[aw-doctor:compiler-security] Security findings: gh-aw compiler validation failed (actionlint, zizmor, poutine/runner-guard, grype, grant)

Compiling all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` (47 lock files) failed the compiler's full validation suite (exit code 1). Findings span 6 categories: 2 actionlint expression errors, 1 poutine/runner-guard permissions warning, 1,647 zizmor lint findings (34 Critical/217 High severity among them concentrated in `github-app` and `secrets-outside-env` rules), 786 Medium container CVEs plus 34 Critical/217 High CVEs from grype across 9 scanned images (curl, OpenSSL, bind9-libs, and others), and 1,250 license-policy violations from grant across all 9 images. Highest-severity supported finding: **Critical** CVE-2026-19931/CVE-2026-18924 (curl/libcurl remote issues) in the `gh-aw-firewall/api-proxy` and `cli-proxy` images, and CVE-2026-63073 (libcrypto3/libssl3) in `gh-aw-firewall/squid`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2265`, `self-care-pages-health.lock.yml:2171` | error | `safe-outputs-app-token` step output referenced but not defined in the `needs` object type | Regenerate lock files from the `.md` sources after fixing the step-output reference/step id used for the GitHub App token in these two workflow sources; do not hand-edit the `.lock.yml` |
| zizmor | 45 workflows (e.g. `aw-doctor.lock.yml`, `self-care-dashboard-performance.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review each flagged job for token scope/exposure per zizmor's `github-app` guidance; scope tokens narrowly and avoid passing them across job boundaries |
| zizmor | 402 findings across most workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into jobs with an explicit `environment:` block where feasible |
| zizmor | 29 workflows | Medium | `artipacked`: credential persistence through uploaded Actions artifacts | Ensure checkout/credential steps don't upload `.git` or token-bearing paths as artifacts |
| zizmor | 271 findings | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add comments explaining why each permission scope is required |
| zizmor | 26 workflows | Low | `adhoc-packages`: unpinned ad-hoc package installs | Pin package versions/hashes in install steps |
| poutine / runner-guard | `agentic_commands.yml:1` | Medium (RGS-005) | Job triggered by untrusted event (e.g. `issue_comment`) declares write-level `permissions:` | Reduce to read-only permissions for the untrusted-trigger job, or gate the write step behind an authorization check |
| grype | `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy` | Critical | CVE-2026-19931, CVE-2026-18924: `curl`/`libcurl@8.21.0-r0` (fix: 8.22.0-r0) | Bump base image or apk-upgrade `curl`/`libcurl` to 8.22.0-r0+ in the firewall proxy image build |
| grype | `gh-aw-firewall/squid` | Critical | CVE-2026-63073: `libcrypto3`/`libssl3@3.5.7-r0` (fix: 3.5.8-r0) | Upgrade OpenSSL packages to 3.5.8-r0+ in the squid image build |
| grype | 7 of 9 scanned images | High (217), Medium (786) | Numerous CVEs (e.g. `bind9-libs` CVEs in `gh-aw-firewall/agent`, `tar`/`ip-address` GHSAs in `api-proxy`/`cli-proxy`) | Rebuild/update base images (`gh-aw-firewall/*:0.28.14`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`) to pull current package fixes; these are upstream image concerns, not workflow-source concerns |
| grant | all 9 scanned images | error (policy) | 1,250 license-policy violations (530 unique packages) across GPL-2.0/3.0, LGPL, MPL, and other flagged licenses in base-image and npm dependencies | Review `grant`'s configured license allow-list; either adjust policy to accept common transitively-bundled OS/npm licenses already vetted for this project, or replace/avoid packages carrying disallowed licenses. This is a policy-tuning task, not a workflow-source fix — flag for maintainer decision if the allow-list itself needs updating |

Note: container CVE and license findings are properties of upstream pinned images (`gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`), not of this repository's workflow `.md` sources. They cannot be fixed by editing `.github/workflows/*.md`; they require upstream image updates or `.poutine.yml`/grant policy decisions and should be routed to the image maintainers or a policy-tuning task if not already tracked upstream.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. In particular:
- Fix the two actionlint `safe-outputs-app-token` expression errors in `self-care-dashboard-performance.md` and `self-care-pages-health.md`.
- Address the `github-app` (High), `secrets-outside-env` (Medium), `artipacked` (Medium), `undocumented-permissions` (Low), and `adhoc-packages` (Low) zizmor findings where they can be safely resolved in workflow source.
- Reduce write-level permissions on the untrusted-trigger job in `agentic_commands.yml` flagged by runner-guard rule RGS-005.
- Do NOT attempt to patch container-image CVEs or license findings from grype/grant by editing workflow sources — those require upstream image bumps or `.poutine.yml`/grant policy changes; stop and report them as out of scope for a `.md`-only fix.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: 2 issue(s), 2 expression error(s) (see table above for locations).

Zizmor summary: 1,647 total findings — 34 Critical, 217 High, 786 Medium, 271 Low, 288 Informational (Critical/High counts above reflect grype CVEs found within the same combined scan pass; zizmor's own rule-based findings top out at High severity: 45 `github-app`, 402 `secrets-outside-env`, 29 `artipacked`, 271 `undocumented-permissions`, 26 `adhoc-packages`, 9 `template-injection`, 3 `obfuscation`).

Grype summary: 9 container images scanned (`gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`) — 34 Critical, 217 High, 786 Medium CVE findings.

Grant summary: `grant failed — strict mode: grant found 1250 license policy finding(s) in container images` across 530 unique packages.

Poutine/runner-guard: 1 medium finding (RGS-005) in `agentic_commands.yml`.

An untracked `.poutine.yml` config file exists in the target checkout (not committed) that acknowledges the `untrusted_checkout_exec` rule for the `activation` job; this is expected local scanner configuration, not a finding.

No token-like or credential-like values were present in the scanned output; none were redacted.

Control plane context

- Correlation ID: `34430842944-129`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34430842944

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34431164652) · copilot · auto · 38.4 AIC · ⌖ 10.3 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 3:10 AM UTC

Start with self-care-dashboard-performance.md, self-care-pages-health.md, and agentic_commands.yml, then review the referenced generated lock-file locations and compiler scan output. Run the gh-aw compiler with its full validation suite, using generated diffs to verify source changes. Done means workflow-source findings are resolved and the remaining image CVE and license findings are clearly reported as upstream or policy work.

Written by the indexing model from the issue text.