[aw-doctor:compiler-security] Compiler & security scan findings: 47 workflows (actionlint, zizmor, grant, grype, runner-guard)

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` succeeded, but the full validation/security suite (`actionlint`, `zizmor`, `poutine`, `runner-guard`, `grant`, `grype`, `syft`) exited non-zero. Findings span 2 actionlint type errors, 1 runner-guard taint warning, 6 zizmor rule categories (37–47 files each, none Critical/High beyond one recurring High), 39 distinct High/Critical CVEs (grype) across 4 firewall/proxy container images, and 1,250 license-policy violations (grant) across 9 images — mostly copyleft (GPL/LGPL family) and public-domain licenses flagged against the repo's minimal `.grant.yaml` allow-list, which does not currently declare an allowed-license list. Highest-severity supported finding: grype `[Critical]` CVEs (e.g. CVE-2026-18924/CVE-2026-19931 in curl/libcurl, CVE-2026-5450/63073/75803 in the squid image) in third-party `gh-aw-firewall` container images, which are pulled by digest and not owned by this repo's workflow sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in that job's needs-context type (`GIT_TOKEN` fallback expression) | Fix source `.md` so the `Configure Git credentials` step's job correctly `needs:` the `safe-outputs-app-token` job (or drop the unresolved fallback), then recompile |
| zizmor | 37 of 47 lock files | High | `github-app`: dangerous use of GitHub App tokens | Review each flagged job's App-token usage per zizmor's `github-app` audit guidance; scope token permissions/lifetime as recommended |
| zizmor | all 47 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-referencing jobs to a job-level `environment:` block |
| zizmor | 16 lock files | Medium | `artipacked`: credential persistence risk via uploaded Actions artifacts (checkout persists credentials before artifact upload) | Set `persist-credentials: false` on checkout steps preceding artifact uploads, or scrub credentials before upload |
| zizmor | all 47 lock files | Low | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission scope in workflow sources |
| zizmor | 25 lock files | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g ...`) outside pinned/lockfile-managed steps | Pin package installs to specific versions/lockfiles where feasible |
| zizmor | 3 lock files (`optimization-ai-credit-auditor`, `optimization-ai-credit-optimizer`, `self-care-docs-build-time-investigator`) | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify flagged expressions per zizmor's `obfuscation` audit guidance |
| runner-guard | `.github/workflows/agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` combined with an externally-triggerable event (`pull_request_target`/`issue_comment`/etc.) | Confirm this is an accepted/intended design (command dispatch); if not required, drop write permissions or restrict trigger to trusted actors |
| grype | `gh-aw-firewall/api-proxy:0.28.14`, `gh-aw-firewall/cli-proxy:0.28.14`, `gh-aw-firewall/squid:0.28.14` (curl/libcurl and other packages) | Critical | 5 distinct Critical CVEs (e.g. CVE-2026-18924, CVE-2026-19931, CVE-2026-5450, CVE-2026-63073, CVE-2026-75803) | These are third-party pinned firewall images, not workflow-source-controlled; report upstream to `gh-aw-firewall` maintainers or bump the pinned digest once patched images are published |
| grype | `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-node` | High | 34 distinct High CVEs/GHSAs (npm `brace-expansion`, `tar`, `ip-address`; curl/libcurl CVEs; others) | Same as above — track and bump pinned image digests when upstream fixes are published |
| grant | 9 container images (alpine, node, gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server) | error (policy) | 1,250 license-policy violations — predominantly ISC, MIT, GPL-2.0/3.0 family, LGPL family, BSD, Apache-2.0, and public-domain licensed packages baked into these third-party base images | `.grant.yaml` currently declares only `allowed-owners`/`allowed-repos`/`permissions` and no `allowed-licenses` list, so grant's default policy rejects nearly every license in scanned images; add an explicit `allowed-licenses` (or `license-policy`) section to `.grant.yaml` reflecting the org's actual license posture, or scope grant's license check to first-party dependencies only |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: the `actionlint` error involves an unresolved `safe-outputs-app-token` step reference in `self-care-dashboard-performance.md` and `self-care-pages-health.md` — verify the job dependency graph. The `grant` license-policy violations stem from `.grant.yaml` lacking an `allowed-licenses` policy for third-party base images; if adding license coverage is out of scope for source changes, stop and explain that this needs a policy-file decision rather than a workflow-source fix. The `grype` Critical/High CVEs are in third-party `gh-aw-firewall` container images pinned by digest — if no patched digest is available upstream, stop and report as needing upstream action rather than a workflow-source fix.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Zizmor finding counts by audit (across 47 files, deduplicated by rule):
```
402 [Medium] secrets-outside-env
271 [Low] undocumented-permissions
45 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
3 [Low] obfuscation
```

Grant: `strict mode: grant found 1250 license policy finding(s) in container images` (exit: grant failed).

Grype: 5 distinct Critical CVE IDs and 34 distinct High CVE/GHSA IDs across `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, and `gh-aw-node` images (9 images scanned total by syft/grype).

Runner-guard: 1 finding — `RGS-005` (Medium) in `.github/workflows/agentic_commands.yml`.

No token-like or credential-like values were present in the raw tool output; none redacted.

Control plane context

- Correlation ID: `34359585793-814`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34359585793

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34359585793) · copilot · auto · 59 AIC · ⌖ 7.81 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 2:10 PM UTC

Start with the two named workflow sources, self-care-dashboard-performance.md and self-care-pages-health.md, then inspect .github/workflows/agentic_commands.yml and .grant.yaml. Run the gh-aw compiler and full validation suite to reproduce the findings, reviewing generated lock-file diffs rather than editing them. Done means source changes pass the compiler and scans, with any third-party image or policy blockers explicitly reported.

Written by the indexing model from the issue text.