[aw-doctor:compiler-security] Compiler validation failed: 2 actionlint errors, 1679 zizmor findings, 660 grype vulnerabilities (34 Critical), 1250 grant licen

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` succeeded, but the full validation/lint/container/security suite failed (exit code 1). Findings span 2 actionlint errors, 1679 zizmor findings (45 High, 431 Medium, 300 Low, 288 Informational), 1 poutine/runner-guard Medium finding, 660 grype container-image vulnerabilities (34 Critical, 116 High, 66 Medium, 25 Unknown), and 1250 grant license-policy violations across 8 base images — the license-policy failures alone caused the non-zero exit. Highest-severity supported findings: **Critical** CVE-2026-63073/CVE-2026-75803 (libssl3/libcrypto3) and CVE-2026-18924/CVE-2026-19931 (curl/libcurl) present in 6+ container images used by workflow steps, and **High** zizmor `github-app` (dangerous use of GitHub App tokens) in 37 of 47 lock files. Recommended next action: assign remediation to Copilot via the agent prompt below, prioritizing the actionlint regression and the github-app finding, then track the grype/grant base-image findings separately since they originate from upstream gh-aw runtime images, not workflow source.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | Error | `safe-outputs-app-token` step-output property not defined on referenced job outputs (expression check) | Fix the `.md` source generating this step reference/output wiring, recompile |
| zizmor | 37 workflow lock files | High | `github-app`: dangerous use of GitHub App tokens | Review token scoping/exposure per zizmor doc; scope down or document accepted risk |
| zizmor | 47 workflow lock files | Medium | `secrets-outside-env` (804 instances): secrets referenced without a dedicated `environment:` | Move secret-consuming jobs into a declared GitHub Environment where feasible |
| zizmor | 16 workflow lock files | Medium | `artipacked` (58 instances): credential persistence through uploaded Actions artifacts | Ensure `actions/checkout` credentials aren't persisted before artifact upload steps |
| zizmor | 47 workflow lock files | Low | `undocumented-permissions` (542 instances): `permissions:` blocks lack explanatory comments | Add comments justifying each granted permission |
| zizmor | 25 workflow lock files | Low | `adhoc-packages` (52 instances): ad-hoc package installs in run steps | Pin package installs via lockfiles/vendored actions where practical |
| zizmor | 3 workflow lock files | Low | `obfuscation` (6 instances): obfuscated GitHub Actions feature usage | Simplify expressions flagged by zizmor for clarity/auditability |
| zizmor | 47 workflow lock files | Informational | `anonymous-definition` (558 instances): workflow/job definitions without a `name:` | Add descriptive `name:` fields |
| zizmor | 3 workflow lock files | Informational | `template-injection` (18 instances): potential code injection via template expansion | Confirm expanded values are not attacker-controlled; quote/sanitize if needed |
| poutine / runner-guard | `.github/workflows/agentic_commands.yml` | Medium | `RGS-005`: write-level `permissions:` combined with an externally-triggerable event | Confirm trigger context and reduce permissions to least privilege if untrusted-triggerable |
| grype | 9 container images (`gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`) | Critical (34), High (116) | CVE-2026-63073/75803 (libssl3/libcrypto3), CVE-2026-18924/19931 (curl/libcurl), CVE-2026-5450 (libc6), and others; fixed versions available for most alpine-based CVEs | Bump/rebuild upstream gh-aw runtime images (`gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`) to pull patched Alpine/Debian packages; out of scope for this repo's workflow sources |
| grant | 8 container images (`gh-aw-node`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `github-mcp-server`, `node:lts-alpine`, `alpine:latest`) | Policy violation (1250 total) | GPL-2.0/ISC/MIT/etc. packages flagged by strict license policy (e.g. `busybox`, `alpine-baselayout`, npm transitive deps) | Review/relax `.poutine.yml`/grant policy allowlist for accepted OSS licenses in base images, or swap flagged packages upstream |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Bounded excerpts from the deterministic compiler/scanner run (full report: 9579 lines, redacted for token-like values — none found in excerpts below):

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint (2 errors):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2287:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2193:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Zizmor severity totals: High 45, Medium 431, Low 300, Informational 288 (1064 total flagged lines; rule breakdown in table above).

Poutine/runner-guard:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Grype (per-image severity counts, most affected first):
```
ghcr.io/github/gh-aw-firewall/agent:0.28.14 Medium:286 High:4
ghcr.io/github/gh-aw-mcpg:v0.4.18 High:48 Medium:19 Critical:4 Unknown:7
ghcr.io/github/gh-aw-firewall/squid:0.28.14 High:35 Critical:10 Medium:7 Unknown:2
node:lts-alpine High:18 Medium:10 Critical:4
ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.14 High:18 Medium:9 Critical:4 Unknown:2
ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14 High:18 Medium:10 Critical:4 Unknown:2
alpine:latest High:14 Medium:5 Critical:4
ghcr.io/github/gh-aw-node High:11 Medium:4 Critical:2 Unknown:1
ghcr.io/github/github-mcp-server:v1.11.0 High:6 Medium:5 Unknown:4 Critical:2
```

Grant license-policy violation counts per image:
```
ghcr.io/github/gh-aw-firewall/agent:0.28.14 381
ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14 185
ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.14 178
ghcr.io/github/gh-aw-node 176
node:lts-alpine 164
ghcr.io/github/gh-aw-mcpg:v0.4.18 80
ghcr.io/github/gh-aw-firewall/squid:0.28.14 63
alpine:latest 16
ghcr.io/github/github-mcp-server:v1.11.0 7
```

Working-tree change from the run: `?? .poutine.yml` (untracked scanner config artifact; no diff-stat changes reported).

Control plane context

- Correlation ID: `34353889785-808`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34353889785`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34353889785) · copilot · auto · 47.9 AIC · ⌖ 10.2 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 1:17 PM UTC

Start with the compiler and security scan, then inspect the .md sources for self-care-dashboard-performance and self-care-pages-health that generate the reported lock-file errors. Read .github/workflows/agentic_commands.yml and the zizmor findings before reviewing the broader workflow sources and referenced container images. Done means the in-scope compiler and security checks pass, with upstream image findings explicitly separated or explained.

Written by the indexing model from the issue text.