[aw-doctor:compiler-security] gh-aw compiler/security scan: findings in githubnext/gh-aw-cao (actionlint, zizmor, grype, grant)

Compiling all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the full gh-aw validation, lint, and security-scanner suite failed (exit code 1). Findings span 4 categories: 2 actionlint expression errors, zizmor policy findings across all 47 lock files (37 High "github-app" token findings, 402 Medium "secrets-outside-env", 29 Medium "artipacked", plus Low/Informational noise), a grype scan reporting 34 Critical and 217 High CVEs across 9 container images (most severe: CVE-2026-63073/CVE-2026-75803 in libssl3/libcrypto3, CVE-2026-18924/CVE-2026-19931 in curl/libcurl), and a `grant` strict-mode license-policy failure with 1250 findings across all scanned images. Highest-severity supported finding: Critical CVEs in shipped container images (grype).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|--------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Property `safe-outputs-app-token` not defined in step-outputs expression type | Fix expression/output reference in the `.md` source that generates this step, then recompile |
| zizmor | 37 of 47 lock files | High | `github-app`: dangerous use of GitHub App tokens (`cao_pre_activation_app_token` step) | Review conditional app-token minting logic in shared control source; scope/guard token issuance |
| zizmor | all 47 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block per zizmor guidance |
| zizmor | 16 lock files (e.g. `dependabot-release-train-updater`, `design-decision-gate`, `self-care-dashboard-performance`, `self-care-pages-health`, `pr-sous-chef`) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure checkout/artifact steps don't retain credentials (`persist-credentials: false`, avoid uploading `.git`) |
| zizmor | most lock files | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | most lock files | Informational | `anonymous-definition`: workflow/action definitions without a `name` | Add `name:` fields |
| zizmor | several lock files | Low | `adhoc-packages`: ad-hoc package installs | Pin/vendor package installation steps |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml` | Informational | `template-injection`: code injection via template expansion | Avoid direct `${{ }}` interpolation of untrusted values into `run:` scripts |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` | Low | `obfuscation`: obfuscated usage of Actions features | Simplify flagged expressions |
| grype | `ghcr.io/github/gh-aw-firewall/*:0.28.14`, `alpine:latest`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1` | Critical (34) | CVE-2026-63073/CVE-2026-75803 (libssl3/libcrypto3, fix 3.5.8-r0 or later), CVE-2026-18924/CVE-2026-19931 (curl/libcurl, fix 8.22.0-r0), CVE-2026-5450 (libc6, github-mcp-server) | Rebuild/bump base images to versions with patched packages; re-pin image digests |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.14` | High | GHSA-rgw5-rvv9-x895: `brace-expansion@5.0.7` (fix 5.0.9) | Bump npm dependency in image build |
| grype | 9 images total | High (217) / Medium (~350+) / Low | Numerous additional OS-package and npm CVEs (bind9-libs, libperl, libexpat1, libpython3.10, etc.) | Rebuild images against latest upstream base image tags |
| grant (strict license policy) | all 9 scanned container images | error (1250 findings) | GPL/LGPL/MPL/AGPL and other flagged licenses present in base-image OS packages and npm deps (e.g. GPL-3.0 `findutils`, `adduser`, `iptables`) | Review/update `.poutine.yml`/grant license allowlist policy or replace flagged packages; confirm whether flagged copyleft licenses are acceptable for distributed images |
| poutine | — | none reported | Scan ran without emitting findings in this report | — |
| runner-guard | — | none reported | Scan ran without emitting findings in this report | — |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Full compiler/scanner output: 9579 lines, `report.txt` digest `740c887778c7d633c4505428c3ccba62fd24fd86b627f06a46ef4edd73f28711`. Working tree showed one untracked file after the run: `.poutine.yml` (git-status.txt), no other diffs (diff-stat.txt empty).

Severity totals extracted from `report.txt`:
- actionlint: 2 errors (expression category)
- zizmor: 45 High (`github-app`), 402 Medium (`secrets-outside-env`), 29 Medium (`artipacked`), 271 Low (`undocumented-permissions`), 279 Informational (`anonymous-definition`), 26 Low (`adhoc-packages`), 9 Informational (`template-injection`), 3 Low (`obfuscation`)
- grype: 34 Critical, 217 High CVE/GHSA findings across `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`
- grant: 1250 license policy findings (strict mode failure) across all 9 scanned images

No token-like or credential-like values were present in the captured output.

Control plane context

- Correlation ID: `34396697845-122`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34396697845

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34397085280) · copilot · auto · 37.4 AIC · ⌖ 7.5 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 8:06 PM UTC

Start with the .github/workflows/*.md sources that generate the two failing lock files, then configure the gh aw MCP server and run its compile and fix tools. Do not edit generated .lock.yml files; review the resulting lock-file diffs and rerun the full compiler, validation, security, and image scans. Done means the reported actionlint, zizmor, grype, and grant findings are resolved or clearly escalated.

Written by the indexing model from the issue text.