[aw-doctor:compiler-security] Compiler security scan findings — githubnext/gh-aw-cao (45 workflows)

Compiling all 45 workflows in `githubnext/gh-aw-cao` failed (exit code 1) with the full gh-aw validation/lint/security-scanner suite. Findings span 6 categories: 2 actionlint expression errors, 1250 grant license-policy violations across 9 container images, hundreds of grype CVEs (20 Critical, 160 High, 774 Medium) in the same images, 41 zizmor High findings (`github-app` — dangerous GitHub App token usage pattern, same code path repeated across workflows), 1 poutine/runner-guard medium finding (excessive permissions on an untrusted-trigger workflow), plus lower-severity zizmor issues (393 secrets-outside-env, 267 anonymous-definition, 259 undocumented-permissions, 25 artipacked, 25 adhoc-packages, 9 template-injection, 3 obfuscation — mostly informational/low). Highest-severity supported finding: **Critical** CVE-2026-75803 (libssl3/libcrypto3) in `node:lts-alpine` and `alpine:latest` base images used by multiple workflow containers.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step-output property not defined in expression type | Fix step-output reference/dependency in the compiled template so the referenced step ID exists in scope; regenerate via `gh aw compile` |
| grype | `node:lts-alpine`, `alpine:latest`, and 7 other images (gh-aw-firewall/agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server) | Critical (20), High (160), Medium (774), Unknown (81) | Numerous CVEs, e.g. CVE-2026-75803/63073 (libssl3/libcrypto3), GHSA-r292-9mhp-454m (tar), GHSA-mh99-v99m-4gvg (brace-expansion) | Bump pinned base/container image digests to patched releases; re-run grype until clean |
| grant | 9 container images (led by `gh-aw-firewall/agent:0.28.14`) | error | 1250 license-policy violations (GPL-2.0/3.0, LGPL, Artistic, etc. packages not in allow-list) | Review `.poutine.yml`/grant policy allow-list vs. actual dependency licenses in firewall/agent images; update policy or swap non-compliant packages |
| zizmor | `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `aw-maintenance-upgrade.lock.yml`, `dependabot*.lock.yml`, and 36 more (41 files total) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token` step gated only by env-var presence) | Scope/guard App-token creation steps per zizmor's `github-app` guidance (restrict to trusted triggers, dedicated environment) |
| poutine/runner-guard | `agentic_commands.yml` | medium (RGS-005) | Write-level `permissions:` on a workflow reachable via untrusted trigger (`issue_comment`) | Drop to read-only permissions or gate the write-scoped job behind an authorization check |
| zizmor | many lock files | Medium/Low/Informational | `secrets-outside-env` (393), `anonymous-definition` (267), `undocumented-permissions` (259), `artipacked` (25), `adhoc-packages` (25), `template-injection` (9, informational), `obfuscation` (3, low) | Move secrets into dedicated `environment:` blocks; add job `name:`; comment `permissions:` blocks; review artifact-persisted credentials and ad-hoc `npm install -g` steps |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Sample actionlint error:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
```

Sample zizmor `github-app` finding:
```
./.github/workflows/aw-doctor.lock.yml:1512:15: error: [High] github-app: dangerous use of GitHub App tokens
1510 | id: cao_pre_activation_app_token
1511 | if: ${{ env.CAO_GITHUB_APP_ID != '' && env.CAO_GITHUB_APP_PRIVATE_KEY != '' }}
1512 | uses: actions/create-github-app-token@bcd2ba4... # v3.2.0
```

Sample poutine/runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

grype severity totals (this run): Critical 20, High 160, Medium 774, Unknown 81.

grant: `strict mode: grant found 1250 license policy finding(s) in container images` (final line: `✗ grant failed`).

zizmor rule totals (this run): secrets-outside-env 393, anonymous-definition 267, undocumented-permissions 259, github-app 41, artipacked 25, adhoc-packages 25, template-injection 9, obfuscation 3.

No token-like or credential-like values were present in the reviewed output.

Control plane context

- Correlation ID: `34217001270-89`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34217001270`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34217344220) · copilot · auto · 43.2 AIC · ⌖ 10.5 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 11:08 AM UTC

Review the `.github/workflows/*.md` sources and the reported findings in the generated lock files, without editing `.lock.yml` files directly. Start with the gh-aw MCP `fix` and `compile` tools, then rerun the full compiler and security scan suite. Done means all 45 workflows compile cleanly and the required validation, actionlint, zizmor, poutine, runner-guard, grant, grype, and syft checks pass.

Written by the indexing model from the issue text.