[aw-doctor:compiler-security] gh-aw compiler & security scan findings: 45 High zizmor, 34 Critical/217 High image CVEs, 1250 license violations

gh-aw compiled all 47 workflows in `githubnext/gh-aw-cao` but the strict-mode compiler pipeline exited non-zero (exit code 1): 2 actionlint errors, 45 High-severity zizmor `github-app` findings, 34 Critical + 217 High vulnerability findings across 9 base container images (grype), 1250 license-policy violations across those same images (grant, strict mode fail), plus lower-severity zizmor/runner-guard/shellcheck noise. Highest-severity supported finding: Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in libssl3/libcrypto3; CVE-2026-19931/CVE-2026-18924 in curl/libcurl) present in `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, and `ghcr.io/github/github-mcp-server:v1.12.1`. Recommended next action: bump/rebuild the pinned base images to pick up patched packages, and add the missing `env:` guard for `safe-outputs-app-token` referenced in two lock files.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token.outputs.token` referenced but step id not defined in that job's `steps` context | Fix the compiler template/source so the `safe-outputs-app-token` step is emitted (or referenced) in the same job before use; recompile |
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `uk-ai-advisory.lock.yml`, ...) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@...` without scoping/permission constraints | Review app-token usage; restrict `permissions:`/scope per zizmor `github-app` guidance, or suppress with justification if pattern is intentional (CAO pre-activation) |
| zizmor | 402 findings across many lock files (e.g. `pr-sous-chef.lock.yml`, `eu-cra-compliance-package-maintainer.lock.yml`, `mattpocock-skills-reviewer.lock.yml`, `design-decision-gate.lock.yml`) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Add a dedicated `environment:` block scoping secrets in these jobs |
| zizmor | 29 findings (e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure checkout/artifact steps don't persist credentials (`persist-credentials: false`, avoid uploading `.git`) |
| zizmor | 271 findings | Low | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission (or accept as low-priority) |
| zizmor | 26 findings | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor or move to a documented setup step |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Excessive permissions on job triggered by untrusted event context | Confirm trigger is not externally-triggerable with write perms, or narrow `permissions:` |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.14` | Critical (10), High (35) | CVE-2026-63073/CVE-2026-75803 (libcrypto3/libssl3/openssl), CVE-2026-19931/CVE-2026-18924 (curl/libcurl), plus bind9-libs Medium CVEs | Rebuild image on patched Alpine base (openssl ≥3.5.8-r0, curl ≥8.22.0-r0) |
| grype | `alpine:latest` | Critical (4), High (14) | Same libcrypto3/libssl3 CVEs as above | Rebuild/refresh `alpine:latest` base layer |
| grype | `node:lts-alpine` | Critical (4), High (18) | Same libcrypto3/libssl3/curl CVEs | Rebuild/refresh `node:lts-alpine` base layer |
| grype | `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.14`, `api-proxy:0.28.14` | Critical (4 each), High (18 each) | Same curl/libcurl CVEs | Rebuild firewall proxy images with patched curl |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.20` | Critical (4), High (48) | libcrypto3/libssl3 CVEs plus additional High CVEs (CVE-2026-63076, CVE-2026-63072, CVE-2026-54874, etc.) | Bump base image / rebuild |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical (2), High (6) | CVE-2026-5450 (libc6), CVE-2026-75803 (libssl3) | Bump Debian base packages / rebuild |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` | High (4) | Additional High CVEs, no Critical found | Rebuild with patched packages |
| grant (strict) | all 9 scanned images | error (license policy) | 1250 license-policy violations across images; largest counts in `gh-aw-firewall/agent` (381), `gh-aw-node` (176), `gh-aw-firewall/api-proxy` (185), `gh-aw-firewall/cli-proxy` (178) — mostly ISC/MIT/Apache-2.0 packages flagged by strict policy | Review `grant` policy allow-list; either relax policy for compatible OSS licenses (ISC/MIT/Apache-2.0) already accepted elsewhere, or confirm these are true violations requiring image changes |
| shellcheck | 68 findings across `.github/graders/*.sh` (SC2034 unused variable warnings) | warning | Grader template variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) appear unused | Confirm these are intentionally exported/used externally, or remove unused vars from the grader script template |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Tool severity totals:
- actionlint: 2 errors (expression type)
- zizmor: 45 High, 431 Medium, 300 Low
- runner-guard: 1 Medium (RGS-005)
- grype: 34 Critical, 217 High, 355 Medium, 54 Low (across 9 container images)
- grant (strict license policy): 1250 findings, exit non-zero
- shellcheck: 68 warnings (all SC2034, grader `.sh` scripts)

Actionlint sample:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2265:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2171:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Full raw tool output (697 KB) is retained in the run's evidence artifact (`report.txt`, digest `02193b0233bd763795d70ba3288352f4a6aefd406497a2d4fd8dba7c470d6ae0`) and was not reproduced in full here to keep this issue bounded. No token-like or credential-like values were observed in the excerpted output.

Control plane context

- Correlation ID: `34385207563-840`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34385207563`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34385207563) · copilot · auto · 39 AIC · ⌖ 8.31 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 6:08 PM UTC

Start with the compiler sources in `.github/workflows/*.md` and the two reported `self-care` lock-file diagnostics; do not edit generated `.lock.yml` files. Use the `gh-aw` MCP server's `fix` and `compile` tools, then run the strict compiler and listed security checks. Done means the generated locks reflect safe source changes and the full scan passes, or an unsafe finding is documented.

Written by the indexing model from the issue text.