[aw-doctor:compiler-security] Compiler suite findings: Critical CVEs, expression errors, and 1,250 license policy violations

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` (commit `955a066e11aa546834cbedc2722011fb01f531ab`) succeeded, but the full validation suite exited 1 with findings across actionlint, zizmor, poutine, runner-guard, grype, and grant. Highest-severity supported finding: 3 unique **Critical** CVEs (CVE-2026-63073, CVE-2026-75803, CVE-2026-5450) in OpenSSL/libc across 5 of 9 scanned container images (fixes available for the OpenSSL ones). Also notable: 45 zizmor **High** `github-app` findings (dangerous GitHub App token usage pattern repeated across workflows), 2 actionlint expression errors, and 1,250 grant license-policy violations (likely an overly strict/unconfigured license allowlist rather than genuinely disallowed licenses). Recommended next action: remediate the actionlint expression errors and pin/upgrade the vulnerable base images first, then address the zizmor `github-app` pattern and grant policy.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `steps.safe-outputs-app-token` property not defined in step-outputs object type (expression check) | Fix upstream compiler template generating this step reference, or remove the invalid expression; recompile |
| zizmor | 45 lock files incl. aw-doctor, aw-failures-investigator, aw-maintenance-compiler-security, aw-maintenance-upgrade, uk-ai-advisory, etc. | High | `github-app`: dangerous use of `actions/create-github-app-token` for GitHub App tokens | Review whether the app-token step needs hardening (scoped permissions, restrict when app credentials are set); likely a shared control-plane template issue |
| zizmor | most lock files (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs to a GitHub Environment or accept as expected pattern for gh-aw generated files |
| zizmor | dashboard-authoring-corpus.lock.yml + others (29 occurrences) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure artifact upload steps don't retain checkout credentials |
| zizmor | 271 occurrences across most lock files | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission (cosmetic, low priority) |
| zizmor | uk-ai-advisory.lock.yml + others (26 occurrences) | Low | `adhoc-packages`: ad-hoc `npm install`/binary installs outside lockfiles | Pin package installs via lockfile or documented version, where feasible |
| runner-guard | agentic_commands.yml | Medium (RGS-005) | Excessive permissions (`contents: write` etc.) on workflow triggered by untrusted event context | Verify triggers/permissions scope for command-dispatch workflow; reduce to minimum needed |
| poutine | activation job (repo-wide) | Medium | Same pattern as runner-guard RGS-005 (untrusted trigger + write permissions) | Same as above; already partially acknowledged via `.poutine.yml` skip for `untrusted_checkout_exec` |
| grype | ghcr.io/github/gh-aw-firewall/squid:0.28.14, gh-aw-mcpg:v0.4.18, github-mcp-server:v1.11.0, alpine:latest, node:lts-alpine | Critical | CVE-2026-63073 / CVE-2026-75803 (libcrypto3/libssl3/openssl, Alpine); CVE-2026-5450 (libc6, Debian) | Upgrade base images / rebuild with patched Alpine/Debian package versions; fixes available for the Alpine OpenSSL CVEs (3.5.8-r0) |
| grype | gh-aw-firewall/agent:0.28.14 and others | High | GHSA-rgw5-rvv9-x895 (brace-expansion, fix 5.0.9) plus numerous Medium/Low bind9-libs, libexpat1, perl CVEs (356 Medium, 119 High total across images) | Bump vulnerable npm/OS packages in image build; rerun grype until clean |
| grant | 9 scanned container images | error (policy) | 1,250 license-policy violations (many permissive licenses like MIT/BSD/Apache-2.0 flagged) — `.grant.yaml` only configures repo permissions, not an image license allowlist | Add/complete a license allowlist in the grant image-scanning configuration so common permissive OSS licenses are not flagged, or confirm intentional denial and document exceptions |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Compiler summary:**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

**actionlint (2 errors):**
```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

**zizmor finding counts by rule/severity:**
```
402 [Medium] secrets-outside-env
271 [Low] undocumented-permissions
45 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
3 [Low] obfuscation
```

**runner-guard / poutine:**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

**grype severities (across 9 images):**
```
Critical: 20 (3 unique CVEs: CVE-2026-63073, CVE-2026-75803, CVE-2026-5450)
High: 119
Medium: 356
Low: 54
Negligible: 27
Unknown: 81
```

**grant:**
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

**git status of evidence workspace:**
```
?? .poutine.yml
```

Control plane context

- Correlation ID: `34258761330-96`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34258761330`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34259228842) · copilot · auto · 54.8 AIC · ⌖ 7.75 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 6:08 PM UTC

Start with the .github/workflows/*.md sources and use the gh-aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Investigate the two actionlint expression errors, then review the image, token, permissions, and license-policy findings reported by the scans. Done means the full compiler and security suite passes, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.