[aw-doctor:compiler-security] gh-aw compiler and security scan findings — 47 workflows, exit code 1 (grant strict-mode failure, 34 Critical CVEs, 45 High gith

Compiled 47 gh-aw workflows and 47 lock files in `githubnext/gh-aw-cao` (exit code 1, target SHA `90f767ac`). The compiler and validators passed, but the scanner suite found actionable issues: 2 actionlint expression errors, zizmor security findings across 45 workflows (45 High `github-app` token misuse, 402 Medium `secrets-outside-env`, plus lower-severity noise), a Medium runner-guard excessive-permissions finding, 217 distinct CVEs (34 Critical) across 9 scanned container images via grype, and 1,250 license-policy violations via `grant` in strict mode — which is the finding that makes the overall compiler run report failure (exit code 1). No poutine or yamllint findings were reported; shellcheck flagged 12 unused-variable style warnings (SC2034) in grader scripts.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | unknown | `steps.safe-outputs-app-token.outputs.token` referenced but not a defined step output in that job context | Fix the source `.md` step ID/condition so the referenced step output exists, or guard the expression; recompile |
| zizmor | 45 workflow lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `dependabot`, `eu-cra-compliance-*`, `self-care-*`) | High | `github-app`: dangerous use of GitHub App tokens | Review App-token minting/usage per zizmor's `github-app` guidance; scope token generation narrowly and avoid exposing it beyond the minting job |
| zizmor | Same 45+ workflows (multiple occurrences each) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (402 occurrences) | Move secret references into a job/step `environment:` block per zizmor guidance, or accept via documented exception |
| zizmor | Various workflows (e.g. `dashboard-authoring-corpus`, `optimization-*`, `self-care-docs-build-time-investigator`) | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `obfuscation`, `template-injection`, `artipacked` (mostly info/low) | Lower priority; add permission comments, workflow names, avoid ad-hoc `apt`/`pip` installs where possible |
| runner-guard | `.github/workflows/agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a job reachable via untrusted trigger (`pull_request_target`/`issue_comment`-style) | Reduce job permissions to least privilege or move privileged steps behind a trusted, non-external-triggerable job |
| grype | `ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.28.14`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine` | Critical | 34 Critical CVEs, notably `CVE-2026-19931`/`CVE-2026-18924` (curl/libcurl), `CVE-2026-63073`/`CVE-2026-75803` (openssl/libssl3/libcrypto3), `CVE-2026-5450` (glibc) | Bump base images / pinned package versions to patched releases (e.g. curl ≥8.22.0-r0, openssl ≥3.5.8-r0); rebuild and rescan |
| grype | Same images (172 High findings) | High | Includes `GHSA-rgw5-rvv9-x895`/`GHSA-mh99-v99m-4gvg` (brace-expansion) among others | Update affected npm/OS packages in image build; rescan |
| grant | 9 scanned container images | unknown (policy violation, strict mode) | 1,250 license-policy violations (GPL/LGPL family licenses such as `net-tools`, `libgdbm-compat4`, `hostname`, plus many permissive/MIT/ISC/BlueOak entries flagged under current strict policy) | Review `grant` policy config for over-broad denylist vs. actual risk tolerance, or replace/remove flagged packages from the container images; this is the failure causing overall exit code 1 |
| shellcheck | 12 grader scripts under `.github/graders/*-operational-value.sh` | unknown (style) | SC2034 — several env vars (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) appear unused | Export or reference these variables, or add `# shellcheck disable=SC2034` with justification if intentionally unused |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: `✓ Checked 47 workflow(s)` / `⚠ Found 2 issue(s) (2 error(s))` (both `expression` type, `safe-outputs-app-token` not defined).

Zizmor severity totals across 47 lock files: 45 High, 431 Medium, 300 Low, 288 Informational (0 Critical from zizmor itself).

Grype severity totals across 9 container images: 34 Critical, 172 High, 355 Medium, 54 Low (217 distinct CVE/GHSA IDs).

Grant: `✗ grant failed` — `strict mode: grant found 1250 license policy finding(s) in container images`.

Poutine: scanner ran, produced no findings.

Runner-guard: 1 Medium finding (RGS-005) on `.github/workflows/agentic_commands.yml`.

Yamllint: scanner ran, produced no findings.

Shellcheck: ran on 2761 run-step resources; 12 files with SC2034 unused-variable warnings only.

Full raw report available in the workflow run's uploaded artifacts (`report.txt`, 9,579 lines); not reproduced in full here to keep this issue bounded. No token-like or credential-like values were observed in the scanned output.

Control plane context

- Correlation ID: `34408406384-124`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34408406384`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34408713434) · copilot · auto · 39.7 AIC · ⌖ 17.3 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 10:06 PM UTC

Start with the uploaded report and the compiler findings for the two workflows referencing `safe-outputs-app-token`, then inspect `.github/workflows/agentic_commands.yml` and the `.github/graders/*-operational-value.sh` scripts. Run the full compiler and security scan against the 47 workflow sources and 9 container images; done means all required validators and scanners pass without editing generated lock files.

Written by the indexing model from the issue text.