[aw-doctor:compiler-security] Compiler security scan findings: actionlint errors, critical CVEs, and license policy failures (45 workflows)

Full gh-aw compiler + security-scanner suite run against `githubnext/gh-aw-cao` (45 workflow sources, 45 compiled locks) exited non-zero (exit code 1). Actionlint reported 2 blocking expression errors in 2 lock files, zizmor flagged 41 High-severity `github-app` findings plus Critical/High/Medium items across categories, grype found 20 Critical and 119 High CVEs across container images (notably `node:lts-alpine` OpenSSL and npm-package CVEs), and grant's strict license-policy scan failed with 1250 findings. Highest-severity supported issue: grype Critical CVE-2026-63073/CVE-2026-75803 (`libcrypto3`/`libssl3`) in `node:lts-alpine`, and actionlint blocking `expression` errors preventing clean compilation.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.md, self-care-pages-health.md | error | `safe-outputs-app-token` step-output property not defined in generated expression context (line ~2283/2189) | Regenerate lock via `gh aw compile` after fixing the source template reference to the app-token step output; do not hand-edit `.lock.yml` |
| zizmor | 34 workflow sources (e.g. aw-doctor, aw-failures-investigator, all `*-app*` users) | High | `github-app`: dangerous use of `actions/create-github-app-token@...` GitHub App tokens | Review app-token scoping; confirm minimal permissions and add zizmor ignore only if intentional and documented |
| zizmor | activation jobs across most workflows | Medium | `secrets-outside-env`: secrets referenced without dedicated `environment:` (393 occurrences) | Move secret-referencing steps into a dedicated `environment:` block per zizmor guidance |
| zizmor | pr-reviewer, self-care-primer-brand-checker, self-care | Informational | `template-injection`: code injection via template expansion (3 occurrences) | Replace `${{ }}` expression interpolation in `run:` blocks with env-var indirection |
| zizmor | optimization-ai-credit-auditor, optimization-ai-credit-optimizer, self-care-docs-build-time-investigator | Low | `obfuscation`: obfuscated usage of Actions features (3 occurrences) | Simplify flagged expressions per zizmor docs |
| zizmor | most workflows | Low/Informational | `undocumented-permissions` (259), `anonymous-definition` (267), `artipacked` (25), `adhoc-packages` (25) | Add permission comments, job `name:` fields, avoid `actions/checkout` credential persistence, prefer pinned installers |
| grype | node:lts-alpine | Critical | CVE-2026-63073, CVE-2026-75803 — `libcrypto3`/`libssl3` 3.5.7-r0 (fix 3.5.8-r0) | Bump base image / apk upgrade openssl to 3.5.8-r0 or later |
| grype | node:lts-alpine | High | CVE-2026-18798, CVE-2026-63076, CVE-2026-14457, CVE-2026-14456, CVE-2026-63072, CVE-2026-54874, CVE-2026-63075 (libcrypto3/libssl3); GHSA-rgw5-rvv9-x895/GHSA-mh99-v99m-4gvg (brace-expansion), GHSA-r292-9mhp-454m (tar), GHSA-mwp4-54f8-5fhr (ip-address) | Update base image and npm deps to fixed versions listed |
| grype | gh-aw-firewall/agent:0.28.14 | Medium | Multiple bind9-libs, perl, libexpat1 CVEs (Ubuntu base) | Rebuild image from an updated Ubuntu base or bump package versions |
| grant | 9 container images | error (policy) | 1250 license-policy violations (GPL/LGPL family, ISC, MIT flagged under current strict policy across images) | Review `.poutine.yml`/grant policy allow-list; confirm whether GPL/LGPL/ISC/MIT should be permitted for these images, update policy or replace flagged packages |
| poutine | agentic_commands.yml | Medium | RGS-005: excessive permissions on workflow reachable via untrusted trigger (issue_comment) | Restrict write permissions or scope command-triggered jobs to trusted context |
| shellcheck | 12 grader scripts under `.github/graders/` | warning | Various shellcheck findings (see raw evidence) | Apply shellcheck-suggested fixes to grader shell scripts |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 45
Compiled locks: 45
```

Actionlint errors (2):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2189:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Zizmor severity totals: Critical 0, High 160, Medium 774, Low 341, Informational 276 (across categories: secrets-outside-env 393, anonymous-definition 267, undocumented-permissions 259, github-app 41, artipacked 25, adhoc-packages 25, template-injection 9, obfuscation 3).

Grype severity totals across 9 scanned images: Critical 20, High 119, Medium 356, Low 54, Negligible 27. Images scanned: `gh-aw-firewall/agent:0.28.14`, `gh-aw-firewall/api-proxy:0.28.14`, `gh-aw-firewall/cli-proxy:0.28.14`, `gh-aw-firewall/squid:0.28.14`, `gh-aw-mcpg:v0.4.18`, `gh-aw-node`, `github-mcp-server:v1.11.0`, `alpine:latest`, `node:lts-alpine`.

Grant: strict mode failed with 1250 license policy findings across 9 images (sample above; full list omitted for size, see workflow run artifacts).

Poutine: 1 medium finding (RGS-005 in `agentic_commands.yml`).

Shellcheck: findings in 12 `.github/graders/*-operational-value.sh` scripts (see workflow run artifacts for line-level detail).

Untracked file at scan time: `.poutine.yml` (uncommitted, per `git-status.txt`) — confirm whether this policy file should be committed.

No token-like or credential-like values were present in the reviewed evidence.

Control plane context

- Correlation ID: `34228434146-91`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34228434146`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34229125683) · copilot · auto · 34.3 AIC · ⌖ 11.9 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 1:17 PM UTC

Start with the two reported actionlint locations in .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, then run gh aw compile with strict validation. Review the related .github/workflows/*.md sources, .github/graders/*-operational-value.sh scripts, container findings, and .poutine.yml policy context without editing generated .lock.yml files. Done means the full compiler and security scan passes, or unresolved human-policy findings are clearly documented.

Written by the indexing model from the issue text.