[aw-doctor:compiler-security] githubnext/gh-aw-cao: compiler findings — 45 High zizmor github-app, 139 grype CVEs (20 Critical), 1250 license findings

Target `githubnext/gh-aw-cao`: compiler exited **1** (findings, not clean) across 47 workflow sources / 47 compiled locks. Highest severity: **Critical** (grype container CVEs, 20 findings) and **High** (zizmor `github-app` dangerous-token-use, 45 findings; grype, 119 findings). Findings by category: 2 actionlint expression errors, 186 zizmor findings (45 High `github-app`, rest Medium/Low/Informational/Unknown), 139 grype container CVEs across 9 images (20 Critical, 119 High), 1 poutine finding (`RGS-005`, Medium, excessive permissions on untrusted trigger), and 1250 grant license-policy findings (strict mode failed). **Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` not defined in expression context | Fix expression source in `.md` workflow, recompile |
| zizmor | 33 `.lock.yml` workflows (45 occurrences) | High | `github-app`: dangerous use of GitHub App tokens | Review app-token usage per zizmor docs; scope/guard token exposure |
| zizmor | multiple workflows | Medium | `secrets-outside-env`: secrets referenced without dedicated environment | Move secret references into a dedicated `environment:` |
| zizmor | multiple workflows | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` | Add permission comments, name jobs/workflows, use pinned package installs |
| poutine | `agentic_commands.yml` | Medium (`RGS-005`) | Write permissions (`contents: write` etc.) on a workflow triggered by untrusted event (`issue_comment`/`pull_request_target`) | Drop write perms or restrict trigger; least-privilege permissions |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | Critical/High (50) | Multiple CVEs/GHSAs (e.g. `CVE-2026-5450`, `GHSA-rgw5-rvv9-x895`, several `GO-2026-*`) | Bump base image / vulnerable Go & JS deps to patched versions |
| grype | `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14` | Critical/High | `brace-expansion`, `tar`, `ip-address`, `libcrypto3` and squid CVEs | Update firewall image base/deps to latest patched release |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical/High (8) | `CVE-2026-5450`, `CVE-2026-75803`, others | Bump to patched `github-mcp-server` release |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-node` | Critical/High | OS/package CVEs (e.g. `undici` GHSA-v3r7/-m8rv/-8xcm) | Rebuild against updated base images |
| grant | 9 container images (1250 total) | license policy | GPL/LGPL/other license-policy violations (e.g. `init-system-helpers`, `sed`, `libgpg-error0`) | Review and update `.poutine.yml`/grant policy allowlist or swap dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

git status after compile (uncommitted local drift, not part of this finding set):
```
M .github/workflows/mattpocock-skills-reviewer.lock.yml
?? .poutine.yml
```

Actionlint:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
```

Zizmor severity counts: Critical 20, High 164 (45 are `github-app`), Medium 787, Low 354, Informational 288, Negligible 27, Unknown 81 (raw regex tags include duplicate substrings from adjacent lines; category counts above are best-effort from `report.txt`).

Grype: scanned 9 container images; 20 Critical + 119 High findings total.

Grant: `strict mode: grant found 1250 license policy finding(s) in container images` (command failed).

Full 9,576-line report available in workflow run artifacts (`/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt`); not reproduced in full here to bound issue size.

Control plane context

- **Correlation ID**: `34287664436-727`
- **Central repository**: `githubnext/gh-aw-cao`
- **Control plane run URL**: `https://github.com/githubnext/gh-aw-cao/actions/runs/34287664436`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34287664436) · copilot · auto · 41.9 AIC · ⌖ 17.3 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 11:05 PM UTC

Start with the compiler report and the named sources `.github/workflows/self-care-dashboard-performance.md`, `.github/workflows/self-care-pages-health.md`, and `agentic_commands.yml`; inspect `.poutine.yml` for policy context. Configure the gh-aw MCP server and use its `fix` and `compile` tools, never editing generated `.lock.yml` files directly. Done means the full compiler and security scan passes cleanly, with generated lock-file diffs reviewed.

Written by the indexing model from the issue text.