[aw-doctor:compiler-security] Compiler & security scan findings for githubnext/gh-aw-cao (exit 1, license policy + CVEs)

Compiler exit code **1** for `githubnext/gh-aw-cao` (47 workflow sources / 47 compiled locks). Two actionlint expression errors, 45 zizmor High "github-app" findings, 1 push-to-pull-request-branch wildcard-target warning, and `grant` license-policy scan failing with 1,250 findings across 9 container images. Grype found 120 unique Critical/High CVEs (dominated by curl/libcurl CVE-2026-18924/19931 in the firewall proxy images and OpenSSL/libcrypto CVE-2026-63073/75803). Highest-severity supported finding: **Critical** — curl/libcurl remote CVEs in `gh-aw-firewall/api-proxy` and `gh-aw-firewall/cli-proxy` images (fix versions available upstream). Recommended next action: assign to Copilot to fix the two actionlint expression errors and bump/patch the flagged base images per Agent prompt below; license-policy and full CVE burn-down need a maintainer license/image-pinning decision (see Failure details).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2268, self-care-pages-health.lock.yml:2174 | error | `safe-outputs-app-token` property not defined in referenced object type (expression check) | Fix the source `.md` step output reference so the compiler emits a valid expression; recompile |
| zizmor | 45 lock files (activation job `needs.pre_activation` guard) | High | `github-app`: dangerous use of GitHub App tokens | Review App-token scoping in the shared activation control template; confirm token exposure is intentional and scoped minimally |
| zizmor | all `.lock.yml` (secrets-outside-env) | Medium (402 occurrences) | Secrets referenced without a dedicated `environment:` | Move secret-consuming steps behind a GitHub Environment where feasible |
| zizmor | all `.lock.yml` (undocumented-permissions) | Low (271) | `permissions:` blocks lack explanatory comments | Add short comments explaining each granted permission |
| zizmor | all `.lock.yml` (anonymous-definition) | Informational (279) | Workflow/job definitions without a `name:` | Cosmetic; add names if desired |
| zizmor | dashboard-authoring-corpus.lock.yml and others (artipacked) | Medium (29) | Credential persistence via `actions/checkout` + artifact upload | Verify checked-out `.git` credentials aren't uploaded as artifacts |
| zizmor | optimization-ai-credit-auditor.lock.yml (obfuscation), pr-reviewer.lock.yml (template-injection) | Low/Informational | Minor lint-level advisories | Low priority; review only if touching these files |
| guard | pr-reviewer.md, design-decision-gate.md, mattpocock-skills-reviewer.md | warning | `push-to-pull-request-branch` target `"*"` has no `required-title-prefix`/`required-labels` constraint | Add scoping constraints to limit which PR branches can receive pushes |
| grype | `gh-aw-firewall/api-proxy:0.28.14`, `cli-proxy:0.28.14`, `squid:0.28.14` | Critical | CVE-2026-18924, CVE-2026-19931 (curl/libcurl 8.21.0-r0, fix 8.22.0-r0) | Bump base image / apk `curl`+`libcurl` to patched version |
| grype | `alpine:latest`, `node:lts-alpine`, `gh-aw-mcpg:v0.4.20`, `squid:0.28.14`, `github-mcp-server:v1.12.1` | Critical | CVE-2026-63073, CVE-2026-75803 (libcrypto3/libssl3, OpenSSL) | Update Alpine/OpenSSL packages to fixed versions |
| grype | `github-mcp-server:v1.12.1` | Critical | CVE-2026-5450 | Rebuild/update `github-mcp-server` image to a patched release |
| grype | `gh-aw-mcpg:v0.4.20` | High (18 CVE/GHSA/GO findings) | Multiple Go module and npm dependency CVEs (GO-2026-*, GHSA-*) | Update pinned Go/npm dependencies in the mcpg image build |
| grype | `gh-aw-firewall/agent:0.28.14` (+api-proxy, cli-proxy, node:lts-alpine) | High (4 each) | GHSA-mh99-v99m-4gvg, GHSA-mwp4-54f8-5fhr, GHSA-r292-9mhp-454m, GHSA-rgw5-rvv9-x895 (tar/ip-address npm packages) | Bump `tar` to 7.5.21+ and `ip-address` to 10.3.1+ |
| grant | 9 container images | error | 1,250 license-policy findings (predominantly ISC/MIT/Apache-2.0/GPL-2.0-only flagged by current policy) | Maintainer decision required: review `.grant.yaml` allow-list vs. actual dependency licenses; not safely auto-fixable |

120 unique Critical/High image CVEs and 660 total grype findings were deduplicated by image+CVE-ID; full per-package detail is in raw evidence.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priorities in order: (1) fix the two actionlint `[expression]` errors referencing `safe-outputs-app-token` in `self-care-dashboard-performance.md` and `self-care-pages-health.md`; (2) update pinned base images / dependency versions to remediate the Critical/High grype CVEs listed in this issue (curl/libcurl, OpenSSL libcrypto3/libssl3, github-mcp-server, tar, ip-address, Go modules in gh-aw-mcpg); (3) add `required-title-prefix:` or `required-labels:` to the `push-to-pull-request-branch` safe output in the three flagged workflows. Do not attempt to resolve the `grant` license-policy findings or the zizmor `github-app`/`secrets-outside-env` advisories — those require a maintainer policy decision and are out of scope for this automated fix; stop and note them if encountered.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: 2 issue(s), 2 error(s), category `expression`.

Severity totals across all tools (zizmor + grype combined, before dedup): 34 Critical, 217 High, 786 Medium, 354 Low, 288 Informational.

Grype: 9 container images scanned (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid` ``@0``.28.14; `gh-aw-mcpg:v0.4.20`; `gh-aw-node`; `github-mcp-server:v1.12.1`; `alpine:latest`; `node:lts-alpine`), 660 total findings, 120 unique Critical/High (Image | Severity | CVE) after dedup — see Failure details table for the condensed set.

`grant` final line: `strict mode: grant found 1250 license policy finding(s) in container images` (exit failed).

`.poutine.yml` present (untracked in working tree) with one documented skip rule (`untrusted_checkout_exec` for `activation` job) — no new poutine findings beyond that acknowledged skip were observed in the scanned output.

Full report is 9,579 lines; per-tool detail retained in the workflow's evidence artifacts (`report.txt`, `diff-stat.txt`, `git-status.txt`) for this run.

Control plane context

- Correlation ID: `34447995189-927`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34447995189`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34447995189) · copilot · auto · 54.5 AIC · ⌖ 10.2 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 7:24 AM UTC

Start with self-care-dashboard-performance.md and self-care-pages-health.md for the two actionlint errors, then inspect the three workflows named for push-to-pull-request-branch constraints. Review the gh-aw MCP server workflow and the listed container image sources, using the compiler and security scan artifacts as the baseline. Done means actionable compiler, image, and guard findings are fixed and the required validation passes; license-policy and broader zizmor findings remain documented for maintainer decisions.

Written by the indexing model from the issue text.