[aw-doctor:compiler-security] gh-aw compiler run found actionlint, zizmor, runner-guard, grype, grant, and shellcheck findings across 47 workflows

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` failed (exit code 1). Findings span 2 actionlint expression errors, 1,110 zizmor findings (45 High), 1 runner-guard medium finding, 642 grype container CVEs (34 Critical), 1,250 grant license-policy violations (strict-mode failure, the actual cause of the non-zero exit), and shellcheck warnings in 12 grader scripts. Highest tool-reported severity: **Critical** (grype, container base-image CVEs). Poutine and yamllint reported no findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.md`, `self-care-pages-health.md` | error | `steps.safe-outputs-app-token.outputs.token` referenced but that step output isn't defined in the job's output type | Fix the step id / job-output wiring for the app-token step in the workflow source, then recompile |
| zizmor | 45 lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `dependabot*`, `eu-cra-compliance*`, `self-care*`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Review each flagged step against zizmor's github-app audit guidance; confirm existing env-gating (`CAO_GITHUB_APP_ID != ''`) is sufficient or add scoping |
| zizmor | most lock files (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs into a dedicated `environment:` block |
| zizmor | e.g. `dashboard-authoring-corpus`, `dependabot-release-train-updater` (29 occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts | Add `persist-credentials: false` to `actions/checkout` steps that don't require push access |
| zizmor | multiple lock files (271 occurrences) | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | multiple lock files (26 occurrences) | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor installs or document rationale |
| zizmor | 3 occurrences | Low | `obfuscation` | Review flagged expressions |
| runner-guard | `.github/workflows/agentic_commands.yml` | medium (RGS-005) | Command-dispatcher workflow triggered by untrusted `issue_comment`-style events specifies write-level permissions | Restrict permissions to read-only at the trigger job, or add `allowed-repos`/`required-labels` gating before granting write scope |
| grype | 9 images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`) | Critical (34) / High (172) / Medium (355) / Low (54) / Negligible (27) | Known CVEs in base OS and npm packages, e.g. `GHSA-rgw5-rvv9-x895`/`GHSA-mh99-v99m-4gvg` (brace-expansion), `GHSA-r292-9mhp-454m` (tar), `CVE-2023-50387` (bind9-libs) | Requires upstream base-image/dependency bumps in the referenced container images; not addressable by editing workflow `.md` sources alone — flag to the image maintainers |
| grant | 9 images (1,250 findings total) | error (policy) | License-policy violations under strict mode (GPL-2.0-only/or-later, LGPL variants, ISC, MIT, BSD, etc. flagged as disallowed) | This is the finding that fails the compiler run (`strict mode: grant found 1250 license policy finding(s)`). Review whether the license allow-list is intentionally strict or needs adjustment; violations originate from third-party image contents, not workflow sources |
| shellcheck | 12 `.github/graders/*-operational-value.sh` scripts | warning (SC2034) | Env vars declared (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) but appear unused in script body | Remove unused variables or add `# shellcheck disable=SC2034` with justification if intentionally exported |
| poutine | — | none | No findings reported | n/a |
| yamllint | — | none | No findings reported | n/a |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- `summary.txt`: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 47`, `Compiled locks: 47`
- `git-status.txt`: `?? .poutine.yml` (new config artifact generated by the scan run, untracked, not a code change)
- Full raw `report.txt` is 9,579 lines / ~697 KB; representative excerpts:

```
.github/workflows/self-care-dashboard-performance.lock.yml:2265:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2171:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

```
./.github/workflows/aw-doctor.lock.yml:1510:15: error: [High] github-app: dangerous use of GitHub App tokens ((docs.zizmor.sh/redacted)
```

```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger - ...
```

```
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: [High] GHSA-rgw5-rvv9-x895: brace-expansion@5.0.7 (fix: 5.0.9)
```

```
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: license policy violation: libmnl0@1.0.4-3build2 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only)
```

```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

No token-like or credential-like values were observed in the tool output.

Control plane context

- Correlation ID: `34390973653-121`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34390973653

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34391415922) · copilot · auto · 51.6 AIC · ⌖ 9.62 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 7:09 PM UTC

Start with .github/workflows/self-care-dashboard-performance.md, self-care-pages-health.md, and .github/workflows/agentic_commands.yml, then inspect the 12 .github/graders/*-operational-value.sh scripts. Run the gh-aw compiler and its full security scan without editing generated .lock.yml files. Done means workflow-source findings are resolved and the full scan passes, or upstream container and license-policy blockers are clearly documented.

Written by the indexing model from the issue text.