[aw-doctor:compiler-security] Compiler & security scan failures across 47 workflows: actionlint expression errors, high-severity zizmor findings, critical con

Compilation of all 47 workflow sources in `githubnext/gh-aw-cao` completed but the full validation/security suite failed (exit code 1). Key findings: 2 actionlint expression errors (invalid `safe-outputs-app-token` step reference) in 2 lock files; zizmor reported 776 findings (45 High, 431 Medium, 300 Low) including a High-severity `github-app` (dangerous use of GitHub App tokens) finding repeated across most workflows; grype found 20 Critical and 119 High container CVEs (e.g. CVE-2026-63073/CVE-2026-75803 in openssl/libssl3/libcrypto3 across the firewall squid, mcpg, and other images); grant reported 1250 license policy violations across 9 container images causing a hard `grant failed`; poutine/runner-guard flagged 1 medium finding (excessive permissions on `pull_request_target`-triggered `agentic_commands.yml`). Highest severity supported by tools: **Critical** (grype CVE-2026-63073/CVE-2026-75803, unpatched OpenSSL in multiple firewall/mcpg images).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (unknown) | Property `safe-outputs-app-token` not defined in step outputs object used in `GIT_TOKEN` expression | Fix the `.md` source's safe-outputs token step reference so the generated step ID matches; recompile |
| zizmor | ~most `.lock.yml` files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `dependabot-release-train-updater.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens | Review GitHub App token usage per zizmor docs; scope/guard token exposure in the `.md` source |
| zizmor | multiple workflows | Medium/Low | `undocumented-permissions`, `template-injection`, `artipacked`, `secrets-outside-env`, `obfuscation`, `anonymous-definition`, `adhoc-packages` (776 total findings: 45 High / 431 Medium / 300 Low) | Address per zizmor audit docs; add permission comments, move interpolations out of shell, use `actions/checkout` without persisting credentials where flagged |
| poutine / runner-guard | `.github/workflows/agentic_commands.yml` | Medium | RGS-005 Excessive Permissions on Untrusted Trigger (`pull_request_target`/`issue_comment` with write perms) | Reduce permissions or add explicit trust gating for this trigger |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18` (+ others) | Critical | CVE-2026-63073, CVE-2026-75803 in `openssl`/`libssl3`/`libcrypto3` (fix: 3.5.8-r0) | Bump base image or pin newer Alpine package versions with the fix available |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` (+ others) | High | GHSA-rgw5-rvv9-x895 `brace-expansion@5.0.7` (fix: 5.0.9); numerous bind9-libs/perl CVEs (Medium/Low) | Upgrade vulnerable npm/OS packages in image build; total 119 High, 356 Medium, 54 Low, 27 Negligible, 81 Unknown across 9 images |
| grant | `ghcr.io/github/gh-aw-node` (and other images) | error (license policy) | 1250 license policy violations (GPL-2.0/3.0, LGPL, MPL variants flagged against configured allow-list) | Review `grant` allow-list policy vs. actual base-image licenses; adjust policy or swap dependencies causing hard failure |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47

Actionlint Summary: Checked 47 workflow(s), found 2 issue(s) (2 errors), type: expression

.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined ...
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined ...

zizmor: 776 findings total (45 High / 431 Medium / 300 Low) across categories:
adhoc-packages, anonymous-definition, artipacked, github-app, obfuscation, secrets-outside-env, template-injection, undocumented-permissions

poutine/runner-guard: 1 medium finding
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger

syft: scanned 9 container images (ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14, gh-aw-mcpg:v0.4.18, gh-aw-node, github-mcp-server:v1.11.0, alpine:latest, node:lts-alpine)

grype severity counts across 9 images: 20 Critical, 119 High, 356 Medium, 54 Low, 27 Negligible, 81 Unknown
Sample Critical: CVE-2026-63073 / CVE-2026-75803 in libcrypto3/libssl3/openssl@3.5.7-r0 (fix 3.5.8-r0) - squid, gh-aw-mcpg images
Sample High: GHSA-rgw5-rvv9-x895 brace-expansion@5.0.7 (fix 5.0.9) - firewall/agent image

grant: "strict mode: grant found 1250 license policy finding(s) in container images" -> grant failed
```

Control plane context

- Correlation ID: `34270960103-707`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34270960103

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34270960103) · copilot · auto · 33.7 AIC · ⌖ 12.5 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 8:07 PM UTC

Start with the two .github/workflows/*.md sources corresponding to self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, then review .github/workflows/agentic_commands.yml and the reported container image findings. Use the gh-aw MCP server's compile and fix tools rather than editing generated .lock.yml files. Done means the full compiler, workflow, security, license, and image scan suite passes, or an unfixable finding is documented.

Written by the indexing model from the issue text.