[aw-doctor:compiler-security] Compiler/security scan findings: 2 actionlint errors, 45 zizmor High, 34 grype Critical CVEs, grant license policy failure (1250

Compiling all 47 gh-aw workflows in `githubnext/gh-aw-cao` succeeded structurally (all 47 lock files regenerate) but the compiler's full validation suite exits non-zero (exit code 1). Findings span 5 categories: 2 actionlint expression errors, 45 zizmor `[High]` GitHub App token findings (plus 402 `[Medium]` secrets-outside-env, 271 `[Low]` undocumented-permissions, 29 `[Medium]` artipacked, 26 `[Low]` adhoc-packages, 3 `[Low]` obfuscation), 1 runner-guard `[medium]` excessive-permissions finding, 34 grype `[Critical]` / 217 `[High]` container CVEs across 9 images, and 1250 grant license-policy violations (hard failure) in container images. Highest severity supported by tooling: **grype Critical CVEs** in outdated Alpine/Debian base-image packages (`libssl3`, `libcrypto3`, `curl`, `libc6`), compounded by a **grant hard failure** (exit-blocking) on license-policy violations. Recommended next action: assign to Copilot to fix the two actionlint regressions and re-pin/rebuild the flagged container images; the zizmor/grant/license findings mostly require upstream image or policy-file updates that a human should review before merge.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2268`, `self-care-pages-health.lock.yml:2174` | error | `safe-outputs-app-token` step output referenced but not defined in that job's step outputs (type-check failure) | Fix the source `.md` frontmatter/step wiring so the referenced step id exists in the same job, then recompile |
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml:1513`, `aw-failures-investigator.lock.yml:1896`, `eu-cra-compliance*.lock.yml`, `optimization*.lock.yml`, `self-care*.lock.yml`, `uk-ai-advisory*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review whether App-token minting steps need tighter scoping/expiry per zizmor guidance; likely accepted pattern for CAO but confirm with `gh aw fix` |
| zizmor | all 47 lock files, repeated | Medium (402×) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Add `environment:` blocks around jobs referencing secrets where feasible |
| zizmor | all 47 lock files, repeated | Low (271×) | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | subset of lock files | Medium (29×) | `artipacked`: credential persistence through GitHub Actions artifacts | Review artifact upload steps for credential leakage |
| zizmor | subset of lock files | Low (26×) | `adhoc-packages`: ad-hoc installation of packages (e.g. `npm install -g @earendil-works/pi-coding-agent`, AWF binary install) | Pin/vendor package installs or move to a maintained action |
| zizmor | 3 lock files | Low (3×) | `obfuscation`: obfuscated usage of GitHub Actions features | Review flagged expressions for clarity |
| runner-guard | `agentic_commands.yml` | medium | RGS-005: excessive write permissions (`contents/actions/etc: write`) combined with untrusted `issue_comment`/command trigger | Confirm this workflow's command-trigger guard restricts execution to trusted actors before granting write scopes; narrow permissions if not already gated |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-mcpg:v0.4.20` | Critical (4× CVE-2026-63073, CVE-2026-75803) | Outdated `libssl3`/`libcrypto3` 3.5.7-r0 (fix: 3.5.8-r0) | Rebuild/re-pull base images to pick up patched Alpine packages |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy`, `cli-proxy`, `squid` (0.28.14) | Critical (CVE-2026-18924, CVE-2026-19931, plus squid also CVE-2026-63073/75803) | Outdated `curl`/`libcurl` 8.21.0-r0 (fix: 8.22.0-r0), `libssl3`/`libcrypto3`/`openssl` | Update firewall image base or bump to a newer `gh-aw-firewall` release with patched packages |
| grype | `ghcr.io/github/gh-aw-node` | Critical (CVE-2026-18924, CVE-2026-19931) | Outdated `libcurl` 8.21.0-r0 | Rebuild image with patched `curl`/`libcurl` |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical (CVE-2026-5450 `libc6`, CVE-2026-75803 `libssl3`) | Outdated Debian base packages | Bump `github-mcp-server` to a version built on a patched base image |
| grype (aggregate) | all 9 images | High (217×), Medium (355×), Low (54×), Negligible (27×) | Broad set of outdated OS-level packages across images | Track via periodic image refresh; not individually actionable per-package here |
| grant | all 9 container images | error (1250 findings, hard fail) | License policy violations across OS/npm packages (ISC, BSD variants, HPND-sell-variant, GPL family, etc.) in base images and bundled npm deps (e.g. `graceful-fs`, `coreutils`, `libxau6`, `fastest-levenshtein`, `agent-base`, `tinyglobby`) | Review `grant` policy file for allowed licenses vs. actual base-image contents; either adjust policy to reflect accepted OSS licenses already in use, or replace flagged dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Compiler summary:**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

**Actionlint summary:** Checked 47 workflow(s); found 2 issue(s) (2 error(s), category: expression).

**Zizmor severity totals:** Critical: 0 (workflow files) / High: 45 / Medium: 431 / Low: 300 (see table above for image-level Critical/High CVE counts from grype, tracked separately).

**Grype severity totals (9 images scanned):** Critical: 34, High: 217, Medium: 355, Low: 54, Negligible: 27.

**Grant:** `✗ grant failed — strict mode: grant found 1250 license policy finding(s) in container images`

**Poutine:** no findings reported in this run.

**Diff stat (regenerated lock files from this compile, 51 files changed, 413 insertions(+), 403 deletions(-)):** routine lock-file regeneration diffs across all 47 workflows plus `.github/aw/actions-lock.json`, consistent with a version/dependency bump rather than new structural issues.

Full raw tool output (~698 KB) is retained in the run's compiler evidence artifact (`report.txt`) for deeper investigation; only bounded excerpts are reproduced above.

Control plane context

- Correlation ID: `34442224210-132`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34442224210`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34442503108) · copilot · auto · 42.5 AIC · ⌖ 6.89 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 6:07 AM UTC

Start with the two actionlint locations in self-care-dashboard-performance.lock.yml:2268 and self-care-pages-health.lock.yml:2174, then trace them back to their .github/workflows/*.md sources; do not edit generated locks. Run the gh aw MCP server's fix and compile tools with strict validation, review report.txt and regenerated lock diffs, and consider the work done only when the full listed compiler and security scan passes or an unsafe human-review blocker is documented.

Written by the indexing model from the issue text.