[aw-doctor:compiler-security] Compiler & security scan findings — githubnext/gh-aw-cao (47 workflows)

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` finished with exit code 1 (findings, not clean). Highest-severity supported findings: 2 **Critical** CVEs (openssl/curl) across 4 firewall container images plus 251 total Critical/High CVEs from `grype`, 45 **High** zizmor `github-app` findings across 37 lock files, 2 actionlint expression errors, 1 poutine medium finding, and a `grant` strict-mode failure with 1250 license-policy findings in container images. No target-repository code changes are needed for the image CVEs/licenses (upstream base images); the actionlint and zizmor findings are fixable in workflow sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` property not defined in job outputs expression context | Fix expression in workflow `.md` source referencing `safe-outputs-app-token`; recompile |
| zizmor | 37 lock files (e.g. aw-doctor, aw-failures-investigator, self-care*, eu-cra-compliance*, optimization*, software-development-practices*, uk-ai-advisory*) — 45 occurrences | High | `github-app`: dangerous use of GitHub App tokens | Review token scoping/step permissions per zizmor docs; adjust source `.md` |
| zizmor | eu-cra-compliance-vulnerability-handling-auditor.lock.yml | Medium | `secrets-outside-env`: secrets referenced without dedicated environment (x4) | Move secret refs into a job `environment:` block |
| zizmor | eu-cra-compliance-vulnerability-handling-auditor.lock.yml | Low/Info | undocumented-permissions, anonymous-definition, adhoc-packages (several) | Add comments/names; low priority |
| poutine | agentic_commands.yml | Medium (RGS-005) | Excessive permissions (`contents: write` etc.) on untrusted-trigger workflow | Restrict permissions or scope trigger |
| grype | ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14, ghcr.io/github/gh-aw-node:1 | Critical/High (251 findings; 50 unique CVEs/GHSAs) | Vulnerable packages incl. `curl`/`libcurl` (CVE-2026-13608/18924/19931/80229/80230/80231/80255/82208/82209), `openssl`/`libssl3`/`libcrypto3` (CVE-2026-63073, 75803, 14456, 14457, 18798), `brace-expansion`, `tar`, `ip-address` | Upgrade upstream base images to versions with patched packages (not fixable in this repo's workflow sources) |
| grant | Same 4+1 container images | policy violation | 1250 license-policy findings (GPL/LGPL/ad-hoc licenses e.g. libdatrie1, media-types, libkrb5-3) | Requires upstream image/license-policy review; not fixable via workflow `.md` changes |
| shellcheck | Multiple `.github/graders/*-operational-value.sh` scripts | warning (SC2034) | Unused variables (WORKFLOW_NAME, SOURCE_PATH, etc.) | Low priority cleanup; export or remove unused vars |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely (e.g. upstream container image CVEs/license findings in `ghcr.io/github/gh-aw-firewall/*` and `gh-aw-node` images, which require upstream image updates rather than workflow-source changes).

Raw evidence

Summary from deterministic compiler run:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint: 47 workflows checked, 2 issues (2 errors, expression type).

Zizmor: `github-app` High finding appears 45 times across 37 distinct lock files; also several Medium (`secrets-outside-env`) and Low/Info findings limited to `eu-cra-compliance-vulnerability-handling-auditor.lock.yml`.

Poutine: 1 medium finding (RGS-005) on `agentic_commands.yml`.

Grype: scanned 9 container images total; findings concentrated in `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14` and `ghcr.io/github/gh-aw-node:1` — 34 Critical + 217 High = 251 findings, 50 unique CVE/GHSA identifiers, all with available upstream fix versions.

Grant: strict mode failed with 1250 license-policy findings across the same container images (GPL-2.0, LGPL-2.1, ad-hoc, and other licenses in system/npm packages bundled in those images).

Shellcheck: SC2034 (unused variable) warnings in several `.github/graders/*-operational-value.sh` files — cosmetic, low priority.

No token-like or credential-like values were present in the evidence reviewed.

Control plane context

- Correlation ID: `34336932736-788`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34336932736`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34336932736) · copilot · auto · 32.4 AIC · ⌖ 7.36 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 10:08 AM UTC

Start with the affected .github/workflows/*.md sources, especially those generating self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml, and agentic_commands.yml; use the gh aw MCP server's compile and fix tools. Review generated lock-file diffs and rerun the full compiler and security scan. Done means fixable workflow-source findings pass while any upstream image findings are documented as requiring upstream changes.

Written by the indexing model from the issue text.