[aw-doctor:compiler-security] Compiler/security scan findings — actionlint errors, high-severity zizmor, critical CVEs, license policy failures

Compiled 46 gh-aw workflow sources / 46 lock files in `githubnext/gh-aw-cao` (exit code 1, non-clean). Findings by category: 2 actionlint expression errors, 43 High + 424 Medium + 294 Low zizmor findings (43 are `github-app` dangerous-token-use errors), 1 runner-guard medium excessive-permissions warning, 199 unique CVEs from grype (20 Critical, 119 High, 356 Medium, 54 Low, 27 Negligible) across 9 container images, and a strict-mode `grant` failure with 1250 license policy findings. Highest severity: Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in openssl/libssl3/libcrypto3) affecting `gh-aw-firewall/squid`, `gh-aw-mcpg`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `46`
- **Generated lock files checked**: `46`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token` referenced but not defined in step-outputs type (undefined property `safe-outputs-app-token`) | Fix the `.md` source's GIT_TOKEN expression / app-token step wiring so the referenced step id/output actually exists, then recompile |
| zizmor | 12+ workflows (e.g. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-compiler-security`, `dependabot-release-train-updater`, `eu-cra-compliance-*`) | High (error) | `github-app`: dangerous use of GitHub App tokens | Review app-token creation/usage steps for unsafe reuse/scoping per zizmor's github-app audit guidance |
| zizmor | ~265 occurrences across all workflows | Medium (info) | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add comments to `permissions:` blocks explaining the minimal scopes granted |
| zizmor | ~273 occurrences | Medium | `anonymous-definition`: unnamed/anonymous job or step definitions flagged | Name jobs/steps per zizmor guidance for auditability |
| zizmor | 26 occurrences (e.g. `uk-ai-advisory.md`) | Low (info) | `adhoc-packages`: ad-hoc package installs (npm install -g, curl\|bash-style installs) | Pin installs to vetted/lockfile-driven dependency management where feasible |
| zizmor | 9 occurrences (e.g. `pr-reviewer`, `self-care-primer-brand-checker`, `self-care`) | Informational | `template-injection`: code injection via template expansion (`${{ vars.* }}` in env near MCP gateway start) | Review flagged expressions for injectable untrusted input before use in `env:`/`run:` |
| zizmor | 3 occurrences | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify flagged expressions per zizmor guidance |
| runner-guard | `agentic_commands.yml` | Medium (warning) | RGS-005: excessive write permissions on a workflow triggered by untrusted events (`issue_comment`/`pull_request_target`-style trigger) | Reduce to minimum required permissions or gate write jobs behind trusted-actor checks |
| grype | `gh-aw-firewall/squid:0.28.14`, `gh-aw-mcpg:v0.4.18` | Critical | CVE-2026-63073, CVE-2026-75803: `openssl`/`libssl3`/`libcrypto3` 3.5.7-r0 (fix: 3.5.8-r0) | Bump base image / rebuild against Alpine package set with openssl ≥3.5.8-r0 |
| grype | `github-mcp-server:v1.11.0` | Critical | CVE-2026-5450 (`libc6`), CVE-2026-75803 (`libssl3`) | Rebase image on patched Debian package set |
| grype | `alpine:latest`, `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803 (`openssl`/`libssl3`/`libcrypto3`) | Update pinned base image digests to include patched openssl |
| grype | 9 images | High/Medium/Low (199 unique CVEs total) | Various OS package CVEs (e.g. `bind9-libs` CVE-2023-50387 and related Medium findings in `gh-aw-firewall/agent`) | Rebuild/update all 9 scanned images to latest patched package sets |
| grant | 9 container images | policy (strict) | 1250 license policy findings blocking strict-mode compile | Review flagged package licenses; update policy allowlist or replace non-compliant packages/images |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Full compiler/scanner output stored in workflow run artifacts under `/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt` (9,429 lines, digest `87df1360635a0eb601888479edca0f74c5d7b160052b78ac1a600670d7a650c1`).
- Summary counts: actionlint `2 error(s)` across 46 files; zizmor `43 High / 424 Medium / 294 Low`; runner-guard `1 medium`; grype `20 Critical / 119 High / 356 Medium / 54 Low / 27 Negligible` (199 unique CVEs) across 9 scanned images (`gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`); grant `1250 license policy finding(s)` (strict mode failure).
- No token-like or credential-like values observed in captured output.
- Working tree showed only an untracked `.poutine.yml` (`git status`), no other diffs from the compile run.

Control plane context

- Correlation ID: `34233825740-92`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34233825740`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34234407974) · copilot · auto · 43.2 AIC · ⌖ 9.67 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 2:10 PM UTC

Start with the findings in /tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt and the affected .github/workflows/*.md sources; do not edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, then rerun the listed validation and security scans. Done means the full compiler and security scan passes, or a specific unsafe-to-fix finding is documented.

Written by the indexing model from the issue text.