[aw-doctor:compiler-security] Compiler security scan findings — actionlint, zizmor, runner-guard, grype, grant (githubnext/gh-aw-cao)

The gh-aw compiler's full validation/security suite exited with code 1 (not clean) after compiling all 47 workflow sources into 47 lock files. Findings span 5 categories: 2 actionlint expression errors, ~1436 zizmor findings (20 Critical, 164 High severity, plus many Medium/Low/Informational — dominated by `secrets-outside-env`, `undocumented-permissions`, `anonymous-definition`, and 45 `github-app` dangerous-token-use findings), 1 runner-guard warning (excessive permissions on untrusted trigger, RGS-005), 215 unique container vulnerabilities via grype (20 Critical, 119 High, 356 Medium, 54 Low, 27 Negligible across 9 scanned images — notably `squid:0.28.14`, `alpine`, `node`, `gh-aw-mcpg`, and `github-mcp-server` have Critical CVEs), and 1250 grant license-policy violations (mostly GPL/LGPL family licenses in base-image packages) that caused grant to fail in strict mode. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073 in squid's OpenSSL stack) and zizmor Critical/High `github-app`/`secrets-outside-env` findings. Recommended next action: assign to Copilot to fix workflow-source-level findings (actionlint, zizmor, runner-guard) via `gh aw fix`/`compile`; the grype/grant container-image findings require upstream base-image or pinned-tag updates and may need separate human follow-up since they originate outside workflow `.md` sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `[expression]` property `safe-outputs-app-token` not defined in step-outputs object type | Fix source `.md` expression reference / step output name, then recompile |
| zizmor | 45 workflow lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `dependabot`, `eu-cra-compliance-*`, `self-care-*`, `optimization-*`) | High | `github-app`: dangerous use of GitHub App tokens | Review token scoping/lifetime per zizmor docs, adjust workflow source |
| zizmor | many workflows | Medium/warning (787 occurrences) | `secrets-outside-env` (402), `undocumented-permissions` (271), `artipacked` (29) | Move secret refs into `env:`, document `permissions:`, avoid artifact secret leakage |
| zizmor | many workflows | Informational/Low (669 occurrences) | `anonymous-definition` (279), `adhoc-packages` (26), `template-injection` (9), `obfuscation` (3) | Lower priority; review per zizmor audit docs |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an event that can be initiated by external users | Reduce permissions or gate write scope behind trusted-actor check |
| grype | `gh-aw-firewall/squid:0.28.14`, `alpine`, `node:lts-alpine`, `gh-aw-mcpg:v0.4.18`, `github-mcp-server:v1.11.0` | Critical (20), High (119) | 215 unique CVEs/GHSAs (e.g. CVE-2026-63073 openssl/libssl3/libcrypto3 in squid; GHSA-rgw5-rvv9-x895 brace-expansion, GHSA-r292-9mhp-454m tar in firewall images) | Bump pinned image digests/tags to versions with available fixes |
| grant | 9 container images | error (1250 findings) | License policy violations — mostly GPL-2.0/GPL-3.0/LGPL family licenses in base-image packages (e.g. `libgdbm-compat4`, `libapt-pkg6.0`, `gnupg`) | Requires license-policy review; likely needs `.poutine.yml`/grant policy adjustment or base-image change, not a workflow-source fix |

Note: a local, uncommitted change (`git-status.txt`) shows the compiler already regenerated `.github/workflows/mattpocock-skills-reviewer.lock.yml` (1 line diff) and produced a new `.poutine.yml`; these are compiler-run artifacts from the scan itself, not manually applied fixes.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely (for example, container-image license/CVE findings that require a base-image change rather than a workflow-source edit).

Raw evidence

Compiler run summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
i Issues by type:
• expression: 2
```

Zizmor severity totals (line-count based, no consolidated summary block was emitted in this run):
```
error: [Critical] 20
error: [High] 164
error: [expression] 2
info: [Informational] 288
info: [Low] 354
info: [Negligible] 27
warning: [Medium] 787
warning: [Unknown] 81
```

Runner-guard: 1 finding (RGS-005, medium).

Grype: 215 unique CVE/GHSA identifiers across 9 images — severity breakdown: Critical 20, High 119, Medium 356, Low 54, Negligible 27.

Grant: `strict mode: grant found 1250 license policy finding(s) in container images` → scanner exited non-zero (`✗ grant failed`).

Shellcheck: 68 findings across 2835 scanned run-step resources (e.g. in `.github/graders/*-operational-value.sh` scripts).

No token-like or credential-like values were present in the reviewed excerpts.

Control plane context

- Correlation ID: `34292266815-732`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34292266815`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34292266815) · copilot · auto · 40.8 AIC · ⌖ 11.9 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 12:06 AM UTC

Start with the 47 .github/workflows/*.md sources and run the gh aw MCP server's fix and compile tools. Review the actionlint, zizmor, runner-guard, shellcheck, grype, grant, and related scan output, leaving generated .lock.yml files untouched. Done means the full strict compiler and security suite passes, or remaining upstream image findings are clearly reported.

Written by the indexing model from the issue text.