[aw-doctor:compiler-security] gh-aw compiler & security scan findings: githubnext/gh-aw-cao (exit 1)

Compiler run against `githubnext/gh-aw-cao` (47 workflow sources, 47 generated locks) exited with code 1. Findings span 2 actionlint expression errors, 45 zizmor High `github-app` token findings (37 workflows), 431 Medium `secrets-outside-env` findings, 29 Medium `artipacked` findings, 34 Critical + 217 High container CVEs across 9 scanned images (curl/libcurl, openssl/libssl3/libcrypto3, libc6), and a failed `grant` license scan (1250 policy violations, mostly from bundled npm packages under ISC/BlueOak/MIT-family licenses inside firewall/proxy images). Highest severity supported by tooling: **Critical** (grype CVEs in `alpine`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| gh-aw model checker (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Undefined `safe-outputs-app-token` property referenced in `${{ }}` expression | Fix the referenced expression in the `.md` source that generates these locks; recompile |
| zizmor | 37 lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-*`, `dashboard-authoring-corpus`, `pr-sous-chef`, `self-care-*`, `uk-ai-advisory-package-maintainer`) | High | `github-app`: dangerous use of GitHub App tokens (45 occurrences) | Review App token minting/usage steps; scope tokens narrowly and avoid exposing them beyond the minting job |
| zizmor | most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (431 occurrences) | Move secret references into a job/step `env:` block instead of inline expression use |
| zizmor | `dashboard-authoring-corpus.lock.yml` and others | Medium | `artipacked`: credential persistence through GitHub Actions artifacts (29 occurrences) | Avoid persisting credentials in uploaded artifacts; scrub or exclude sensitive paths |
| zizmor | many lock files | Low | `undocumented-permissions`, `adhoc-packages` | Add comments explaining `permissions:` blocks; pin/verify ad-hoc package installs |
| zizmor | many lock files | Informational | `anonymous-definition`, `template-injection` (9 occurrences, `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml`) | Add `name:` fields; verify template expansions don't interpolate untrusted content into shell/script contexts |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Excessive permissions (write-level) on a workflow triggered by an event that can be initiated by external users | Drop write permissions for externally-triggerable trigger, or gate the write job behind an explicit approval/authorization check |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14`, `cli-proxy:0.28.14`, `squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine` | Critical | 34 findings across 5 unique CVEs: CVE-2026-19931 & CVE-2026-18924 (curl/libcurl 8.21.0-r0, fix 8.22.0-r0), CVE-2026-63073 & CVE-2026-75803 (libcrypto3/libssl3/openssl 3.5.7-r0, fix 3.5.8-r0), CVE-2026-5450 (libc6 2.36-9+deb12u14, no fix listed) | Rebuild/bump base images to pick up patched curl, openssl, and libc packages; re-pin image digests |
| grype | same images | High | 217 findings across 25 unique CVEs (not individually itemized here; see raw evidence) | Rebuild images after upstream Alpine/Debian security updates land |
| grant | 9 scanned images (heaviest: `ghcr.io/github/gh-aw-firewall/agent:0.28.14`, `node:lts-alpine`) | error (license policy) | 1250 license policy violations, largely ISC/BlueOak-1.0.0/MIT-family npm and OS packages flagged by strict-mode policy | Review `grant` license allowlist/policy for these package families; either update the policy for accepted permissive licenses or replace flagged dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Bounded excerpt of compiler/scanner output (full report is 9,579 lines; only representative excerpts included, credential-like values redacted):

```
.github/workflows/self-care-dashboard-performance.lock.yml:2265:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2171:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}

./.github/workflows/aw-doctor.lock.yml:1510:15: error: [High] github-app: dangerous use of GitHub App tokens
./.github/workflows/aw-failures-investigator.lock.yml:1893:15: error: [High] github-app: dangerous use of GitHub App tokens
(45 total across 37 lock files)

.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger

ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14:1:1: error: [Critical] CVE-2026-19931: curl@8.21.0-r0 (fix: 8.22.0-r0)
ghcr.io/github/github-mcp-server:v1.12.1:1:1: error: [Critical] CVE-2026-5450: libc6@2.36-9+deb12u14
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
node:lts-alpine:1:1: error: [Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
(34 Critical, 217 High total across 9 images)

i Running grant license scanner on 9 container images
ghcr.io/github/gh-aw-firewall/agent:0.28.14:1:1: error: license policy violation: @npmcli/promise-spawn@9.0.1 (ISC)
node:lts-alpine:1:1: error: license policy violation: libnpmexec@10.3.2 (ISC)
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images

i Actionlint Summary
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
```

Control plane context

- Correlation ID: `34438453833-131`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34438453833`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34438894188) · copilot · auto · 32.9 AIC · ⌖ 7.48 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 5:12 AM UTC

Start with the `.github/workflows/*.md` sources that generate the reported lock files, especially the sources for `self-care-dashboard-performance` and `self-care-pages-health`, and review `agentic_commands.yml`. Run the `gh aw mcp-server` `fix` and `compile` tools with strict validation; do not edit generated `.lock.yml` files. Done means the compiler, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft scans pass.

Written by the indexing model from the issue text.