[aw-doctor:compiler-security] Compiler and security scan findings: 5 categories (actionlint, zizmor, runner-guard, grype, grant) across 47 workflows

The gh-aw compiler failed (`exit code 1`) while validating all 47 workflow sources / 47 generated lock files in `githubnext/gh-aw-cao`. Findings span 5 categories: 2 actionlint expression errors, 45 zizmor High "github-app" token findings (plus widespread Medium/Low/Informational), 1 runner-guard Medium permissions finding, 34 unique Critical + 34 unique High CVEs across base/tool container images (grype), and 1250 license-policy violations across 9 images (grant, strict mode) — the tool that caused the hard failure.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in expression context (`GIT_TOKEN` env line) | Regenerate lock files via `gh aw compile` after fixing the referencing `.md` source's step id/output wiring |
| zizmor | 37 lock files (e.g. `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `aw-maintenance-upgrade.lock.yml`) | High | `github-app`: dangerous use of `actions/create-github-app-token` (45 occurrences) | Review app-token step guarding/scoping per zizmor's `github-app` audit guidance |
| zizmor | all 47 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (402 occurrences) | Move secret references into a dedicated `environment:` block per file |
| zizmor | 16 lock files (e.g. `dashboard-authoring-corpus.lock.yml`) | Medium | `artipacked`: credential persistence through Actions artifacts (29 occurrences) | Avoid persisting credentials in uploaded artifacts; scrub before upload |
| zizmor | many lock files | Low | `undocumented-permissions` (271), `adhoc-packages` (26), `obfuscation` (3) | Add explanatory comments to `permissions:` blocks; pin/package installs via lockfiles |
| zizmor | many lock files | Informational | `anonymous-definition` (279), `template-injection` (9) | Name workflow/job definitions; review templated expressions |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job grants write-level `permissions:` while triggered by an untrusted event (`issue_comment`/`pull_request_target`-class trigger) | Drop to read-only permissions for this trigger or gate the write job behind an authorization check |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/github-mcp-server:v1.12.1`, `ghcr.io/github/gh-aw-node` | Critical | 5 unique CVEs (`CVE-2026-63073`, `CVE-2026-75803` in `libssl3`/`libcrypto3`/`openssl`; `CVE-2026-18924`, `CVE-2026-19931` in `curl`/`libcurl`; `CVE-2026-5450` in `libc6`) across images, fixes available for alpine-based images | Bump base images to pick up patched `openssl`/`curl`/`glibc` packages |
| grype | same images | High | 34 unique CVEs/GHSAs (e.g. `GHSA-rgw5-rvv9-x895`, `GHSA-mh99-v99m-4gvg` in `brace-expansion`; `GHSA-r292-9mhp-454m` in `tar`; `GHSA-mwp4-54f8-5fhr` in `ip-address`; multiple `curl`/`libcurl` CVEs) | Update npm deps and base OS packages in image build layers |
| grant | 9 container images | error (strict mode) | 1250 license-policy violations (mixed GPL/LGPL/Artistic/custom licenses across OS and npm packages); this is the finding that failed the run | Review and update `grant` policy allowlist or replace/repackage flagged dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: 2 error(s), type `expression` (2 occurrences).

Zizmor rule totals across 47 lock files: `secrets-outside-env` (402, Medium), `anonymous-definition` (279, Informational), `undocumented-permissions` (271, Low), `github-app` (45, High), `artipacked` (29, Medium), `adhoc-packages` (26, Low), `template-injection` (9, Informational), `obfuscation` (3, Low).

runner-guard: 1 finding, `RGS-005` (Medium), in `agentic_commands.yml`.

grype severity totals across 9 scanned images (579 total findings): Critical 34, High 172, Medium 355, Low 54, Negligible 27, Unknown 18.

grant (strict mode): "grant found 1250 license policy finding(s) in container images" — reported as the tool that failed the run (`✗ grant failed`).

yamllint: no findings reported. shellcheck: `SC2034` (unused variable) warnings in 12 grader shell scripts under `.github/graders/` and `graders/` (informational, non-blocking).

Non-finding notices: an ignored `includes` entry for `.github/workflows/aw.json` in `aw.yml`, and a guard-policy advisory about `push-to-pull-request-branch: target: "*"` in `pr-reviewer.md` lacking `required-title-prefix`/`required-labels` constraints.

No token-like or credential-like values were present in the reviewed evidence.

Control plane context

- Correlation ID: `34434968279-907`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34434968279`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34434968279) · copilot · auto · 50.5 AIC · ⌖ 7.87 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 4:12 AM UTC

Start with the `.github/workflows/*.md` sources and the two actionlint errors, then inspect `agentic_commands.yml` for the runner-guard finding; generated `.lock.yml` files must not be edited directly. Run `gh aw compile` with strict validation, using the listed MCP `fix` and `compile` tools, and review the generated diffs. Done means the full compiler, security, image, and policy scan passes without findings.

Written by the indexing model from the issue text.