[aw-doctor:compiler-security] Compiler & security scan findings for githubnext/gh-aw-cao (Critical CVEs, license violations, zizmor High findings)

Compiling `githubnext/gh-aw-cao` (47 workflow sources / 47 lock files) with the full gh-aw validation and security-scanner suite exited with code 1. Findings span 4 categories: 2 actionlint expression errors, zizmor static-analysis warnings (20 Critical/164 High/787 Medium/354 Low/288 Informational across all lock files), grype found 20 Critical and additional High CVEs in 9 scanned container images, and grant reported 1250 license-policy violations across those same images. poutine and runner-guard ran clean apart from one Medium runner-guard finding. Highest severity supported by tooling: **Critical** (grype CVEs in `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/squid`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/github-mcp-server`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw compiler (expression validator) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Property `safe-outputs-app-token` not defined in referenced object type (2 occurrences) | Fix the `.md` workflow source expression referencing `safe-outputs-app-token`; recompile until the expression validator passes |
| actionlint | (same 2 files as above) | error | 2 expression issues, matching the compiler errors above | Same remediation |
| zizmor | `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `aw-maintenance-upgrade.lock.yml`, and 41 others | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` (45 occurrences) | Review app-token issuance steps; scope tokens narrowly and confirm they are not exposed to untrusted input |
| zizmor | `dashboard-authoring-corpus.lock.yml` and others | Medium | `artipacked`: credential persistence through GitHub Actions artifacts (29 occurrences) | Avoid persisting credentials in uploaded artifacts; use `actions/checkout` with `persist-credentials: false` where applicable |
| zizmor | many lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (787 total Medium findings, majority this rule) | Move secret references into a dedicated `environment:` block per workflow |
| zizmor | many lock files | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `obfuscation`, `template-injection` | Add permission comments, workflow names, and review ad-hoc script patterns as time allows |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an event that can be initiated by external users | Verify workflow trigger scope; restrict write permissions when triggered by untrusted events |
| grype | `alpine:latest`, `node:lts-alpine` | Critical | `CVE-2026-63073`, `CVE-2026-75803` in `libcrypto3`/`libssl3` (fix: 3.5.8-r0) | Rebuild/pull updated base image with OpenSSL 3.5.8-r0 |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical | Same CVE-2026-63073/75803 in `libcrypto3`, `libssl3`, `openssl` (fix: 3.5.8-r0) | Update image's Alpine OpenSSL packages |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | Critical | Same CVE-2026-63073/75803 in `libcrypto3`, `libssl3` | Update image's Alpine OpenSSL packages |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical | `CVE-2026-5450` in `libc6`; `CVE-2026-75803` in `libssl3` (Debian) | Update Debian base image packages |
| grype | 9 scanned images total | High (164 total across all severities) | 20 distinct additional CVE IDs (see raw evidence) beyond the Critical set above | Update affected packages/base images per grype fix guidance |
| grant | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` and 8 other images | error (license policy) | 1250 license-policy violations (GPL/LGPL/AGPL-family and other flagged licenses) across bundled OS and npm packages | Review `grant.yml`/license allowlist policy; either adjust the policy for accepted licenses or replace flagged dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint errors (2):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

zizmor severity totals: Critical 20, High 164, Medium 787, Low 354, Informational 288, Unknown 81.

grant: `strict mode: grant found 1250 license policy finding(s) in container images`.

grype distinct CVE IDs observed (Critical + High across 9 images, 178 total): CVE-2010-4756, CVE-2016-20013, CVE-2016-2781, CVE-2017-11164, CVE-2017-7189, CVE-2017-7475, CVE-2018-1000021, CVE-2018-10126, CVE-2018-18064, CVE-2018-20796, CVE-2018-5709, CVE-2019-1010022, CVE-2019-1010023, CVE-2019-1010024, CVE-2019-1010025, CVE-2019-9192, CVE-2020-10735, CVE-2020-25697, CVE-2022-24975, CVE-2022-27943, CVE-2022-2795, CVE-2022-3219, CVE-2022-41409, CVE-2022-4899, CVE-2023-2828, CVE-2023-29383, CVE-2023-31486, CVE-2023-34969, CVE-2023-37769, CVE-2023-4408, CVE-2023-47039, CVE-2023-50387, CVE-2023-50495, CVE-2023-50868, CVE-2023-52355, CVE-2024-0760, CVE-2024-10041, CVE-2024-11187, CVE-2024-12705, CVE-2024-1737, CVE-2024-1975, CVE-2024-52005, CVE-2024-52615, CVE-2024-52616, CVE-2024-56433, CVE-2025-12781, CVE-2025-15366, CVE-2025-15367, CVE-2025-15649, CVE-2025-27587, CVE-2025-40778, CVE-2025-40780, CVE-2025-50422, CVE-2025-5222, CVE-2025-59375, CVE-2025-59529, CVE-2025-60876, CVE-2025-66382, CVE-2025-8677, CVE-2026-0864, plus numerous 2026-series CVEs across squid, mcpg, github-mcp-server, agent, api-proxy, cli-proxy, node, and alpine images — see full `report.txt` for per-package detail (redacted here for length; no credential values were present in scanner output).

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

poutine: no findings reported (ran clean).

git status during scan: `?? .poutine.yml` (untracked scanner config file, not a finding).

Control plane context

- Correlation ID: `34312264023-107`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34312264023`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34312643938) · copilot · auto · 47 AIC · ⌖ 7.7 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 5:11 AM UTC

Start with the workflow sources corresponding to self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, then inspect agentic_commands.yml, grant.yml, and the listed container images. Run the gh-aw compiler and the full validation and security-scanner suite before making changes. Done means generated lock files are reviewed and the compiler, actionlint, zizmor, runner-guard, grant, grype, and related checks pass.

Written by the indexing model from the issue text.