[aw-doctor:compiler-security] Compiler exit 1: license policy violations block strict compile; zizmor/actionlint/runner-guard/grype findings across 46 workflo

Compiling all 46 gh-aw workflows in `githubnext/gh-aw-cao` (sha `be27b41d`) with the full validation/lint/container/security suite failed with exit code 1. The blocking failure is `grant` (license scanner), which found 1250 license-policy findings across 9 scanned container images in strict mode. Non-blocking tooling also reported: 2 actionlint expression errors (undefined `safe-outputs-app-token` step output) in 2 lock files, a widespread zizmor High finding (`github-app`: dangerous use of GitHub App tokens) in 42 lock files, 397 zizmor Medium `secrets-outside-env` findings, many Low/Informational zizmor findings, 1 runner-guard Medium finding (`RGS-005` excessive permissions on untrusted trigger in `agentic_commands.yml`), grype High/Critical CVEs across 9 container base images (35 unique High, 3 unique Critical CVE/GHSA IDs, e.g. libssl3/openssl OpenSSL CVEs, grpc, brace-expansion, Go stdlib), and cosmetic shellcheck `SC2034` warnings in 16 grader scripts. Highest severity supported by tooling: grant strict-mode failure (blocking) plus multiple zizmor/grype High findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `46`
- **Generated lock files checked**: `46`
- **Result**: `findings`

| Tool | Workflow/Image | Severity (tool-reported) | Finding | Remediation |
|---|---|---|---|---|
| grant | 9 container images (e.g. `node:lts-alpine`) | blocking (strict mode) | 1250 license-policy findings (e.g. ISC, GPL-2.0-only `busybox`, CC-BY-3.0 `spdx-exceptions`, Artistic-2.0 `npm`) | Review `.poutine.yml`/grant license policy allowlist; either accept known-safe licenses in policy config or pin to images without disallowed-license packages |
| actionlint | `self-care-dashboard-performance.lock.yml:2283`, `self-care-pages-health.lock.yml:2189` | error [expression] | `steps.safe-outputs-app-token` output referenced but not defined in that job's step outputs | Fix in the `.md` workflow source (likely a shared include/template mismatch) then recompile; do not edit `.lock.yml` directly |
| zizmor | 42 `.lock.yml` files (e.g. `aw-doctor.lock.yml:1512`, `dependabot.lock.yml:1482`) | High | `github-app`: dangerous use of GitHub App tokens | Review shared control template generating GitHub App token usage; scope/guard per zizmor docs |
| zizmor | `dependabot-release-train-updater.lock.yml` and others | Medium | `secrets-outside-env` (397 occurrences) — secrets referenced without dedicated environment | Move secret references into a job `environment:` where feasible |
| zizmor | many `.lock.yml` files | Low/Informational | `undocumented-permissions`, `anonymous-definition` | Add explanatory comments to `permissions:` blocks; name workflow/action definitions |
| runner-guard | `agentic_commands.yml:1` | Medium (RGS-005) | Excessive permissions on untrusted trigger (write perms with `pull_request_target`/`issue_comment`-style triggers) | Reduce permissions to least privilege for that trigger context |
| grype | 9 container images (firewall agent/api-proxy/cli-proxy/squid, mcpg, gh-aw-node, github-mcp-server, alpine, node:lts-alpine) | High (35 unique)/Critical (3 unique) | OS package and Go/npm dependency CVEs (OpenSSL/libssl3 CVE-2026-14456/14457/18798/54874/63072/63073/63075/63076/75803, libc6, libexpat, libblkid/libmount, brace-expansion, tar, grpc, Go stdlib) | Update/rebuild base images to pick up patched packages; bump vulnerable Go/npm dependencies |
| shellcheck | 16 grader `.sh` scripts under `.github/graders/` | warning (SC2034) | Unused-looking exported variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) | Confirm variables are consumed externally (likely yes, via env injection) or remove/export explicitly to silence |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary line: `Target: githubnext/gh-aw-cao / Exit code: 1 / Workflow sources: 46 / Compiled locks: 46`.

Actionlint summary: `Checked 46 workflow(s)` / `Found 2 issue(s) (2 error(s))` / issues by type: `expression: 2`.

Compiler workflow-size summary: 46 workflows, total size 6.8 MB, 273 jobs, 5812 steps, 2754 scripts (1.5 MB). Experimental features in use: `graders` (16 workflows), `gh-aw-detection` (2 workflows).

Grant failure tail: `✗ grant failed` / `strict mode: grant found 1250 license policy finding(s) in container images`.

Full raw report (687,670 bytes, 9,429 lines) retained in the run's deterministic evidence at `/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt`; no token-like or credential-like values were observed in the excerpted output above.

Control plane context

- Correlation ID: `34240335984-93`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34240335984`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34241080195) · copilot · auto · 41.4 AIC · ⌖ 9.69 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 3:12 PM UTC

Start by running the full compiler and security scan against the 46 `.github/workflows/*.md` sources, then inspect `.poutine.yml`, `agentic_commands.yml`, and the two sources producing the `safe-outputs-app-token` errors. Do not edit generated `.lock.yml` files. Done means the strict compile and all listed validation and security tools pass, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.