[aw-doctor:compiler-security] Compiler and security scan findings for githubnext/gh-aw-cao (45 workflows)

Compiling all 45 workflow sources (45 generated locks) in `githubnext/gh-aw-cao` with the full gh-aw validation/lint/container/security suite failed (exit code 1). Findings: 2 actionlint expression errors, 160 zizmor High-severity findings (41 distinct `github-app` "dangerous use of GitHub App tokens" occurrences across 35 lock files) plus numerous Low/Medium/Informational zizmor findings, 1 poutine Medium finding (`RGS-005` excessive permissions on untrusted trigger in `agentic_commands.yml`), and 1250 grant license-policy violations plus ~1868 grype vulnerability findings (many High-severity CVEs, e.g. libssl3/libcrypto3 CVE-2026-14456/14457/18798/54874/63072/63075/63076, GHSA-mh99-v99m-4gvg in brace-expansion, GHSA-r292-9mhp-454m in tar) across 9 scanned container images. Highest-severity supported finding: zizmor High `github-app` (dangerous GitHub App token usage), recurring in 35 workflow lock files. **Result: findings.**

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `property "safe-outputs-app-token" is not defined` (expression type error) | Fix the source `.md` expression referencing `safe-outputs-app-token`; recompile |
| zizmor | 35 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `uk-ai-advisory.lock.yml`, ...) | High | `github-app`: dangerous use of GitHub App tokens (41 occurrences) | Review `actions/create-github-app-token` usage; scope/guard token generation per zizmor guidance |
| zizmor | Many lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block |
| zizmor | Many lock files | Low | `undocumented-permissions`, `adhoc-packages` | Add comments explaining `permissions:`; avoid ad-hoc package installs |
| zizmor | Many lock files | Informational | `anonymous-definition`: workflow/job without a `name:` | Add descriptive `name:` fields |
| poutine | `agentic_commands.yml` | Medium | `RGS-005`: excessive write permissions on an untrusted-trigger workflow | Restrict `permissions:` or gate write scopes behind trusted triggers |
| grype | `ghcr.io/github/gh-aw-firewall/*:0.28.14`, `node:lts-alpine`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/github-mcp-server:v1.11.0`, `alpine:latest`, `ghcr.io/github/gh-aw-node` (9 images total) | High/Medium/Low | ~1868 total findings; High CVEs include CVE-2026-14456/14457/18798/54874/63072/63075/63076 (libssl3/libcrypto3/openssl), GHSA-mh99-v99m-4gvg & GHSA-rgw5-rvv9-x895 (brace-expansion), GHSA-r292-9mhp-454m (tar), multiple `GO-2026-*` stdlib/golang.org/x advisories | Rebuild/pull updated base images with patched packages; bump vulnerable npm/go dependencies |
| grant | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` and other images | error | 1250 license policy violations (GPL/LGPL/MPL and other non-allowlisted licenses in transitive OS/npm packages) | Review license allowlist policy vs. actual base image contents; update `.poutine.yml`/grant policy or swap dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Actionlint summary:
```
✓ Checked 45 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
• expression: 2
```

Final tool status line:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Git status after run: `?? .poutine.yml` (new file created during the scan; no source diffs reported).

Full raw report (9279 lines) was reviewed for this summary; only the bounded excerpts above and in Failure details are reproduced here to keep the issue actionable. No token-like or credential-like values were found in the reviewed output.

Control plane context

- Correlation ID: `34222479388-654`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34222479388`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34222479388) · copilot · auto · 40.5 AIC · ⌖ 10.4 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 12:06 PM UTC

Start with the two source workflows corresponding to self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, then review agentic_commands.yml and the other .github/workflows/*.md sources; do not edit generated lock files. Use the gh-aw MCP server's fix and compile tools with the full validation and security suite. Done means the compiler and scans pass, or any findings that require human policy decisions are clearly explained.

Written by the indexing model from the issue text.