[aw-doctor:compiler-security] gh-aw compiler & security scan findings in githubnext/gh-aw-cao (47 workflows)

Compiling all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` completed with exit code 1. Findings: 2 actionlint expression errors, 45 zizmor High `github-app` findings (dangerous GitHub App token usage pattern repeated across nearly every self-care/eu-cra/optimization workflow), widespread container CVEs (multiple Critical/High CVEs in `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/github-mcp-server`), 1250 `grant` license-policy violations causing hard scanner failure, and 1 poutine/runner-guard Medium finding (RGS-005 excessive permissions on untrusted trigger in `agentic_commands.yml`). Highest severity: Critical CVEs (e.g. CVE-2026-63073/75803 in openssl/libssl3) plus zizmor High `github-app` misuse. Recommended next action: assign to Copilot to update pinned base images/action versions and fix the App-token step pattern, then rerun the full compiler/scan suite.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step-output property referenced but not defined in step outcome type | Fix the source `.md` step-output reference/step id so the generated expression matches an actual declared output |
| zizmor | 45 lock files (aw-doctor, aw-failures-investigator, dependabot*, eu-cra-compliance*, optimization*, self-care*, software-development-practices*, uk-ai-advisory*) | High | `github-app`: dangerous use of `actions/create-github-app-token` (conditional/dynamic App token minting pattern) | Review the token-minting step; scope permissions minimally and confirm zizmor's recommended safer pattern (e.g., pinned action + explicit least-privilege permissions) |
| zizmor | all 47 lock files | Medium | `secrets-outside-env` (402 occurrences): secrets referenced without dedicated `environment:` | Move secret-referencing jobs under a dedicated GitHub Environment where feasible |
| zizmor | multiple | Medium | `artipacked` (29 occurrences): artifact/credential persistence risk | Review artifact upload steps for leaked credentials |
| zizmor | multiple | Low/Info | `undocumented-permissions` (271), `anonymous-definition` (279), `adhoc-packages` (26), `template-injection` (9), `obfuscation` (3) | Informational; document `permissions:` blocks, name jobs, prefer pinned installs |
| grype/syft (grant) | `alpine:latest` | Critical/High | Multiple OpenSSL/libssl3/libcrypto3 CVEs (CVE-2026-63073, 75803, 14456/7, 18798, 54874, 63072/5/6) | Bump base image / apk packages to fixed versions (libssl3/libcrypto3 3.5.8-r0) |
| grype | `node:lts-alpine` | Critical/High | Same OpenSSL family CVEs plus `brace-expansion`, `ip-address`, `tar` GHSAs | Update Node base image tag and vendored npm deps |
| grype | `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy}:0.28.14` | High | `brace-expansion`, `ip-address`, `tar` GHSAs | Bump firewall image dependency versions |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical/High | OpenSSL family CVEs | Bump squid image base packages |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | Critical/High | OpenSSL, libblkid/libmount, Go stdlib/grpc/crypto/text GHSAs and GO advisories | Update mcpg image Go toolchain and dependencies |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical/High | glibc CVEs, libssl3, `golang.org/x/text` GHSA-hfg8 family | Update MCP server base image and Go deps |
| grant | many `ghcr.io/github/gh-aw-firewall/agent` npm deps | error (license) | 1250 total license-policy violations (GPL-2.0-only, ISC, MIT flagged under strict policy) causing `grant failed` | Review license allow-list/policy config vs. actual base-image licenses; adjust policy or base images |
| poutine / runner-guard | `.github/workflows/agentic_commands.yml` | Medium | RGS-005: write permissions declared alongside an untrusted-trigger event | Reduce `permissions:` to read-only or use safe-outputs instead of direct write permissions for this trigger |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action (e.g., license policy exceptions or base image pinning decisions), require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- `summary.txt`: Target githubnext/gh-aw-cao, exit code 1, 47 workflow sources, 47 compiled locks.
- `git-status.txt`: only `.poutine.yml` untracked (scanner config artifact), no source diffs.
- Full `report.txt` is 9576 lines; key excerpts:
- Actionlint: `✓ Checked 47 workflow(s)` / `⚠ Found 2 issue(s) (2 error(s))` — both `expression` type on `safe-outputs-app-token`.
- Zizmor: unique-rule histogram — 402 Medium `secrets-outside-env`, 279 Info `anonymous-definition`, 271 Low `undocumented-permissions`, 45 High `github-app`, 29 Medium `artipacked`, 26 Low `adhoc-packages`, 9 Info `template-injection`, 3 Low `obfuscation`.
- Grype/grant: 8 distinct images scanned with Critical/High CVEs; `grant failed: strict mode: grant found 1250 license policy finding(s) in container images`.
- Poutine/runner-guard: 1 shared finding, RGS-005, Medium, in `agentic_commands.yml`.

No token-like or credential-like values were present in the reviewed excerpts.

Control plane context

- Correlation ID: `34301342749-746`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34301342749`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34301342749) · copilot · auto · 51.1 AIC · ⌖ 9.18 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 2:17 AM UTC

Start by rerunning the compiler and security scan suite for the 47 `.github/workflows/*.md` sources, then inspect the two `safe-outputs-app-token` references and `.github/workflows/agentic_commands.yml`. Review the generated lock-file diffs without editing them directly, and address the reported action, image, permission, artifact, and license findings. Done means the full strict compiler and security scan passes, or any human-required policy decision is documented.

Written by the indexing model from the issue text.