[aw-doctor:compiler-security] gh-aw compiler security scan found actionlint, zizmor, grant, grype, and runner-guard findings in githubnext/gh-aw-cao

The gh-aw compiler's full validation/lint/scanner suite failed (exit code 1) when compiling all 47 workflow sources in `githubnext/gh-aw-cao`. Findings span 5 categories: 2 actionlint expression errors, 45 zizmor High `github-app` findings, 1 runner-guard Medium finding, 1250 grant license-policy violations across 9 container images (strict-mode failure), and 1910 grype vulnerability findings (34 Critical, 172 High, 355 Medium, 54 Low, 27 Negligible) across the same 9 images. Highest severity: **Critical** — multiple CVE-2026-19931/CVE-2026-18924 (curl/libcurl RCE-class) and CVE-2026-63073 (libssl3/libcrypto3) findings in the firewall proxy and squid images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | `safe-outputs-app-token` property not defined in step-outcome object type | Fix the workflow `.md` source generating this expression reference so it only accesses defined step outputs; recompile |
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `optimization.lock.yml`, etc.) | High | `github-app`: dangerous use of GitHub App tokens | Review each workflow's App-token usage per (docs.zizmor.sh/redacted) scope token permissions/usage safely |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Excessive permissions (`contents: write` etc.) on workflow triggerable by untrusted events (`pull_request_target`/`issue_comment`) | Reduce permissions or restrict trigger scope for untrusted-context jobs |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14`, `cli-proxy:0.28.14` | Critical | CVE-2026-19931, CVE-2026-18924 in curl/libcurl@8.21.0-r0 (fix: 8.22.0-r0) | Upgrade base image / curl package to patched version |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical | CVE-2026-63073 in libssl3/libcrypto3@3.5.7-r0 (fix: 3.5.8-r0) | Upgrade OpenSSL packages in image |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.18` | High | GO-2026-6089/6090/5972/5942/5026 in stdlib@go1.26.4 (fix: 1.25.13/1.26.6/1.27.0-rc.3) | Rebuild image with patched Go toolchain |
| grype | `node:lts-alpine`, others | High/Medium | Numerous CVEs (busybox, undici, ip-address, brace-expansion, tar, openssl) — 1910 total findings (34 Critical, 172 High, 355 Medium, 54 Low, 27 Negligible) across 9 images | Upgrade all referenced container base images to latest patched tags |
| grant | 9 container images | error (strict mode) | 1250 license-policy violations (mixed OSS licenses including GPL variants) flagged by strict license policy | Review `.poutine.yml`/grant policy for acceptable license set, or adjust image contents; strict mode currently fails the build |
| poutine | — | — | No findings reported | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Deterministic compiler run summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: Checked 47 workflow(s); Found 2 issue(s) (2 error(s)), both `expression` type.

Grant summary: `strict mode: grant found 1250 license policy finding(s) in container images` — build marked failed.

Grype per-image finding counts (line count in evidence report, includes duplicate CVEs across packages): alpine 39, gh-aw-firewall/agent 737, api-proxy 219, cli-proxy 211, squid 117, gh-aw-mcpg 164, gh-aw-node 194, github-mcp-server 33, node:lts-alpine 196.

Severity totals across all images: Critical 34, High 172, Medium 355, Low 54, Negligible 27.

No secret-like or token-like values were present in the excerpted evidence; full raw report (697KB) available in the deterministic evidence artifact `/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt` from this run (not reproduced verbatim here due to size).

Control plane context

- Correlation ID: `34347000095-114`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34347000095

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34347446086) · copilot · auto · 38.9 AIC · ⌖ 18.8 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 12:08 PM UTC

Start with the 47 `.github/workflows/*.md` sources, the generated lock-file diffs, and `.poutine.yml`; use the `gh aw` MCP server's `fix` and `compile` tools rather than editing `.lock.yml` files. Re-run the full compiler and security suite named in the issue. Done means the actionlint, zizmor, runner-guard, grant, grype, and other checks pass, or an unsafe human-required finding is documented.

Written by the indexing model from the issue text.