[aw-doctor:compiler-security] AW compiler & security scan findings: 39 Critical/High CVEs, license policy failure, 2 actionlint errors

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` succeeded (47/47 lock files generated), but the compiler's full validation and security-scanner suite (exit code 1) reported real, actionable findings: 2 actionlint expression errors, 45 zizmor High-severity `github-app` findings plus hundreds of Medium/Low findings, 1 poutine excessive-permissions warning, 39 unique Critical/High CVEs across container images (grype), and 1,250 license-policy violations in the `gh-aw-node` image (grant, strict mode — this alone fails the build). Highest-severity supported finding: **Critical CVE** libssl3/libcrypto3 `CVE-2026-75803` in `node:lts-alpine` and `alpine:latest` base images used by `gh-aw-node`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step-output property not defined in referenced job's output type (expression check) | Regenerate from source `.md` after fixing the referenced step ID/output name in the workflow template; do not hand-edit the lock file |
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care*.lock.yml`) | High | `github-app`: dangerous use of `actions/create-github-app-token` for CAO pre-activation token generation | Review whether the App token step needs broader review per zizmor's `github-app` guidance; scope the token's permissions/env as tightly as possible |
| zizmor | 29 lock files | Medium | `artipacked`: credential persistence risk through GitHub Actions artifacts | Ensure artifact upload steps do not retain credential-bearing files |
| zizmor | 402 occurrences across most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-referencing jobs into a scoped `environment:` block where feasible |
| poutine / runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a job triggered by an untrusted-actor event (`issue_comment`/`pull_request_target`-class trigger) | Narrow permissions to read-only for the untrusted-trigger job, or gate write steps behind an authorization check |
| grype | `gh-aw-node` (Node.js/Alpine base) | Critical | `CVE-2026-75803`, `CVE-2026-63073` — libssl3/libcrypto3 `3.5.7-r0` (fix: `3.5.8-r0`) | Bump base image / rebuild `gh-aw-node` against updated Alpine packages |
| grype | `gh-aw-node`, `alpine:latest`, `node:lts-alpine` | High | 11+ High CVEs incl. `GHSA-r292-9mhp-454m` (tar), `GHSA-mh99-v99m-4gvg`/`GHSA-rgw5-rvv9-x895` (brace-expansion), `GHSA-mwp4-54f8-5fhr` (ip-address), multiple libssl3/libcrypto3 CVEs | Rebuild affected images with patched base packages |
| grant (license) | `ghcr.io/github/gh-aw-firewall/agent:0.28.14`, `gh-aw-node` | error (strict-mode failure) | 1,250 license policy violations (GPL-2.0/3.0, LGPL, Artistic, ISC, etc. flagged by current policy) across base-image and npm-bundled packages | Review `grant` license policy allowlist vs. actual image contents; either adjust policy for accepted OSS licenses or replace non-conforming packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priority order for this run:
1. Fix the 2 actionlint `expression` errors in `self-care-dashboard-performance.md` and `self-care-pages-health.md` (broken `safe-outputs-app-token` step-output reference) — these are hard compiler errors.
2. Investigate the `grant` license-policy failure (1,250 violations, strict mode) for the `gh-aw-firewall/agent` and `gh-aw-node` images; this is the only failure that currently blocks the compiler exit code, and it likely requires a policy-file decision rather than a code change — flag it clearly if human judgment is needed.
3. Note the Critical/High grype CVEs and zizmor `github-app`/`secrets-outside-env` findings for maintainer awareness; these are Docker-base-image and workflow-hardening items outside the `.md` source diff and may require separate image-rebuild or policy work.

Raw evidence

Compile summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: `Checked 47 workflow(s)`, `Found 2 issue(s) (2 error(s))`, issue type: `expression`.

Zizmor severity totals across all 47 lock files: 45 High, 431 Medium, 300 Low, 288 Informational.

Grype severity totals across 9 scanned container images: 34 Critical, 172 High, 355 Medium, 54 Low, 18 Unknown (39 unique CVE/GHSA IDs at Critical/High).

Grant (license scanner): `strict mode: grant found 1250 license policy finding(s) in container images` → tool exit failure.

Git status after compile (uncommitted, not part of workflow sources): `?? .poutine.yml` (new scanner config file created by the deterministic compiler step; not a workflow change).

Control plane context

- Correlation ID: `34372227170-118`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34372227170`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34372670613) · copilot · auto · 46.3 AIC · ⌖ 13.4 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 4:07 PM UTC

Start with .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, then use the gh aw MCP server's fix and compile tools. Do not edit generated .lock.yml files; rerun the listed compiler and security scans. Done means the actionlint errors and applicable findings are resolved, or any policy and image findings requiring maintainer judgment are clearly reported.

Written by the indexing model from the issue text.