[aw-doctor:compiler-security] Compiler and security scan findings in gh-aw workflows (grant license gate blocking build; 45 High zizmor github-app findings)

Compiling all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with `gh aw compile` (strict mode + full scanner suite) failed with exit code 1. Findings span actionlint (2 expression errors), zizmor (45 High "dangerous github-app token" findings, 402 Medium "secrets-outside-env", 271 Low "undocumented-permissions", 29 Medium "artipacked", 26 Low "adhoc-packages"), poutine (1 Medium excessive-permissions on untrusted trigger), and grant (1,250 container-image license policy violations blocking the build). grype/syft also report numerous High/Medium CVEs across 9 scanned images (libssl3/libcrypto3, busybox, tar, brace-expansion, ip-address, undici, Go stdlib in `gh-aw-mcpg`). Highest-severity supported finding: zizmor `github-app` (High) — dangerous GitHub App token usage in 45 lock files. The compiler's overall failure is currently driven by `grant`'s strict license-policy gate (1,250 findings), which blocks compilation regardless of the other findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `dependabot.lock.yml`, ...) | High | `github-app`: dangerous use of GitHub App tokens | Review App-token minting/usage per zizmor guidance; scope token permissions narrowly or avoid persisting the token beyond the step that needs it |
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | `safe-outputs-app-token` referenced but not defined in job outputs object | Fix the generating `.md` workflow source expression/output wiring so the referenced property exists |
| zizmor | ~402 occurrences across most workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block per zizmor guidance |
| zizmor | ~271 occurrences across most workflows | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add short comments justifying each `permissions:` entry |
| zizmor | ~29 occurrences (e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Avoid uploading credential-bearing paths (e.g. `.git`) as artifacts |
| zizmor | ~26 occurrences | Low | `adhoc-packages`: ad-hoc package installation | Pin package versions / use lockfile-based installs |
| poutine | `.github/workflows/agentic_commands.yml` | Medium (RGS-005) | Job grants write-level permissions on an untrusted-trigger event (`pull_request_target`/`issue_comment`/etc.) | Reduce permissions to read-only or gate write access behind trusted-actor checks |
| grype/syft | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | High | Multiple Go stdlib CVEs (GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5942, GO-2026-5026) | Rebuild image with patched Go toolchain (≥1.25.13/1.26.6/1.27.0-rc.3) |
| grype/syft | `node:lts-alpine`, `alpine:latest`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/github-mcp-server:v1.11.0` | High/Medium | Numerous CVEs (libssl3/libcrypto3, busybox, tar, brace-expansion, ip-address, undici, nghttp2-libs, ssl_client) | Bump base images / dependency versions to patched releases |
| grant | 9 scanned container images | error (build-blocking) | 1,250 license policy findings (e.g. Zlib, BSD-2-Clause, BlueOak-1.0.0, ISC, MIT flagged by current policy) | Review `grant`/license policy configuration for false positives, or replace/relicense flagged dependencies; this gate is currently what causes the overall compile failure |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: `Checked 47 workflow(s)`, `Found 2 issue(s) (2 error(s))`, issue type `expression: 2`.

Zizmor findings by category (counts): `secrets-outside-env` 402 (Medium), `undocumented-permissions` 271 (Low), `github-app` 45 (High), `artipacked` 29 (Medium), `adhoc-packages` 26 (Low).

Poutine: 1 finding, `RGS-005` (Medium) on `.github/workflows/agentic_commands.yml`.

Grype/syft: 9 container images scanned (`gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`), with High/Medium CVE counts as tabulated above.

Grant: `strict mode: grant found 1250 license policy finding(s) in container images` — this failure is the proximate cause of the non-zero compiler exit code.

No token-like or credential-like values were present in the reviewed report excerpts.

Control plane context

- Correlation ID: `34282094025-100`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34282094025`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34282594430) · copilot · auto · 41.6 AIC · ⌖ 7.22 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 10:08 PM UTC

Start by running `gh aw compile` in the target repository with strict validation and the full scanner suite. Review the 47 `.github/workflows/*.md` sources, especially the workflows producing the two actionlint errors and `.github/workflows/agentic_commands.yml`; do not edit generated `.lock.yml` files. Done means the compiler and required security scans pass, or any unfixable finding is documented for human review.

Written by the indexing model from the issue text.