[aw-doctor:compiler-security] gh-aw compiler security scan: findings across actionlint, zizmor, runner-guard, grype, grant

Compiling all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` (target SHA `5875a57b`) with the full gh-aw validation/lint/security suite exited non-zero (exit code 1). Findings span 5 tool categories: 2 actionlint expression errors, 45 zizmor High "dangerous GitHub App token" findings (plus 402 Medium/354 Low/288 Info lower-severity zizmor findings), 1 runner-guard Medium excessive-permissions finding, 34 Critical + 217 High container CVEs across 9 images (grype), and 1250 license-policy violations across the same 9 images (grant, which failed in strict mode). Highest-severity supported finding: Critical CVEs (e.g. CVE-2026-18924/19931/63073/75803 in curl/openssl) in multiple `gh-aw-firewall` and `node:lts-alpine` images used by workflow containers.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step output referenced but not defined in the job's step outputs type | Fix the `.md` source's GIT_TOKEN expression/step wiring so `safe-outputs-app-token` is a real prior step id, then recompile |
| zizmor | 9+ workflow lock files (aw-doctor, aw-failures-investigator, aw-maintenance-compiler-security, uk-ai-advisory, etc.) | High (`github-app`) | Dangerous use of `actions/create-github-app-token` GitHub App tokens (45 occurrences) | Scope App token usage/permissions per zizmor guidance; confirm token is not exposed to untrusted context |
| zizmor | Many lock files | Medium (`secrets-outside-env`) | Secrets referenced without a dedicated `environment:` (402 occurrences) | Move jobs referencing secrets into a declared `environment:` |
| zizmor | Many lock files | Low/Info (`undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `artipacked`) | Permissions lack comments, workflows/jobs unnamed, ad-hoc package installs, artifact-related issues (354/288/26/29 occurrences) | Low priority style/hardening cleanup |
| zizmor | Several lock files | Low (`template-injection`, `obfuscation`) | 9 template-injection + 3 obfuscation findings | Review flagged expressions for injection risk |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a workflow reachable via untrusted trigger context (issue_comment/pull_request_target-style) | Reduce to least-privilege read permissions or gate write jobs behind an approval/authorization check |
| grype | `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/github-mcp-server:v1.11.0`, `node:lts-alpine`, `ghcr.io/github/gh-aw-node`, `alpine:latest` | Critical/High | 34 Critical + 217 High CVEs (e.g. CVE-2026-18924/19931/63073/75803 in curl/openssl; GO-2026-* in Go stdlib; GHSA-* in npm deps) | Bump base images / pinned tool versions to patched releases |
| grant | Same 9 images | error (strict mode) | 1250 license-policy violations (mostly transitive npm/OS package licenses e.g. ISC/ GFDL-NIV/GPL) | Review `.poutine.yml`/grant license policy allowlist against actual dependency licenses in these images; either adjust policy or swap flagged deps/images |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Zizmor severity totals: 34 Critical, 217 High, 786 Medium, 354 Low, 288 Informational (rule breakdown: secrets-outside-env 402, undocumented-permissions 271, anonymous-definition 279, github-app 45, artipacked 29, adhoc-packages 26, template-injection 9, obfuscation 3).

Actionlint: 2 issues, both `[expression]` type, in `self-care-dashboard-performance.lock.yml:2287` and `self-care-pages-health.lock.yml:2193`.

Runner-guard: 1 Medium finding (RGS-005) in `agentic_commands.yml`.

Grype: 34 Critical + 217 High across `alpine:latest`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.11.0`, `node:lts-alpine`. Sample Critical CVEs: CVE-2026-18924, CVE-2026-19931, CVE-2026-63073, CVE-2026-75803 (curl/libcurl/libssl3/libcrypto3/openssl).

Grant: 1250 license-policy violations (strict mode failure) across the same 9 images.

Poutine: no findings emitted in this run's report section.

Untracked file at scan time: `.poutine.yml` (working-tree only, not part of the diff).

No secret-like values were present in the excerpted evidence above.

Control plane context

- Correlation ID: `34331511789-784`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34331511789`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34331511789) · copilot · auto · 42.6 AIC · ⌖ 9.23 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 9:12 AM UTC

Read the affected .github/workflows/*.md sources and agentic_commands.yml, then run gh aw compile against the listed workflow and image findings. Review the generated lock-file diffs without editing them directly. Done means the full compiler and security suite passes cleanly, with unresolved findings explained.

Written by the indexing model from the issue text.