[aw-doctor:compiler-security] Compiler & security scan: 47 workflows, grant license policy failure + critical CVEs + 2 actionlint errors

Compiled all 47 workflow sources (47 lock files) in `githubnext/gh-aw-cao` with the gh-aw compiler's full validation, lint, container, and security-scanner suite. The compile command exited non-zero (`1`). Findings span 6 categories: 2 actionlint expression errors, 431 medium/45 high zizmor security findings, 1 runner-guard permissions warning, grype container CVEs (34 critical, 172 high, 355 medium), and 1250 grant license-policy violations across 9 scanned images (`grant failed` — the hard blocking failure). Highest-severity supported finding: **Critical** — multiple images carry unpatched `libssl3`/`libcrypto3`/`curl` CVEs (CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931) with available fixed versions. Recommended next action: assign to Copilot to update pinned base-image digests/versions where fixes exist, remove the two invalid `safe-outputs-app-token` expression references, and review the license-policy list for false-positive permissive licenses (MIT/ISC/BSD dominate the 1250 grant findings) before retrying `grant --strict`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2265`, `self-care-pages-health.lock.yml:2171` | error | `safe-outputs-app-token` property not defined in job outputs object type (2 occurrences) | Fix the referencing `.md` source expression; do not edit the `.lock.yml` directly, recompile |
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `uk-ai-advisory.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` (45 occurrences) | Review each App-token step scope/exposure per zizmor guidance; scope tokens minimally and confirm no downstream leak paths |
| zizmor | various lock files | Medium (431), Low (300), Informational (288) | Undocumented permissions, anonymous job/workflow definitions, ad-hoc package installs, etc. | Lower priority; address opportunistically alongside High findings |
| runner-guard | `.github/workflows/agentic_commands.yml:1` | Medium | RGS-005: excessive permissions (write-level) on a workflow triggered by an untrusted/external event | Reduce to least-privilege permissions or scope trigger away from external-initiated events |
| grype | 9 container images | Critical (34), High (172), Medium (355), Low (54), Negligible (27), Unknown (18) | Unpatched CVEs; notably `libssl3`/`libcrypto3` (CVE-2026-63073, CVE-2026-75803) across `alpine:latest`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `node:lts-alpine`; `curl`/`libcurl` (CVE-2026-18924, CVE-2026-19931) across `alpine:latest`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`; `libc6` CVE-2026-5450 and `libssl3` CVE-2026-75803 in `github-mcp-server:v1.12.1`; `brace-expansion` GHSA-rgw5-rvv9-x895 (High) in `gh-aw-firewall/agent` | Bump/repin base images and packages to the fixed versions reported by grype where available; re-scan |
| grant | 9 container images | error (blocking) | 1250 license-policy findings; dominant licenses flagged: ISC (367), MIT (291), GPL-2.0-or-later (95), GPL-2.0-only (88), Apache-2.0 (88), BSD-3-Clause (68), BSD-2-Clause (68) | Review the grant license policy/allowlist for false positives on common permissive licenses before treating this as a real blocker; for genuine GPL/AGPL policy conflicts, replace or vendor the affected packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**actionlint** (2 errors):
```
self-care-dashboard-performance.lock.yml:2265:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
self-care-pages-health.lock.yml:2171:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
```

**runner-guard** (1 finding):
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

**grype critical CVEs** (10 distinct, 34 total occurrences across images):
```
CVE-2026-63073: libcrypto3/libssl3/openssl@3.5.7-r0 (fix: 3.5.8-r0) — alpine:latest, gh-aw-firewall/squid, gh-aw-mcpg, node:lts-alpine
CVE-2026-75803: libcrypto3/libssl3/openssl@3.5.7-r0 (fix: 3.5.8-r0) + libssl3@3.0.20-1~deb12u2 — same images + github-mcp-server:v1.12.1
CVE-2026-18924: libcurl/curl@8.21.0-r0 (fix: 8.22.0-r0) — alpine:latest, gh-aw-firewall/api-proxy, gh-aw-firewall/cli-proxy, gh-aw-firewall/squid
CVE-2026-19931: libcurl/curl@8.21.0-r0 (fix: 8.22.0-r0) — same images as above
CVE-2026-5450: libc6@2.36-9+deb12u14 — github-mcp-server:v1.12.1
```

**Summary counts**: Workflows checked: 47. Total workflow size 6.9 MB, 279 jobs, 5883 steps, 2745 scripts. Grant: `strict mode: grant found 1250 license policy finding(s) in container images`.

No token-like or credential-like values were observed in the tool output.

Control plane context

- Correlation ID: `34413571010-125`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34413571010

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34414059041) · copilot · auto · 40.3 AIC · ⌖ 8.02 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 23, 2026, 11:09 PM UTC

Start with the two source workflow expressions corresponding to self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, and inspect .github/workflows/agentic_commands.yml for the runner-guard finding. Run the gh-aw compiler and full validation/security suite against the 47 workflow sources; done means generated lock files are clean and the scan passes without editing .lock.yml files.

Written by the indexing model from the issue text.