[aw-doctor:compiler-security] gh-aw compiler & security scan findings for githubnext/gh-aw-cao (47 workflows) — critical CVEs, license violations, github-app

The gh-aw compiler and security-scanner suite failed (exit code 1) for `githubnext/gh-aw-cao` across all 47 workflow sources / 47 generated lock files. Findings span 2 actionlint expression errors, 45 High-severity zizmor `github-app` token misuse warnings, 39 unique CVEs (32 Critical/High findings across 9 container images), and 1250 grant license-policy violations — the license violations alone caused `grant failed` and the overall non-zero exit. Highest severity: **Critical CVEs** in `libssl3`/`libcrypto3`/`curl`/`libc6` across `alpine`, `node:lts-alpine`, `gh-aw-firewall/*`, `gh-aw-mcpg`, and `github-mcp-server` images (e.g. CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931, CVE-2026-5450).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Count | Remediation |
|---|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `[expression]` property `safe-outputs-app-token` not defined in step-outputs object type | 2 | Fix the `.md` source expression referencing `safe-outputs-app-token`; regenerate lock via `gh aw compile` |
| zizmor | 37 workflows (e.g. `aw-doctor.md`, `aw-failures-investigator.md`, `dependabot.md`, `eu-cra-compliance*.md`) | High | `github-app`: dangerous use of GitHub App tokens | 45 | Review `GH_AW_GITHUB_READ_APP_ID`/token-generation steps; scope token usage per zizmor guidance |
| zizmor | 47 workflows | Medium | `secrets-outside-env`: secrets referenced without dedicated environment | 402 | Move secret references into a job/step `environment:` block |
| zizmor | multiple lock files (e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`) | Medium | `artipacked`: credential persistence through Actions artifacts | 29 | Avoid `actions/checkout` with persisted credentials before artifact upload steps |
| zizmor | all 47 | Low | `undocumented-permissions` / `adhoc-packages` | 271 / 26 | Add explanatory comments to `permissions:`; pin package installs |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` | Low | `obfuscation`: obfuscated Actions feature usage | 3 | Simplify expression syntax flagged by zizmor |
| zizmor | `pr-reviewer.lock.yml` and others | Informational | `template-injection`: code injection via template expansion | 9 | Use `env:` indirection instead of direct `${{ }}` interpolation in `run:` blocks |
| poutine / runner-guard | `agentic_commands.yml` | Medium | `RGS-005`: excessive write permissions on untrusted trigger (`pull_request_target`/`issue_comment`-style) | 1 | Reduce job `permissions:` to read-only or move privileged steps to a separate trusted job |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1` | Critical/High | 39 unique CVEs (`libssl3`/`libcrypto3` CVE-2026-63073/75803, `curl`/`libcurl` CVE-2026-18924/19931/13608, `libc6` CVE-2026-5450, `brace-expansion`/`tar`/`ip-address` GHSA advisories in gh-aw-firewall images) | 213 findings (32 Critical, 146 High, 35 Medium) | Bump base images / rebuild `gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node` images with patched Alpine/Debian packages; upgrade pinned `github-mcp-server` and `node:lts-alpine` tags |
| grant | `alpine`, `node`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server` | error | 1250 license-policy violations (GPL-2.0-only, ISC, MIT, Apache-2.0, and many multi-license SPDX combinations flagged by strict grant policy) — this is what makes `grant failed` and causes the non-zero exit | 1250 | Review `grant` policy config for allowed licenses; either relax the policy for known-safe permissive/copyleft licenses already accepted elsewhere in this catalog, or replace/rebuild images to drop packages under disallowed licenses |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Compiler summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 47`, `Compiled locks: 47`
- Git status during scan showed only an untracked `.poutine.yml` (poutine scanner config, not a source change)
- Actionlint: 2 issues found, both `[expression]` type
- Zizmor: scanned 47 lock files; rule breakdown — `undocumented-permissions` 271, `anonymous-definition` 279 (informational), `secrets-outside-env` 402, `artipacked` 29, `github-app` 45 (High), `adhoc-packages` 26, `obfuscation` 3, `template-injection` 9
- Poutine/runner-guard: 1 finding (`RGS-005` on `.github/workflows/agentic_commands.yml`)
- Syft/Grype: scanned 9 container images; grype reported 213 findings (32 Critical, 146 High, 35 Medium) across 39 unique CVE/GHSA IDs
- Grant: scanned 9 container images; 1250 license-policy violations reported, causing `✗ grant failed` and the final non-zero exit
- No token-like or credential-like values were present in the sampled report output

Control plane context

- Correlation ID: `34418117348-126`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34418117348`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34418483395) · copilot · auto · 62 AIC · ⌖ 8.95 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 12:07 AM UTC

Start with the 47 .github/workflows/*.md sources, especially the sources for self-care-dashboard-performance, self-care-pages-health, and agentic_commands.yml; run gh aw compile and the reported security scanners against the generated locks. Done means the source changes preserve existing behavior and the full compiler, actionlint, zizmor, poutine, runner-guard, grant, grype, and syft scan passes without findings.

Written by the indexing model from the issue text.