[aw-doctor:compiler-security] Compiler & security scan findings: 47 workflows, actionlint errors, zizmor High/Medium, grype Critical CVEs, grant license polic

The compiler suite compiled all 47 workflow sources into 47 lock files (exit code 1) for `githubnext/gh-aw-cao`. Findings span 6 categories: 2 actionlint syntax errors, 1064 zizmor findings (45 High github-app, 402 Medium secrets-outside-env, 29 Medium artipacked, 271 Low undocumented-permissions, 26 Low adhoc-packages, 9 Informational template-injection, 3 Low obfuscation, 279 Informational anonymous-definition), 1 runner-guard Medium finding (excessive permissions on untrusted trigger), 0 poutine findings, ~1552 grype container CVEs (5 unique Critical CVEs across 7 of 9 scanned images, plus High/Medium/Low), and 1250 grant container license-policy violations (blocking, strict mode) across all 9 images. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in openssl/libssl3/libcrypto3; CVE-2026-18924/CVE-2026-19931 in curl/libcurl; CVE-2026-5450 in libc6) in base images pulled by gh-aw (alpine, node, gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server). Recommended next action: bump/rebuild the affected upstream base images to patched package versions and resolve the actionlint `safe-outputs-app-token` regression, then re-run the full compiler/scanner suite.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2265, self-care-pages-health.lock.yml:2171 | error | `safe-outputs-app-token` step-output property not defined in referenced object type | Fix the gh-aw compiler template that emits the `GIT_TOKEN` expression referencing `steps.safe-outputs-app-token.outputs.token`; recompile so the step id/output type matches |
| zizmor | 37 of 47 lock files | High | `github-app`: dangerous use of `actions/create-github-app-token` (CAO pre-activation app token) | Restrict token permissions/scope via `permissions:` input to the action, and confirm the token is not persisted beyond the job |
| zizmor | 47 lock files (402 occurrences) | Medium | `secrets-outside-env`: `activation`/related jobs reference secrets without a dedicated `environment:` | Add an `environment:` block gating jobs that read `vars.GH_AW_GITHUB_READ_APP_ID` / related secrets |
| zizmor | dashboard-authoring-corpus.lock.yml:1827, dependabot-release-train-updater.lock.yml:2563/2569/2584, +others (29 total) | Medium | `artipacked`: checkout step retains `persist-credentials: true` alongside artifact upload, risking credential persistence in artifacts | Set `persist-credentials: false` on post-agent checkout steps that don't need to push, or restrict artifact retention |
| runner-guard | agentic_commands.yml:1 | Medium | `RGS-005`: excessive write permissions on a job reachable from untrusted triggers (`pull_request_target`/`issue_comment`-style) | Scope `permissions:` down to read-only for the triggering job, or move privileged steps behind an approval gate |
| zizmor | 271 occurrences across all lock files | Low | `undocumented-permissions`: permission blocks lack explanatory comments | Add inline comments explaining each granted permission (compiler template change) |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc `npm install -g` package installs (e.g. Pi CLI) without pinning/lockfile | Pin package versions and prefer lockfile-based installs where feasible |
| zizmor | pr-reviewer.lock.yml:764, self-care-primer-brand-checker.lock.yml:826, self-care.lock.yml:1494 (9 occurrences) | Informational | `template-injection`: code injection via template expansion | Review flagged expressions for untrusted input reaching `run:` blocks; quote/sanitize via env vars |
| zizmor | 3 occurrences (optimization-ai-credit-auditor.lock.yml:301, optimization-ai-credit-optimizer.lock.yml:298, self-care-docs-build-time-investigator.lock.yml:288) | Low | `obfuscation`: `GH_AW_WIKI_NOTE: ${{ '' }}` obfuscated empty-string expression | Replace `${{ '' }}` with a plain empty string literal in the compiler template |
| zizmor | 279 occurrences | Informational | `anonymous-definition`: workflow/job definitions without a `name:` | Add explanatory `name:` fields to compiler-generated job/workflow definitions |
| grype | alpine, node, gh-aw-firewall/api-proxy, gh-aw-firewall/cli-proxy, gh-aw-firewall/squid, gh-aw-mcpg, gh-aw-node, github-mcp-server | Critical | 5 unique CVEs: CVE-2026-63073/CVE-2026-75803 (openssl/libssl3/libcrypto3), CVE-2026-18924/CVE-2026-19931 (curl/libcurl), CVE-2026-5450 (libc6) | Rebuild/bump referenced base images (`ghcr.io/github/gh-aw-firewall/*:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`) to pick up patched package versions |
| grype | gh-aw-firewall/agent, gh-aw-mcpg, gh-aw-node, github-mcp-server, others | High/Medium/Low/Unknown | 217 High, 786 Medium, 354 Low, 27 Negligible, 18 Unknown severity CVEs (e.g. bind9-libs, perl, GHSA-xjvp-4fhw-gc47 runc) | Same base-image update path; prioritize High severity with available fixed versions |
| grant | all 9 scanned images | error (blocking) | 1250 license-policy violations in strict mode (e.g. `containers-common@0.64.2-r0` Apache-2.0 flagged) | Review `grant` policy config vs. actual package licenses; either update the allow-list for legitimately compliant licenses or replace non-compliant packages |
| poutine | — | — | No findings reported | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Scanner tool counts (from `report.txt`, 9579 lines, sha256 43d1c8e1...):
```
zizmor rule breakdown:
402 [Medium] secrets-outside-env
279 [Informational] anonymous-definition
271 [Low] undocumented-permissions
45 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation

runner-guard: 1 finding (RGS-005, medium)
poutine: 0 findings

grype severity totals across 9 images:
34 Critical
217 High
786 Medium
354 Low
27 Negligible
18 Unknown

grant: 1250 license-policy findings (strict mode) -> grant failed
```

Example critical grype findings:
```
ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14: [Critical] CVE-2026-18924/CVE-2026-19931: curl/libcurl@8.21.0-r0
ghcr.io/github/gh-aw-firewall/agent:0.28.14: [Critical] CVE-2026-63073/CVE-2026-75803: openssl/libssl3/libcrypto3
ghcr.io/github/gh-aw-node: [Critical] CVE-2026-5450: libc6@2.36-9+deb12u14
```

No token-like or credential-like values were present in the reviewed evidence; none redacted beyond this note.

Control plane context

- Correlation ID: `34427438401-891`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34427438401`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34427438401) · copilot · auto · 39.2 AIC · ⌖ 9.95 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 2:16 AM UTC

Start with the `.github/workflows/*.md` sources and the `gh aw mcp-server` entry point; do not edit generated `.lock.yml` files. Run the compiler and full validation suite named in the issue, then review generated lock-file diffs. Done means the compiler, actionlint, security scanners, and license checks pass, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.