[aw-doctor:compiler-security] githubnext/gh-aw-cao: compiler exit 1 — 2 actionlint errors, grant license violations, critical grype CVEs, zizmor High findings

Compiled 47 workflow sources / 47 lock files for `githubnext/gh-aw-cao`; compiler exited 1 (findings). Highest severity: **Critical** (grype: unpatched OpenSSL/libcrypto3 CVE-2026-63073/75803 and libc6 CVE-2026-5450 in base container images). Category counts: 2 actionlint expression errors, 858 zizmor findings (45 High/431 Medium/300 Low/288 Informational), 602 grype CVE findings (20 Critical/119 High), 1250 grant license-policy violations, 1 runner-guard medium finding, numerous shellcheck SC2034 unused-variable warnings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.md, self-care-pages-health.md | error | `safe-outputs-app-token` property not defined in `needs` context object | Fix expression reference / job output wiring for `safe-outputs-app-token` in these workflow sources |
| zizmor | uk-ai-advisory.md + others (45 occurrences) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review App-token usage scope/exposure per zizmor guidance |
| zizmor | many workflows (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job `environment:` block |
| zizmor | many workflows (29 occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid persisting credentials (e.g. `.git` dir) in uploaded artifacts |
| zizmor | many workflows (271 occurrences) | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | many workflows (26 occurrences) | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g`) | Pin/vendor installs or use lockfile-based installs |
| zizmor | pr-reviewer.md, self-care-primer-brand-checker.md (9 occurrences) | Informational | `template-injection`: code injection via template expansion | Use intermediate env vars instead of direct `${{ }}` interpolation in `run:` |
| zizmor | optimization-ai-credit-auditor.md + others (3) | Low | `obfuscation`: obfuscated usage of Actions features | Simplify expression usage flagged by zizmor |
| zizmor | 279 jobs across workflows | Informational | `anonymous-definition`: job/workflow lacks a `name:` | Add descriptive `name:` fields |
| runner-guard | agentic_commands.yml | Medium | RGS-005: excessive permissions under untrusted trigger context | Restrict write permissions when triggered by `pull_request_target`/`issue_comment` |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `alpine:latest`, `node:lts-alpine` | Critical | CVE-2026-63073 / CVE-2026-75803: outdated `libssl3`/`libcrypto3`/`openssl` (3.5.7-r0, fix 3.5.8-r0) | Bump base images to pick up patched OpenSSL |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical | CVE-2026-5450 (libc6), CVE-2026-75803 (libssl3) | Update/rebuild `github-mcp-server` image with patched packages |
| grype | 9 container images (602 total findings) | High/Medium/Low/Unknown | Includes GHSA-rgw5-rvv9-x895/GHSA-mh99-v99m-4gvg (`brace-expansion`), GHSA-r292-9mhp-454m (`tar`), GHSA-mwp4-54f8-5fhr (`ip-address`), plus many OS package CVEs (bind9-libs, libexpat1, libpython3.10, etc.) | Rebuild/update images to latest patched package versions |
| grant | 9 container images (1250 findings) | error (policy) | License policy violations across OS and npm packages (GPL-2.0/3.0, LGPL, and other non-allowlisted licenses) | Review `.poutine.yml`/grant license allowlist policy vs. actual image contents; adjust policy or replace non-compliant components |
| shellcheck | many script steps | warning [SC2034] | Variables (e.g. `WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`) appear unused | Remove or export unused script variables in workflow source templates |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint errors:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...; setup: ...; setup-agent-output-env: ...}
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...; setup: ...; setup-agent-output-env: ...}
```

Summary counts:
```
Actionlint: 2 issues (2 errors) across 47 workflows
Zizmor: 858 findings — 45 High, 431 Medium, 300 Low, 288 Informational
runner-guard: 1 medium finding (RGS-005)
Grype: 602 findings — 20 Critical, 119 High, 356 Medium, 54 Low, 27 Negligible, 81 Unknown, across 9 container images
Grant: 1250 license policy violations (strict mode) across 9 container images — compiler treats this as a failing check
Total workflows compiled: 47 (7.0 MB total lock size, 279 jobs, 5994 steps, 2819 scripts)
```

No token-like or credential-like values were present in the scanner output requiring redaction.

Control plane context

- Correlation ID: `34298384705-736`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34298384705`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34298384705) · copilot · auto · 49.1 AIC · ⌖ 9.3 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 1:34 AM UTC

Start with the two named workflow sources, .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, and compare them with their reported actionlint errors. Then review the other .github/workflows/*.md sources, .poutine.yml, and the gh aw MCP server's fix and compile tools. Done means the full compiler and security scan passes without direct edits to generated .lock.yml files.

Written by the indexing model from the issue text.