[aw-doctor:compiler-security] Compiler & security scan findings: gh-aw-cao (exit 1, 34 critical CVEs, 45 high zizmor, grant policy failed)

Compiler run for `githubnext/gh-aw-cao` (target SHA `4c1539d2`) exited **1** across 47 workflow sources / 47 compiled locks. Findings: 2 actionlint errors (High, compiler-level type errors), 45 zizmor High findings (`github-app` — dangerous GitHub App token use, one per workflow using the shared app-token pattern), 431 zizmor Medium (`secrets-outside-env`, `artipacked`), grype found **34 Critical / 172 High** CVEs across the 9 pinned container images (mostly `curl`/`openssl`/`libcrypto3` in Alpine-based images), and `grant` failed strict license-policy checks with 1250 findings (many against common permissive licenses such as MIT/ISC/Apache-2.0, suggesting the policy allowlist is too narrow rather than a genuine license violation). Highest-severity actionable, source-fixable issue: the 2 actionlint compiler errors referencing an undefined `safe-outputs-app-token` step output.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2265`, `self-care-pages-health.lock.yml:2171` | High | `property "safe-outputs-app-token" is not defined` — expression references a step id/output that does not exist in the job's step map | Fix the step-id reference (or add the missing `safe-outputs-app-token` step output) in the corresponding `.md` source, then recompile |
| zizmor | 36 workflow locks (all using the shared GitHub App token pattern) | High | `github-app`: dangerous use of GitHub App tokens | Review whether the flagged step needs the app token at that scope; scope down permissions or add zizmor suppression with justification if intentional |
| zizmor | multiple workflows | Medium | `secrets-outside-env` (402x), `artipacked` (29x, credential persistence via uploaded artifacts) | Route secrets through a dedicated `env:`/`environment:`; ensure `actions/checkout` steps that may persist credentials set `persist-credentials: false` |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14`, `cli-proxy:0.28.14`, `squid:0.28.14`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine` | Critical (34), High (172) | Unpatched `curl`/`libcurl` (CVE-2026-19931, CVE-2026-18924), `openssl`/`libcrypto3`/`libssl3` (CVE-2026-63073, CVE-2026-75803), `libc6` (CVE-2026-5450) | Bump pinned image digests to versions carrying the patched packages; re-run grype after bump |
| grant | 9 container images | unknown (strict-mode policy error) | 1250 license-policy violations, majority against common permissive licenses (MIT, ISC, Apache-2.0, BSD) | Review `.grant.yaml` allowlist — the current policy appears to omit common permissive licenses rather than reflect a genuine legal issue; confirm intended license allowlist with a maintainer before broadening it |
| shellcheck | 14 `.github/graders/*-operational-value.sh` scripts | Low (SC2034) | Grader template variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) reported unused | Confirm these are consumed via external sourcing/templating; if genuinely unused, remove or `export`/reference them |

Untracked file `.poutine.yml` was present in the working tree at scan time (not part of the compiled diff).

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Zizmor severity distribution: 45 High, 431 Medium, 300 Low, 288 Informational.
Grype severity distribution across 9 images: 34 Critical, 172 High, 355 Medium, 54 Low, 27 Negligible, 18 Unknown.
Grant: `strict mode: grant found 1250 license policy finding(s) in container images`.
Actionlint: `Found 2 issue(s) (2 error(s))`, both `[expression]` type errors on `safe-outputs-app-token`.

Full raw report (697 KB) was reviewed in full; only representative excerpts above are reproduced here to bound issue size. No token-like or credential-like values were present in the tool output.

Control plane context

- Correlation ID: `34403206740-859`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34403206740`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34403206740) · copilot · auto · 47.9 AIC · ⌖ 9 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 9:07 PM UTC

Start with the `.github/workflows/*.md` sources corresponding to the actionlint errors in `self-care-dashboard-performance.lock.yml:2265` and `self-care-pages-health.lock.yml:2171`; do not edit generated locks. Run the compiler and listed security checks, then review `.grant.yaml`, container image references, and `.github/graders/*-operational-value.sh`. Done means the full strict scan passes or a maintainer-approved exception is documented.

Written by the indexing model from the issue text.