[aw-doctor:compiler-security] Compiler & security scan findings — 47 workflows (2 actionlint errors, 45 zizmor github-app, 1 runner-guard, 184 grype, 1250 gra

Compiled all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` (target SHA `4e4671eac1f30e6359bf757d372992ba9ab25af9`) with the full validation/lint/scanner suite. Compiler **exited 1** — the run is not clean. Highest-severity supported finding: **Critical** grype vulnerabilities (CVE-2026-63073 in `libcrypto3`/`libssl3`/`openssl` on the `gh-aw-firewall/squid` image, 20 Critical instances total). Findings by category: 2 actionlint expression errors, 45 zizmor `github-app` (High) findings, 1 runner-guard `RGS-005` (Medium) warning, 184 grype vulnerabilities (20 Critical / 164 High, plus many Medium/Low warnings not counted as failures), 1250 grant license-policy violations across 9 container images, and 1 shellcheck script-variable warning class repeated across 12 grader scripts. `grant failed` in strict mode is the terminating failure condition.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in `needs.*.outputs` expression type | Fix the expression in the workflow `.md` source (likely a typo'd output name or missing job output declaration) and recompile |
| zizmor | 45 workflow `.lock.yml` files (e.g. `aw-doctor`, `aw-failures-investigator`, `dependabot`, `eu-cra-compliance-*`, `self-care-*`, `optimization-*`, `software-development-practices-*`, `uk-ai-advisory*`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/usage per zizmor's `github-app` audit guidance; likely a shared control template pattern needing an allowlist or narrower token permissions |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a job triggered by an untrusted event type | Reduce permissions to least-privilege for that trigger, or gate the write steps behind an authorization check |
| grype | `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy` `0.28.14` | High | `brace-expansion`, `tar`, `ip-address` npm packages with known CVEs (GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, GHSA-r292-9mhp-454m, GHSA-mwp4-54f8-5fhr) | Bump base image / vendor deps to patched versions in the upstream `gh-aw-firewall` image build |
| grype | `gh-aw-firewall/squid:0.28.14` | Critical/High | `libcrypto3`, `libssl3`, `openssl` (3.5.7-r0 → 3.5.8-r0) — multiple CVEs incl. CVE-2026-63073 (Critical) | Rebuild squid image on updated Alpine base with patched OpenSSL |
| grant | 9 container images (`gh-aw-firewall/agent`, `node:lts-alpine`, others) | error (policy) | 1250 license-policy violations across bundled npm/OS packages (MIT/ISC/BlueOak/GPL mix) | Update `.poutine.yml`/grant allowlist policy to reflect accepted licenses, or exclude vendored dev-only packages from the scanned image layers |
| shellcheck | 12 `*-operational-value.sh` grader scripts | warning (SC2034) | Env vars (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) assigned but apparently unused | Add `# shellcheck disable=SC2034` with justification if intentionally exported for later use, or remove unused assignments |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Bounded excerpts from `report.txt` (696,805 bytes total, 9,576 lines):

```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}

i Actionlint Summary
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
• expression: 2

./.github/workflows/aw-doctor.lock.yml:1511:15: error: [High] github-app: dangerous use of GitHub App tokens ((docs.zizmor.sh/redacted)
[45 occurrences total across workflow lock files]

.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger

ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-firewall/squid:0.28.14:1:1: error: [Critical] CVE-2026-63073: openssl@3.5.7-r0 (fix: 3.5.8-r0)
[20 Critical, 164 High grype findings total across 9 images]

✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images

⚠ shellcheck findings in .github/graders/eu-cra-compliance-article-14-reporting-readiness-operational-value.sh
script:3:1: warning: WORKFLOW_NAME appears unused. Verify use (or export if used externally). [SC2034]
[repeated across 12 grader scripts]
```

Git status recorded alongside the scan: `?? .poutine.yml` (untracked policy file present in the working tree — not committed).

Control plane context

- Correlation ID: `34276428074-99`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34276428074

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34276790663) · copilot · auto · 40 AIC · ⌖ 11.2 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 9:06 PM UTC

Start by running the full compiler and security scan against the 47 workflow sources in .github/workflows/*.md, then inspect the two actionlint locations in self-care-dashboard-performance and self-care-pages-health, agentic_commands.yml, the 12 grader scripts, and the gh-aw-firewall image build inputs. Use the gh aw MCP server's fix and compile entry points; done means generated lock files reflect source changes and the complete strict scan passes, or an unresolved finding is documented.

Written by the indexing model from the issue text.