[aw-doctor:compiler-security] Compiler & security scan findings across 47 workflows (exit code 1)

Compiling all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` succeeded, but the full validation/lint/security suite exited with code 1. Findings span: 2 actionlint expression errors, 45 High zizmor `github-app` findings (GitHub App token misuse pattern reused across nearly every workflow), 402 Medium `secrets-outside-env`, 29 Medium `artipacked`, 34 Critical/172 High grype CVEs across 9 container images (notably `alpine:latest` libcrypto3/libssl3 CVE-2026-63073 and a `brace-expansion` GHSA-rgw5-rvv9-x895 High in the firewall agent image), and 1250 grant license-policy violations in container images (mostly GPL/LGPL-tainted packages bundled in base images). No action needed on container base-image license/CVE findings beyond upstream image updates; the actionlint errors and github-app pattern are directly fixable in workflow sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in expression context | Fix the source `.md` step reference/output name so the generated expression matches an actual step id/output |
| zizmor | 20 workflows incl. `aw-doctor`, `aw-failures-investigator`, `dependabot`, `eu-cra-compliance*`, `optimization*` | High | `github-app`: dangerous use of GitHub App tokens | Review App-token minting/usage pattern for least-privilege scoping; follow zizmor guidance to avoid broad token exposure |
| zizmor | most workflows (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without dedicated environment | Move secret references into a scoped `environment:` block where feasible |
| zizmor | `dashboard-authoring-corpus`, `dependabot-release-train-updater`, others (29) | Medium | `artipacked`: credential persistence via uploaded artifacts | Ensure checkout/artifact steps don't persist credentials (`persist-credentials: false`) |
| zizmor | most workflows (271) | Low | `undocumented-permissions`: permissions block lacks explanatory comments | Add comments explaining each granted permission |
| zizmor | many workflows (26) | Low | `adhoc-packages`: ad-hoc package installs | Pin package installs / use lockfiles where practical |
| zizmor | `pr-reviewer` and others (9) | Informational | `template-injection`: code injection via template expansion | Review templated expressions for untrusted input interpolation |
| zizmor | `optimization-ai-credit-auditor`, `optimization-ai-credit-optimizer`, `self-care-docs-build-time-investigator` (3) | Low | `obfuscation`: obfuscated Actions feature usage | Simplify expression/step usage flagged by zizmor |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-75803 (libcrypto3/libssl3) + other 2026 CVEs | Bump base image tag / rebuild when upstream `alpine:latest` ships patched OpenSSL |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` | High | GHSA-rgw5-rvv9-x895 `brace-expansion@5.0.7` (fix 5.0.9); ~30 Medium bind9-libs/perl CVEs | Upgrade firewall agent image / bump `brace-expansion` dependency upstream |
| grype | other 7 images (api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, node) | High/Medium | Various upstream CVEs (see raw evidence) | Track upstream image releases; not directly fixable in this repo's workflow sources |
| grant | 9 container images | error (policy) | 1250 license-policy violations (GPL/LGPL/Artistic/etc. transitively bundled in base OS + npm packages) | Requires license-policy exception review or upstream image change; not fixable via workflow `.md` edits |

Deduplication note: the same `github-app` and `secrets-outside-env` rule fires once per matrix/job repetition within each lock file (5–6 occurrences per workflow) because each workflow lock file defines the pattern in multiple generated jobs; counts above are as reported by zizmor without further collapsing beyond per-rule aggregation.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Priority order: (1) fix the 2 actionlint expression errors referencing `safe-outputs-app-token` in `self-care-dashboard-performance.md` and `self-care-pages-health.md`; (2) address the 45 High `github-app` zizmor findings; (3) address `secrets-outside-env` and `artipacked` Medium findings. Container image CVE (grype) and license-policy (grant) findings originate from upstream base images and third-party actions and generally cannot be fixed by editing workflow `.md` sources alone — stop and report those as requiring an upstream image/dependency bump or license-policy exception rather than attempting workarounds.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint: `Found 2 issue(s) (2 error(s))` — both `expression` type, `safe-outputs-app-token` output not defined in step-outputs object.

Zizmor rule totals (47 files scanned): `secrets-outside-env` Medium ×402, `anonymous-definition` Informational ×279, `undocumented-permissions` Low ×271, `github-app` High ×45, `artipacked` Medium ×29, `adhoc-packages` Low ×26, `template-injection` Informational ×9, `obfuscation` Low ×3.

Grype: 34 Critical + 172 High findings across 9 scanned container images (`ghcr.io/github/gh-aw-firewall/agent:0.28.14`, `api-proxy:0.28.14`, `cli-proxy:0.28.14`, `squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.18`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.11.0`, `alpine:latest`, `node:lts-alpine`). Sample distinct CVE/GHSA IDs: CVE-2026-63073, CVE-2026-75803, CVE-2026-76641/76642/76956/76957, CVE-2026-78408/78409/78410, CVE-2026-80229/80230/80231/80255, CVE-2026-82208/82209, GHSA-rgw5-rvv9-x895 (brace-expansion), GHSA-hfg8-hc9c-6c3h, GHSA-mh99-v99m-4gvg, GHSA-r292-9mhp-454m, GHSA-vp52-pcj8-j9qc.

Grant: `strict mode: grant found 1250 license policy finding(s) in container images` (final failing line, exit code 1 driver). Sample violating packages: `libaudit1` (GPL-1.0/GPL-2.0/LGPL-2.1), `libuuid1`, `libxtables12` (Artistic/GPL), `mawk` (GPL-2.0), `libtiff5` (Hylafax), `sigstore@4.1.1` (Apache-2.0 flagged), and many transitive npm packages (ISC/MIT) in the firewall agent image.

No credential-like or token-like values were present in the sampled evidence; none redacted beyond standard truncation.

Control plane context

- Correlation ID: `34342103274-794`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34342103274

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34342103274) · copilot · auto · 49.3 AIC · ⌖ 7.72 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 11:05 AM UTC

Start with .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, then review the other workflow sources named in the scan. Use the gh aw MCP server's fix and compile tools rather than editing generated .lock.yml files, and rerun the strict validation and security suite. Done means the actionable workflow findings are resolved and the full scan passes, with upstream image findings documented if they remain.

Written by the indexing model from the issue text.