[aw-doctor:compiler-security] Compiler & security scan findings across 47 workflows (exit 1)

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` completed with **exit code 1** (not clean). Findings span 6 categories: 2 actionlint expression errors, 402 zizmor `secrets-outside-env` (Medium), 45 zizmor `github-app` dangerous-token-use (High), 29 `artipacked` (Medium), 1 poutine/runner-guard `RGS-005` excessive-permissions-on-untrusted-trigger (Medium), 22 grype container CVEs (4 Critical/18 High, mostly `alpine:latest` OpenSSL and `gh-aw-firewall/agent` npm deps), and grant strict-mode license-policy violations (1250 findings, largely permissive/system licenses in the `gh-aw-firewall/agent` image — likely policy config, not code, issue). Highest-severity supported finding: **Critical CVE-2026-63073/75803** (libssl3/libcrypto3 in `alpine:latest` base image, fix available: 3.5.8-r0).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in `needs` output type | Fix source `.md` expression referencing an undefined step output; recompile |
| zizmor | 45 workflows incl. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-compiler-security`, `aw-maintenance-upgrade` | High | `github-app`: dangerous use of GitHub App tokens | Review token-generation step scoping/exposure per zizmor guidance |
| zizmor | most workflows (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block |
| zizmor | `dashboard-authoring-corpus.lock.yml` and others (29 occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid uploading credential-bearing paths as artifacts |
| zizmor | 271 occurrences | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | 279 occurrences | Informational | `anonymous-definition`: workflow/job without a `name` | Add descriptive `name:` fields |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g`) | Pin package installs via lockfile/manifest where feasible |
| poutine/runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job grants write-level permissions while triggered by an event that can be initiated by external users | Restrict `permissions:` to read-only or gate write jobs behind approval for untrusted triggers |
| grype | `alpine:latest` | Critical | `CVE-2026-63073`, `CVE-2026-75803`: libssl3/libcrypto3 (fix: 3.5.8-r0) | Bump base image / rebuild with patched OpenSSL packages |
| grype | `alpine:latest` | High | `CVE-2026-14456/14457/18798/54874/63072/63075/63076`: libssl3/libcrypto3 | Same fix as above (3.5.8-r0) |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` | High | `GHSA-mh99-v99m-4gvg`, `GHSA-rgw5-rvv9-x895` (brace-expansion), `GHSA-mwp4-54f8-5fhr` (ip-address), `GHSA-r292-9mhp-454m` (tar) | Update vulnerable npm deps to fixed versions listed |
| grant | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` (and other images) | policy | 1250 license-policy violations flagged in strict mode, largely permissive (MIT/ISC/BSD) and system (GPL/LGPL) packages | Likely a `grant` policy/allowlist configuration gap rather than a code defect — review `.poutine.yml`/grant policy allowlist for common OSS licenses before treating as blocking |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Sample actionlint errors:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Zizmor rule totals: `secrets-outside-env`=402 (Medium), `anonymous-definition`=279 (Informational), `undocumented-permissions`=271 (Low), `github-app`=45 (High), `artipacked`=29 (Medium), `adhoc-packages`=26 (Low), `template-injection`=9 (Informational), `obfuscation`=3 (Low).

Poutine/runner-guard:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Grype critical/high sample:
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: [High] GHSA-r292-9mhp-454m: tar@7.5.19 (fix: 7.5.21)
```

Grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Untracked file noted in workspace: `.poutine.yml` (git status: `??`) — a poutine config file was added by the run but not committed to the target repo source; the compile evidence does not indicate what it contains or whether it should be tracked.

Control plane context

Correlation ID: `34308628434-757`
Central repository: `githubnext/gh-aw-cao`
Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34308628434

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34308628434) · copilot · auto · 39.9 AIC · ⌖ 10.2 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 4:09 AM UTC

Start with the .github/workflows/*.md sources, especially the sources for the two self-care workflows and agentic_commands.yml; do not edit generated .lock.yml files. Run the gh aw MCP server's fix and compile flow, inspect the generated diffs, and rerun the listed validation scans. Done means the compiler and security scans pass.

Written by the indexing model from the issue text.