[aw-doctor:compiler-security] Findings: 2 actionlint errors, 1,332 zizmor findings, 39 High/Critical container CVEs, grant license-policy failure (1,250)

Compiling all 47 workflow sources in `githubnext/gh-aw-cao` succeeded, but the full validation/lint/security suite failed (exit code 1). Findings span 2 actionlint expression errors, 1,332 zizmor findings (45 High `github-app`, 402 Medium `secrets-outside-env`, 29 Medium `artipacked`), 39 distinct High/Critical container CVEs (grype) across 6 of 9 scanned images (worst: `alpine:latest`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy` with Critical `curl`/OpenSSL CVEs), 1 Medium taint finding (runner-guard RGS-005), 68 shellcheck SC2034 warnings, and a hard failure from `grant` (1,250 license-policy findings in strict mode) that alone caused the non-zero exit. Highest-severity, highest-confidence issue: grype `[Critical]` CVEs in `curl`/`libcurl` (CVE-2026-18924, CVE-2026-19931) on `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14` and `cli-proxy:0.28.14`, and OpenSSL CVE-2026-63073/CVE-2026-75803 on `alpine:latest`, all with available upstream fixes.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|--------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token.outputs.token` referenced but step not defined in that job's step-outputs type | Fix the workflow source's app-token step id/reference so the referenced step exists in the same job, then recompile |
| zizmor | 36 lock files (e.g. `aw-doctor.lock.yml:1510`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review scoping/lifetime of generated app tokens per zizmor guidance; narrow token permissions where possible |
| zizmor | 24 lock files | Medium | `secrets-outside-env` (402 occurrences): secrets referenced without a dedicated `environment:` | Move secret-referencing steps into a dedicated GitHub Environment where feasible |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml` | Medium | `artipacked` (29 occurrences): credential persistence through uploaded artifacts | Ensure checkout/persist-credentials is disabled before artifact upload steps |
| zizmor | multiple | Low/Informational | `undocumented-permissions` (271), `anonymous-definition` (279), `adhoc-packages` (26), `obfuscation` (3) | Lower priority; add permission comments and named definitions where practical |
| zizmor | `optimization-ai-credit-*.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` | Informational | `template-injection` (9): `${{ '' }}` obfuscated expression usage | Cosmetic; simplify to a literal empty string assignment |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3` ``@3``.5.7-r0 (fix: 3.5.8-r0) | Bump base image / apk packages to pick up OpenSSL fix |
| grype | `gh-aw-firewall/api-proxy:0.28.14`, `cli-proxy:0.28.14` | Critical | CVE-2026-18924, CVE-2026-19931: `curl`/`libcurl` ``@8``.21.0-r0 (fix: 8.22.0-r0) | Rebuild/update firewall proxy images to pull patched curl |
| grype | 6 of 9 images (39 distinct CVE/GHSA IDs total) | High | Includes `GHSA-rgw5-rvv9-x895`/`GHSA-mh99-v99m-4gvg` (brace-expansion), `GHSA-r292-9mhp-454m` (tar), `GHSA-mwp4-54f8-5fhr` (ip-address) in `gh-aw-firewall/agent`; additional High CVEs concentrated in `squid` (45) and `gh-aw-mcpg` (52) images | Update vulnerable npm/apk packages in each image per fix versions shown; rebuild and re-scan |
| grant | 9 of 9 container images | error (strict) | 1,250 license-policy findings (largest counts: `gh-aw-firewall/agent` 381, `api-proxy` 185, `cli-proxy` 178, `gh-aw-node` 176, `node` 164) — many are copyleft (GPL/LGPL family) or unclassified/custom licenses in transitive OS/npm packages | Review `grant` policy allowlist vs. actual base-image license inventory; this single failure caused the overall non-zero exit and blocks strict-mode compliance |
| runner-guard (poutine) | `agentic_commands.yml` | Medium | `RGS-005`: write-level `permissions:` on a job reachable by an untrusted trigger (`pull_request_target`/`issue_comment`-class event) | Scope down permissions for that trigger or move privileged steps to a separate, trigger-gated job |
| shellcheck | 12 grader scripts under `.github/graders/*.sh` | warning | `SC2034` (68 occurrences): variables assigned (e.g. `WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`) but apparently unused | Confirm intended external use (export) or remove unused assignments |
| yamllint | — | — | No findings reported | — |
| poutine | — | — | No standalone poutine findings beyond the runner-guard taint result above | — |

Untracked file `.poutine.yml` was observed in the working tree (uncommitted); not evaluated as a compiler/scanner finding.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint (2 expression errors):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2265:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...; setup: ...; setup-agent-output-env: ...}
GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/self-care-pages-health.lock.yml:2171:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...; setup: ...; setup-agent-output-env: ...}
GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
```

Grant strict-mode failure (final line):
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Full report is 9,579 lines (~697KB); the table above summarizes all categories and top offenders. No token-like or credential-like values were found in the reviewed output.

Control plane context

- Correlation ID: `34378676901-119`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34378676901

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34379177259) · copilot · auto · 44.1 AIC · ⌖ 8.38 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 5:09 PM UTC

Start with the source workflows under `.github/workflows/*.md`, especially the sources for `self-care-dashboard-performance`, `self-care-pages-health`, and `agentic_commands.yml`; do not edit generated `.lock.yml` files. Run the gh-aw MCP `compile` and full validation/security suite first, then address findings in the sources. Done means compilation and the required actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft checks pass.

Written by the indexing model from the issue text.