[aw-doctor:compiler-security] gh-aw compiler & security scan: 34 Critical / 217 High findings, license-policy failure across 47 workflows

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` completed with **exit code 1** (not clean). The compiler/lint/scan suite reported: 2 actionlint expression errors, 34 Critical + 217 High severity findings (zizmor + grype combined), 402 zizmor Medium secrets-outside-env findings, 1 runner-guard Medium taint finding, 12 shellcheck warnings, and a **failed `grant` license-policy check with 1250 findings** across 9 pinned container images. Highest-severity supported findings: grype Critical CVEs (e.g. CVE-2026-75803 in libssl3/libcrypto3, CVE-2026-19931/CVE-2026-18924 in curl/libcurl) in the firewall, mcpg, node, and github-mcp-server images, plus 45 zizmor High `github-app` findings across 36 lock files. Recommended next action: assign to Copilot to fix compiler/actionlint issues and bump vulnerable pinned image digests, then re-run the full scan.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | High (error, ×2) | `[expression]` property `safe-outputs-app-token` is not defined on the referenced job-output object type | Fix the `.github/workflows/*.md` source generating this output reference and recompile; do not hand-edit the `.lock.yml` |
| zizmor | 36 lock files (45 occurrences, e.g. `aw-doctor`, `aw-failures-investigator`, `self-care*`, `eu-cra-compliance*`) | High | `github-app`: dangerous use of GitHub App tokens | Review each GitHub App token acquisition/use per (docs.zizmor.sh/redacted) and scope to least privilege |
| zizmor | all 47 lock files (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a job/step `environment:` block per (docs.zizmor.sh/redacted) |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: excessive write permissions (`contents`/`packages`/`id-token`/etc.) on a workflow triggerable by external actors (`pull_request_target`/`issue_comment`) | Reduce permissions to read-only for untrusted-trigger jobs or gate write access behind an authorization check |
| grype | 9 container images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`) | Critical (34), High (172) | Known CVEs in pinned base image layers, e.g. CVE-2026-75803/CVE-2026-63073 (libssl3/libcrypto3), CVE-2026-19931/CVE-2026-18924 (curl/libcurl), CVE-2026-5450/CVE-2026-5928 (libc6), multiple Go stdlib/grpc GO-2026-xxxx advisories in `gh-aw-mcpg` | Bump each pinned image tag/digest in the `.md` workflow container declarations to a version with the CVE fix, then recompile to refresh pinned digests |
| grant | 9 container images | Findings (1250), strict-mode failure | License policy violations for packages under ISC, MIT, GPL-2.0/3.0, LGPL, BSD variants, etc. not on the allow-list (e.g. `spdx-expression-parse@4.0.0` (MIT) in 5 images) | Update the `grant` license allow-list policy if these licenses are acceptable, or replace/remove the offending packages/images |
| shellcheck | 12 grader scripts under `.github/graders/*-operational-value.sh` | Low | SC2034: sourced variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`, `FRAMEWORK`) appear unused | Confirm these are consumed externally (grader harness) and add `# shellcheck disable=SC2034` with a comment, or remove if truly unused |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- `git-status.txt`: `?? .poutine.yml` (untracked poutine config left by the scan run; not a code finding)
- `diff-stat.txt`: empty (no source changes made by the compile/scan step)
- Severity totals across the full `report.txt` (697 KB, 9579 lines): `[Critical]` ×34, `[High]` ×217 (45 zizmor + 172 grype), `[Medium]` ×786 grype + 402 zizmor + 1 runner-guard, `[Low]` ×354 grype + 26 zizmor (undocumented-permissions/adhoc-packages), `[Informational]` ×288, `[Negligible]` ×27, `[Unknown]` ×18
- Actionlint summary: "Checked 47 workflow(s)" / "Found 2 issue(s) (2 error(s))" / issues by type: `expression: 2`
- Poutine and syft ran to completion (poutine reported no additional findings beyond runner-guard/zizmor coverage; syft produced SBOMs for all 9 scanned images)
- No token-like or credential-like values were present in the scanned output

Control plane context

- Correlation ID: `34366226346-820`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34366226346`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34366226346) · copilot · auto · 62.9 AIC · ⌖ 10.2 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 3:11 PM UTC

Start by reading the two workflow sources producing the actionlint errors under `.github/workflows/*.md`, then inspect the container declarations, `agentic_commands.yml`, and `.github/graders/*-operational-value.sh` noted in the report. Re-run the full compiler and security scan after each source-level change; done means all 47 workflows compile cleanly and the required validation tools report no findings, without editing generated `.lock.yml` files.

Written by the indexing model from the issue text.