[aw-doctor:compiler-security] Compiler & security scan findings across 45 workflows: 2 actionlint errors, critical container CVEs, github-app zizmor findings,

Compiled all 45 GitHub Agentic Workflows in `githubnext/gh-aw-cao` (target sha `85ead3ecf6d0b60165976e959741c4a6138431b2`) with the full gh-aw compiler + lint + scanner suite. Compiler exited `1` (findings). Highest-confirmed severity: **Critical** — grype reports Critical CVEs (CVE-2026-63073, CVE-2026-75803, CVE-2026-5450) in 5 container images (alpine, node:lts-alpine, gh-aw-firewall/squid, gh-aw-mcpg, github-mcp-server). Also: 2 actionlint expression errors (undefined `safe-outputs-app-token` property), 41 zizmor `github-app` High findings (dangerous GitHub App token usage pattern, appears repo-wide), and `grant` failed with 1250 license-policy violations across container images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2283, self-care-pages-health.lock.yml:2189 | error | property `safe-outputs-app-token` not defined in expression object type | Fix the `.md` source expression referencing this undefined output property; regenerate lock file via `gh aw compile` |
| grype | alpine:latest, node:lts-alpine, gh-aw-firewall/squid:0.28.14, gh-aw-mcpg:v0.4.18, github-mcp-server:v1.11.0 | Critical | CVE-2026-63073 / CVE-2026-75803 (libssl3/libcrypto3/openssl, Alpine, fix 3.5.8-r0), CVE-2026-5450 (libc6, Debian) | Bump base images / pin newer digests once upstream publishes patched images; re-run grype until clean |
| grype | multiple images | High (79), Medium (324), Low (54) | Various OS-package CVEs (bind9-libs, etc.) | Track via base-image updates; not immediately actionable beyond image bumps |
| zizmor | aw-doctor, aw-failures-investigator, aw-maintenance-compiler-security, aw-maintenance-upgrade, eu-cra-compliance-supply-chain-sbom-auditor.lock.yml (+more, 41 total) | High | `github-app`: dangerous use of `actions/create-github-app-token` | Review whether the generated App-token step needs narrower scoping/guarding; likely inherited from shared `control.md` — fix at the `.md` source template level |
| zizmor | most workflows | Medium (774 across repo) | `secrets-outside-env`: secrets referenced without dedicated environment | Consider moving secret-consuming steps into a scoped `environment:` |
| zizmor | most workflows | Low (259) | `undocumented-permissions`: permissions blocks lack explanatory comments | Add short comments explaining each `permissions:` scope |
| zizmor | dashboard-authoring-corpus.lock.yml (+similar) | Medium (25) | `artipacked`: credential persistence via uploaded Actions artifacts | Avoid uploading directories containing `.git` credentials as artifacts |
| grant | 9 container images | error | 1250 license-policy violations (many permissive-but-flagged licenses: GPL-2.0/3.0, LGPL, HPND, etc.) across OS/npm packages in images | Review `grant` policy allowlist vs. actual license mix; likely needs policy tuning rather than image changes — human review recommended |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Comment-derived metadata file `agentic_commands.yml` flagged for excessive-permissions-on-untrusted-trigger heuristic (likely a false positive on a static command-list file, not a live workflow) | Verify this file's actual permissions/trigger; if it is not an executable workflow, consider excluding from runner-guard scope |
| compiler | `.poutine.yml` | note | Untracked new file `.poutine.yml` appeared in git status | Verify intended and commit if required by poutine config |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Priority order: (1) fix the 2 actionlint `safe-outputs-app-token` expression errors, (2) address the 41 zizmor `github-app` High findings in the shared control template, (3) evaluate whether the `grant` license-policy failure needs a policy-file change vs. dependency swap — if it requires a genuine license-policy exception decision, stop and explain rather than silently loosening the policy, (4) note that Critical grype CVEs are in third-party base images (alpine, node, gh-aw-firewall, gh-aw-mcpg, github-mcp-server) not owned by this repo — if no newer pinned digest fixes them, stop and explain rather than guessing. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Actionlint:
```
✓ Checked 45 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Grant:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Zizmor severity totals (repo-wide, includes duplicates across 45 workflows sharing templates): Critical 0 (workflow-source), High 160, Medium 774, Low 341, Informational 276, Unknown 81 (container-scanner rows counted separately below).

Grype severity totals (container images): Critical 20, High 79, Medium 324, Low 54.

Runner-guard: 1 Medium finding (`agentic_commands.yml`, RGS-005).

Git status after run: `?? .poutine.yml` (untracked new file, not committed).

No credential-like or token-like values were present in the excerpted output; none reproduced here.

Control plane context

- Correlation ID: `34211716344-88`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34211716344`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34212119873) · copilot · auto · 37.8 AIC · ⌖ 15.9 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 10:08 AM UTC

Start by reading the affected .github/workflows/*.md sources, especially the shared control.md template and the sources for the two safe-outputs-app-token errors, then run the gh aw compiler and full scanner suite. Generated .lock.yml files are outputs and should not be edited directly. Done means the source-level fixes preserve behavior and the compiler, actionlint, zizmor, grant, grype, and related checks pass; findings requiring upstream image or human policy decisions should be reported rather than guessed.

Written by the indexing model from the issue text.