[aw-doctor:compiler-security] Compiler/security scan findings: gh-aw-cao (34 Critical, 217 High vulnerabilities; 1250 license findings; 2 actionlint errors)

Compiling all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the full gh-aw compiler/validation/scanner suite exited with code 1. Findings span 2 actionlint errors, 1250 container-image license-policy violations (grant), 34 Critical + 217 High + 786 Medium + 354 Low + 27 Negligible vulnerabilities across 9 container images (grype), and hundreds of zizmor static-analysis findings (217 High, mostly `github-app` dangerous-token-use across 37 workflow lock files) plus 1 poutine/runner-guard medium finding. No compiler parse/validation errors were reported for the workflow sources themselves — all 47 sources compiled to 47 lock files. Highest-severity supported finding: 34 Critical CVEs (e.g. CVE-2026-75803 in `node:lts-alpine`'s libssl3/libcrypto3, CVE-2026-63073, CVE-2026-5450, CVE-2026-18924, CVE-2026-19931) in base container images used by workflow steps.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step-outputs expression context | Fix the source `.md` expression referencing `safe-outputs-app-token`; recompile |
| grant | 9 container images (`gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`) | error | 1250 license-policy findings, e.g. `spdx-expression-parse@4.0.0 (MIT)` flagged repeatedly across images | Review/adjust license policy (`.poutine.yml`/grant config) or update base images; confirm MIT is an intended allowed license |
| grype | `node:lts-alpine` | Critical | CVE-2026-75803: libcrypto3/libssl3 3.5.7-r0 (fix: 3.5.8-r0) | Bump base image / apk upgrade to pull patched OpenSSL |
| grype | multiple images | Critical | CVE-2026-18924, CVE-2026-19931, CVE-2026-5450, CVE-2026-63073 | Update affected base images to patched versions |
| grype | `gh-aw-firewall/agent:0.28.14` | Medium | Multiple bind9-libs/perl CVEs (Ubuntu 22.04 base) | Update firewall image base / upstream gh-aw-firewall release |
| zizmor | 37 lock files (e.g. `aw-doctor.lock.yml:1511`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Review App-token scoping/exposure per zizmor guidance; may be accepted risk — confirm |
| zizmor | many lock files | Medium | `secrets-outside-env`: secrets referenced without dedicated environment | Move secret references into a dedicated `environment:` block where feasible |
| zizmor | many lock files | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` | Add comments to `permissions:`, name jobs, use pinned package installs |
| poutine / runner-guard | `.github/workflows/agentic_commands.yml` | Medium | RGS-005: write-level permissions combined with untrusted trigger event | Review trigger/permission combination; scope down permissions or trigger |
| shellcheck | multiple grader scripts under `.github/graders/` | warning | SC2034 unused variables (`WORKFLOW_NAME`, `METRIC_ID`, etc.) | Remove or `export`/use the variables, or add `# shellcheck disable` with justification |

Untracked file noted during scan: `.poutine.yml` (present in git status, not otherwise analyzed here).

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: 2 issues (2 errors), category `expression`.

Grant: `strict mode: grant found 1250 license policy finding(s) in container images` — top repeated packages (7 occurrences each): `zlib@1.3.2-r0`, `ssl_client@1.37.0-r31`, `scanelf@1.3.9-r1`, `musl@1.2.6-r2`, `musl-utils@1.2.6-r2`, `ca-certificates-bundle@20260611-r0`, `busybox@1.37.0-r31`, `busybox-binsh@1.37.0-r31`, `alpine-release@3.24.1-r0`, `alpine-keys@2.6-r0`, `alpine-baselayout@3.7.2-r1`, `alpine-baselayout-data@3.7.2-r1` (all MIT-flagged under strict policy).

Grype severity totals across 9 scanned images: Critical 34, High 217, Medium 786, Low 354, Negligible 27 (584 total CVE-tagged lines). Images scanned: `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.11.0`, `alpine:latest`, `node:lts-alpine`.

Zizmor severity totals: High 217, Medium 786 (shared count with other tools' medium tally in raw log ordering — see per-tool table above for attribution), Low 354, Informational 288. Dominant High finding: `github-app` dangerous-token-use (45 occurrences across 37 lock files).

Poutine/runner-guard: 1 medium finding (RGS-005) in `agentic_commands.yml`.

Shellcheck: multiple SC2034 unused-variable warnings in `.github/graders/*.sh` operational-value scripts.

No token-like or credential-like values were present in the reviewed output; none redacted beyond standard pinned action SHAs already public in the repository.

Control plane context

- Correlation ID: `34326020586-779`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34326020586`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34326020586) · copilot · auto · 43.4 AIC · ⌖ 11.6 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 8:10 AM UTC

Start with the reported expressions in .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, then inspect .github/workflows/agentic_commands.yml, .github/graders/*.sh, and .poutine.yml. Use the gh aw MCP server's compile and fix entry points without editing generated .lock.yml files; done means the full compiler, validation, lint, policy, and vulnerability scan passes or any unavoidable finding is documented.

Written by the indexing model from the issue text.