[aw-doctor:compiler-security] Compiler & security scan findings — actionlint, zizmor, grype, grant

Compiled 47 gh-aw workflow sources / 47 lock files in `githubnext/gh-aw-cao` (exit code 1, not clean). Findings span 4 categories: 2 actionlint expression errors, 37 workflows with zizmor High "github-app" findings (plus Medium/Low/Info), 1 runner-guard Medium taint finding, grype container CVEs (20 Critical / 164 High / 787 Medium / 354 Low), and a hard-failing grant license scan (1250 policy violations). Highest severity: **Critical** (grype CVEs in firewall/mcpg/node images); highest-impact blocking failure is `grant` (strict mode exit).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step outputs object (expression syntax error) | Fix the referenced step ID / output reference in the source `.md` workflow so the expression type-checks |
| zizmor | 37 `.lock.yml` workflows (e.g. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-*`, ~5 occurrences each) | High | `github-app`: dangerous use of `actions/create-github-app-token` | Review App token scoping/exposure per zizmor docs; likely accepted pattern for CAO control workflows but confirm least-privilege usage |
| zizmor | many workflows | Medium | `secrets-outside-env`: secrets referenced without dedicated environment | Move secret references into a dedicated `environment:` block where feasible |
| zizmor | `dashboard-authoring-corpus.lock.yml` | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid persisting credentials into uploaded artifacts |
| zizmor | many workflows | Low/Info | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` | Add comments to `permissions:` blocks; name jobs; pin ad-hoc package installs |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: excessive write permissions on untrusted trigger (`issue_comment`-style event with write perms) | Reduce to least-privilege permissions or gate write scope for untrusted triggers |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` (largest contributor) + 8 other images | Critical (20), High (164), Medium (787), Low (354), Negligible (27), Unknown (81) | OS/npm package CVEs (e.g. `GHSA-rgw5-rvv9-x895` brace-expansion, bind9-libs CVEs, undici CVEs) | Bump base images / vendored packages to patched versions; re-scan |
| grant | 9 container images | error (hard fail) | 1250 license policy violations across bundled OS + npm packages (BSD/GPL/ISC/MIT/etc. flagged by current policy) | Review `.poutine.yml`/grant license allow-list policy; confirm intended licenses are allow-listed or exclude vendor images from strict grant enforcement |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: `Found 2 issue(s) (2 error(s))` — both `expression` type errors on `safe-outputs-app-token` step-output access.

Sample zizmor High finding:
```
./.github/workflows/aw-doctor.lock.yml:1511:15: error: [High] github-app: dangerous use of GitHub App tokens
1511 | uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
```

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Sample grype Critical/High:
```
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: [High] GHSA-rgw5-rvv9-x895: brace-expansion@5.0.7 (fix: 5.0.9)
```

Grant failure summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Note: `git-status.txt` showed an untracked `.poutine.yml` produced during the run; not committed by this worker.

Control plane context

- Correlation ID: `34304616928-105`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34304616928`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34304878337) · copilot · auto · 37.2 AIC · ⌖ 10.2 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 3:10 AM UTC

Start with the workflow sources under .github/workflows/*.md, especially the sources for self-care-dashboard-performance and self-care-pages-health, plus agentic_commands.yml; do not edit generated .lock.yml files. Run the gh aw MCP server's fix and compile tools, then review the full compiler, security, license, and container-scan output. Done means the findings are safely resolved or explicitly explained and the complete strict scan passes.

Written by the indexing model from the issue text.