[aw-doctor:compiler-security] gh-aw-cao: 45 workflows flagged for GitHub App token misuse; container images carry Critical/High CVEs; license policy violation

Compiler run for `githubnext/gh-aw-cao` at `5875a57b8ab5fd5e918beafe85d1ff664235f997` exited with code 1 (47 workflow sources, 47 compiled locks). Zizmor flagged 45 lock files for a High-severity "dangerous use of GitHub App tokens" pattern; 2 lock files have a `[expression]` type error referencing an undefined `safe-outputs-app-token` step output; container scans (grype) found 20 Critical and 164 High CVEs across 8 base images (worst: `ghcr.io/github/gh-aw-mcpg:v0.4.18` with 4 Critical/46 High, `ghcr.io/github/gh-aw-firewall/squid:0.28.14` with 6 Critical/21 High, `ghcr.io/github/github-mcp-server:v1.11.0` with 2 Critical incl. glibc CVE-2026-5450); grant flagged 1250 license-policy violations across images (notably GPL-2.0-only packages `ssl_client`, `scanelf` in `node:lts-alpine`). Highest-severity supported finding: Critical CVE-2026-5450 (glibc) in `github-mcp-server:v1.11.0`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor | 45 `.lock.yml` files (e.g. `aw-doctor.lock.yml`, `self-care.lock.yml`, `optimization.lock.yml`, ...) | High | `github-app`: dangerous use of GitHub App tokens ([docs]((docs.zizmor.sh/redacted) | Review App-token usage pattern per zizmor guidance; regenerate via `gh aw compile` after source fix |
| gh-aw type-checker | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | Undefined property `safe-outputs-app-token` referenced in `GIT_TOKEN` fallback expression (line ~2287/2193) | Fix the underlying workflow `.md` source generating this step reference; recompile |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | Critical/High (4/46) | `stdlib@go1.26.4` multiple Go stdlib CVEs (GO-2026-6090, -6089, -5972, -5942, -5026) | Bump base image / Go toolchain to fixed versions (1.25.13, 1.26.6, 1.27.0-rc.3) |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical/High (6/21) | Multiple package CVEs (unspecified in excerpt) | Update firewall squid image to patched release |
| grype | `ghcr.io/github/github-mcp-server:v1.11.0` | Critical/High (2/6) | `libc6@2.36-9+deb12u14`: CVE-2026-5450 (Critical); `libssl3@3.0.20-1~deb12u2`: CVE-2026-63076, -63072, -54874 (High) | Update base image to patched Debian package versions |
| grype | `alpine:latest` | Critical/High (4/14) | `libcrypto3`/`libssl3@3.5.7-r0`: CVE-2026-63073, -75803 (Critical), CVE-2026-14456/-14457/-18798/-54874 (High) | Bump to `3.5.8-r0` |
| grype | `node:lts-alpine` | Critical/High (4/18) | Alpine libcrypto3/libssl3 CVEs (same family as above) | Bump base image / apk packages |
| grant | `node:lts-alpine` (and other images) | policy violation | 1250 license findings, including GPL-2.0-only (`ssl_client`, `scanelf`) alongside many permissive (MIT/ISC/BlueOak) flagged by strict policy | Confirm license policy allowlist; replace or vendor GPL-2.0-only system packages if disallowed |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Severity totals across full report.txt (9576 lines): Critical=20, High=164, Medium=787, Low=354, Unknown severity=81.

Sample zizmor findings (first 3 of 45):
```
.github/workflows/aw-doctor.lock.yml: error: [High] github-app: dangerous use of GitHub App tokens
.github/workflows/aw-failures-investigator.lock.yml: error: [High] github-app: dangerous use of GitHub App tokens
.github/workflows/aw-maintenance-compiler-security.lock.yml: error: [High] github-app: dangerous use of GitHub App tokens
```

Type-check expression error excerpt:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined
2287 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
```

No token-like or credential-like values were present in the excerpted output.

Control plane context

- Correlation ID: `34321547279-771`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34321547279`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34321547279) · copilot · auto · 35.9 AIC · ⌖ 14.8 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 7:19 AM UTC

Start with the `.github/workflows/*.md` sources and the generated findings for the 45 lock files; do not edit `.lock.yml` files directly. Use the `gh aw mcp-server` `fix` and `compile` entry points, then review generated lock-file diffs. Done means the compiler and the listed validation, security, container, and license scans pass cleanly.

Written by the indexing model from the issue text.