no findings. Highest-severity supported finding: Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in openssl/libcrypto3/libssl3) in `alpine:latest`, `node:lts-alpine`, and several `ghcr.io/github/gh-aw-firewall/*` images, and CVE-2026-5450 (libc6) plus CVE-2026-75803 (libssl3) in `ghcr.io/github/github-mcp-server:v1.11.0`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step output referenced but not defined in `GIT_TOKEN` expression | Fix the `.md` source generating this step reference/definition mismatch, recompile |
| grype | alpine:latest, node:lts-alpine, gh-aw-firewall/squid:0.28.14, gh-aw-mcpg:v0.4.18 | Critical | CVE-2026-63073, CVE-2026-75803 in libcrypto3/libssl3/openssl 3.5.7-r0 (fix: 3.5.8-r0) | Bump base image / pin newer Alpine tag once fix is published |
| grype | github-mcp-server:v1.11.0 | Critical | CVE-2026-5450 (libc6 2.36-9+deb12u14), CVE-2026-75803 (libssl3 3.0.20-1~deb12u2) | Upgrade upstream `github-mcp-server` image version |
| grype | 9 images total | High (160), Medium (774), Low (341), Negligible (27) | Numerous package CVEs across scanned images | Track via SBOMs; upgrade images as fixes land |
| grant | 9 container images | policy violation (strict) | 1250 license policy findings (e.g. Apache-2.0, BSD-2-Clause, ISC, MIT flagged under strict policy) | Review `grant` policy config; confirm intended license allowlist matches actual dependencies |
| zizmor | many `.lock.yml` (41 occurrences) | High | `github-app`: dangerous use of GitHub App tokens (e.g. `actions/create-github-app-token`) | Review App token scoping/usage per zizmor guidance |
| runner-guard | agentic_commands.yml | Medium | RGS-005: write-level permissions combined with untrusted trigger (issue_comment/pull_request_target-style event) | Restrict permissions or add stricter trigger/authorization gating |
| zizmor | many `.lock.yml` (393 occurrences) | Medium | `secrets-outside-env`: secrets referenced without dedicated environment | Move secret references into scoped `environment:` blocks |
| zizmor | dashboard-authoring-corpus.lock.yml, dependabot-release-train-updater.lock.yml, design-decision-gate.lock.yml | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid persisting credentials to uploaded artifacts |
| zizmor | 259 occurrences | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | optimization-ai-credit-auditor/optimizer, self-care-docs-build-time-investigator | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify expression/feature usage for auditability |
| zizmor | 25 occurrences | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g`) | Pin/vendor via lockfiles where feasible |
| zizmor | pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml, self-care.lock.yml | Informational | `template-injection`: code injection via template expansion | Review expression usage per zizmor guidance |
| zizmor | 267 occurrences | Informational | `anonymous-definition`: workflow/job definitions without a `name` | Add descriptive names (cosmetic, optional) |
| poutine | — | — | No findings reported | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Zizmor severity totals: Critical 20 (container image scan output mixed into report), High 160, Medium 774, Low 341, Informational 276.

Actionlint summary: Checked 45 workflow(s); Found 2 issue(s) (2 error(s)); Issues by type: expression: 2.

Grant summary: `strict mode: grant found 1250 license policy finding(s) in container images` (command failed).

Container images scanned by syft/grype/grant (9 total): `ghcr.io/github/gh-aw-firewall/agent:0.28.14`, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14`, `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.14`, `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.11.0`, `alpine:latest`, `node:lts-alpine`.

No credential-like or token-like values were observed in the evidence; none redacted beyond this note.

Control plane context

- Correlation ID: `34206786796-635`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34206786796`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34206786796) · copilot · auto · 44.6 AIC · ⌖ 8.5 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 9:12 AM UTC

Start with the .github/workflows/*.md sources behind self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, and use the gh aw MCP server's fix and compile tools. Do not edit generated .lock.yml files; review the generated diffs and rerun the listed compiler and security scans until the full run passes, stopping when a finding needs human action.

Written by the indexing model from the issue text.