[aw-doctor:compiler-security] Compiler & security scan findings — 47 workflows, actionlint errors + zizmor/grype/grant findings

Compiling all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` failed (exit code 1) with the full validation/lint/container/security-scanner suite. Findings span 4 categories: 2 actionlint expression errors, 1436 zizmor security findings (20 Critical, 164 High, 787 Medium, remainder Low/Informational — including 37 workflows using a dangerous GitHub App token pattern), grype container CVEs (multiple Critical/High across 6 of 9 scanned images, notably `alpine:latest`, `node:lts-alpine`, and `ghcr.io/github/github-mcp-server:v1.11.0`), and a failed `grant` license scan (1250 policy findings, mostly copyleft/GPL-family licenses in `ghcr.io/github/gh-aw-firewall/agent:0.28.14`). Highest-severity supported finding: **Critical** — CVE-2026-63073/CVE-2026-75803 (libssl3/libcrypto3 in `alpine:latest` and `node:lts-alpine`, fixes available) and zizmor Critical rules. Recommended next action: assign to Copilot to fix the two actionlint errors and reduce zizmor High/Critical findings via workflow-source changes; container CVEs/license findings require base-image/policy decisions and should be reviewed by a maintainer.

**Action:** Assign this issue to Copilot using **Agent prompt** below for the actionlint/zizmor source-fixable findings; review its pull request and merge only after the full compiler and security scan passes. Container CVE and license-policy findings (grype/grant) require a maintainer decision on base images and license policy exceptions before automated remediation.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2287`, `self-care-pages-health.lock.yml:2193` | error | `steps.safe-outputs-app-token` referenced but not a defined step output in that job context | Fix the source `.md` template's app-token step wiring so the referenced step ID exists in the same job, then recompile |
| zizmor | 37 workflows (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `uk-ai-advisory.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@...` | Review App-token scope/lifetime per zizmor docs; restrict permissions and audit downstream token usage |
| zizmor | multiple workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into a job with an explicit `environment:` |
| zizmor | multiple | Low/Informational | `undocumented-permissions`, `adhoc-packages`, `anonymous-definition` | Add comments to `permissions:` blocks; document ad-hoc package installs |
| zizmor | (20 findings) | Critical | Not itemized individually here (see raw evidence) — highest-severity zizmor class present | Requires manual triage; see raw report for exact rule names/locations |
| grype | `alpine:latest`, `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3, fix 3.5.8-r0 available) | Bump base image / rebuild to pick up patched OpenSSL |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical | CVE-2026-75803 (libssl3 3.0.20-1~deb12u2) | Update MCP server image tag once upstream ships a patched build |
| grype | `node:lts-alpine` | High | GHSA-r292-9mhp-454m (tar), GHSA-mwp4-54f8-5fhr (ip-address), GHSA-rgw5-rvv9-x895/GHSA-mh99-v99m-4gvg (brace-expansion) | Rebuild image to refresh npm-bundled dependencies |
| grant (strict) | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` | error (policy) | 1250 license policy violations, largely GPL-family/copyleft packages (e.g. `findutils` GPL-3.0-or-later, `libmnl0` GPL-2.0) bundled in the firewall agent image | Maintainer must decide: accept exception, swap packages, or adjust `grant` policy for this pinned base image |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: container CVE (grype) and license-policy (grant) findings originate from pinned upstream base images (`alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*:0.28.14`, `ghcr.io/github/github-mcp-server:v1.11.0`) — these cannot be fixed by editing workflow `.md` sources alone; flag them for maintainer decision rather than attempting a workaround.

Raw evidence

Compiler summary: 47 workflow sources, 47 compiled locks, exit code 1.

Zizmor totals: 20 Critical, 164 High, 787 Medium findings (report.txt lines ~7100–9440 in the deterministic evidence bundle).

Actionlint: "Found 2 issue(s) (2 error(s))" — both `expression` category, both referencing `steps.safe-outputs-app-token` in a job context where that step ID is not defined.

Poutine: scan ran with no findings printed to report (clean for poutine specifically).

Runner-guard: 1 medium finding — `agentic_commands.yml:1:1 RGS-005: Excessive Permissions on Untrusted Trigger` (a job with write-level permissions on an untrusted-trigger-adjacent commands manifest; flagged informationally, verify this is the expected trusted-command-dispatch pattern).

Grype: scanned 9 container images (`alpine:latest`, `node:lts-alpine`, `ghcr.io/github/github-mcp-server:v1.11.0`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, and 4 `ghcr.io/github/gh-aw-firewall/*:0.28.14` variants); ~230 distinct CVE/GHSA identifiers found across images at Critical/High/Medium/Low/Negligible severities.

Grant: "strict mode: grant found 1250 license policy finding(s) in container images" — scan exited non-zero; dominant image is `ghcr.io/github/gh-aw-firewall/agent:0.28.14` (Ubuntu + npm packages, many copyleft licenses flagged by policy).

No token-like or credential-like values were present in the reviewed output.

Control plane context

- Correlation ID: `34316062617-108`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34316062617`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34316371220) · copilot · auto · 36.4 AIC · ⌖ 9.57 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 6:06 AM UTC

Start by running the compiler and full validation/security suite for the 47 `.github/workflows/*.md` sources, then inspect the templates corresponding to `self-care-dashboard-performance.lock.yml` and `self-care-pages-health.lock.yml`. Do not edit generated `.lock.yml` files. Done means source-fixable actionlint and zizmor findings are resolved and the scans pass; container CVEs and grant policy findings require maintainer decisions.

Written by the indexing model from the issue text.