[aw-doctor:compiler-security] aw-doctor: compiler & security scan findings for githubnext/gh-aw-cao (grant strict-mode failure, actionlint errors, container C

gh-aw compiled all 47 workflow sources in `githubnext/gh-aw-cao` into 47 lock files, but the run exited with code 1 because **actionlint found 2 syntax errors** and **grant (license scanner) failed in strict mode with 1,250 license policy findings** across the 9 container images used by workflows. zizmor also flagged 45 High-severity `github-app` findings (across 37 workflows) plus hundreds of Medium/Low findings, runner-guard flagged 1 Medium excessive-permissions finding, and grype found 34 Critical / 172 High CVEs (199 unique) in the same container images. Highest-severity supported finding: **Critical CVEs in container images** (e.g. CVE-2026-18924/CVE-2026-19931 in `curl`/`libcurl`, CVE-2026-75803 in `libssl3`/`libcrypto3`) combined with the strict-mode grant failure blocking a clean compile.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token` referenced but not a defined step output in that job | Fix the source `.md` template so the `safe-outputs-app-token` step id/output exists in the job before referencing it, then recompile |
| grant (license) | 9 container images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`) | error (strict mode) | 1,250 license policy violations (mixed license SBOM entries: GPL family, ISC, BlueOak-1.0.0, ad-hoc, etc.) | Review `.poutine.yml`/grant policy allowlist vs. actual base-image licenses; either adjust the accepted-license policy for these known base images or pin to images with compliant licenses; do not silently disable strict mode |
| grype | 9 container images | Critical (34) | CVE-2026-18924, CVE-2026-19931 (curl/libcurl), CVE-2026-75803 (libssl3/libcrypto3), CVE-2026-5450, CVE-2026-63073 | Rebuild/update base images to patched package versions where fixes are published; track upstream image updates for `gh-aw-firewall/*`, `gh-aw-node`, `node:lts-alpine` |
| grype | 9 container images | High (172) | 199 unique CVEs total (e.g. GHSA-rgw5-rvv9-x895 brace-expansion, GHSA-r292-9mhp-454m tar, GHSA-mwp4-54f8-5fhr ip-address) | Bump vulnerable npm/OS packages bundled in firewall/node images to fixed versions listed in report |
| zizmor | 37 workflow lock files | High | `github-app`: dangerous use of `actions/create-github-app-token` (45 occurrences) | Review each app-token step for scope/lifetime; ensure token isn't over-broadly exposed to later steps/outputs |
| zizmor | many workflow lock files | Medium | `secrets-outside-env`: secrets referenced without dedicated `env:` block (402 occurrences) | Move secret references into a dedicated `env:` mapping per zizmor guidance |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`, others | Medium | `artipacked`: credential persistence via `actions/checkout` artifacts/`persist-credentials: true` (29 occurrences) | Set `persist-credentials: false` or clear credentials before uploading artifacts |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level permissions job on an untrusted-trigger-adjacent file (informational commands manifest header) | Confirm this file is data-only (not itself a workflow trigger target) or scope permissions down; likely a false positive on the commands manifest comment but should be verified |
| zizmor | many workflow lock files | Low | `undocumented-permissions` (271), `adhoc-packages` (26), `obfuscation` (3) | Add explanatory comments to `permissions:` blocks; avoid ad-hoc `npm install -g`; avoid empty-string obfuscated expressions like `${{ '' }}` |
| zizmor | several workflow lock files | Informational | `anonymous-definition` (279), `template-injection` (9) | Add `name:` to workflow/job/action definitions; review template-injection audit context for any real injection risk |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint errors (excerpt):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2265:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/self-care-pages-health.lock.yml:2171:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Actionlint summary: `Checked 47 workflow(s)` / `Found 2 issue(s) (2 error(s))` — `expression: 2`.

grant summary: `strict mode: grant found 1250 license policy finding(s) in container images` (exit code contributor).

grype severity distribution across 9 scanned images: Critical 34, High 172, Medium 355, Low 54, Negligible 27, Unknown 18 (199 unique CVE/GHSA IDs).

zizmor severity distribution: High 217 (mostly `github-app` at 45 raw findings across distinct call sites, appearing per-lock-file), Medium 786 (`secrets-outside-env` 402, `artipacked` 29, remainder duplicated per occurrence), Low 354 (`undocumented-permissions` 271, `adhoc-packages` 26, `obfuscation` 3), Informational 288 (`anonymous-definition` 279, `template-injection` 9).

runner-guard: 1 Medium `RGS-005` finding in `.github/workflows/agentic_commands.yml` (commands manifest header, write-permission-adjacent trigger heuristic).

Summary totals: 47 workflows, 279 jobs, 5,883 steps, 2,745 scripts, total lock-file size 6.9 MB.

Control plane context

- Correlation ID: `34424827420-888`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34424827420`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34424827420) · copilot · auto · 49.8 AIC · ⌖ 8.93 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 1:36 AM UTC

Start with the two actionlint findings in self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, tracing them back to their .md sources; review .poutine.yml and agentic_commands.yml for the policy findings. Run gh-aw through its MCP server with fix and compile, then rerun the full listed validation suite. Done means generated lock files compile cleanly without direct edits and all compiler and security findings are resolved or explicitly explained.

Written by the indexing model from the issue text.