[aw-doctor:compiler-security] AW Doctor: compiler/security findings across 47 workflows (findings — exit 1)

Compiling all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` at `0718c06`, `gh-aw compile` exited **1** (findings, not clean). The full validation/lint/security suite ran to completion: actionlint found 2 expression errors, zizmor flagged 45 High-severity dangerous-GitHub-App-token findings (of 1,376 total findings across all severities), runner-guard flagged 1 Medium excessive-permissions issue, poutine reported no findings, grype found 34 Critical / 172 High CVEs across the 9 scanned container images (mostly curl/openssl/libexpat), and grant's strict license-policy check failed with 1,250 findings, mostly ISC/MIT/Apache-2.0 packages. Highest severity: **Critical** (grype container CVEs, e.g. CVE-2026-19931 in curl/libcurl and CVE-2026-63073/CVE-2026-75803 in openssl, present in 5+ base/proxy images).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2268, self-care-pages-health.lock.yml:2174 | error | `safe-outputs-app-token` step output referenced but not defined in the step's output object type | Recompile from the `.md` source after fixing the safe-outputs app-token step id/output wiring in the shared control template |
| zizmor | 24 lock files (e.g. aw-doctor, aw-failures-investigator, dependabot, eu-cra-compliance*, optimization*, self-care*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens (45 occurrences) | Review app-token generation steps per zizmor's github-app audit guidance; scope/rotate tokens and avoid persisting them across job boundaries |
| zizmor | multiple lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (788 occurrences across severities) | Move secret references into a dedicated `environment:` block where feasible |
| zizmor | multiple lock files | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` (354 Low, 18 Unknown) | Add permission comments, workflow/job names, and pin ad-hoc package installs |
| runner-guard | agentic_commands.yml:1 | Medium | RGS-005: job grants write-level `permissions:` while triggered by an untrusted event context | Scope permissions to read-only or move privileged steps behind a job gated on trusted actors |
| poutine | all 47 workflows | — | No findings | None |
| grype | ghcr.io/github/gh-aw-firewall/api-proxy, cli-proxy, squid; ghcr.io/github/gh-aw-mcpg; ghcr.io/github/gh-aw-node; alpine:latest; node:lts-alpine | Critical | CVE-2026-19931, CVE-2026-18924 (curl/libcurl); CVE-2026-63073, CVE-2026-75803 (openssl/libssl3/libcrypto3) — 34 Critical findings total | Rebuild/update base images to pull patched curl (8.22.0-r0) and openssl (3.5.8-r0) packages |
| grype | ghcr.io/github/gh-aw-firewall/agent | High | GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg (brace-expansion), GHSA-r292-9mhp-454m (tar), GHSA-mwp4-54f8-5fhr (ip-address) — npm-level advisories | Bump vendored npm packages to the fixed versions noted in each advisory |
| grype | ghcr.io/github/github-mcp-server | High/Critical | CVE-2026-5450 (libc6), CVE-2026-75803 (libssl3), plus Go stdlib/module CVEs (GO-2026-*) | Rebuild image against a patched base and updated Go toolchain/module versions |
| grype | all 9 images | Medium/Low/Negligible | 357 Medium, 54 Low, 27 Negligible OS-package CVEs (bind9-libs, python3.10, libglib2.0, git, etc.) | Track via routine base-image refresh; not immediately actionable individually |
| grant | ghcr.io/github/gh-aw-firewall/agent (381), api-proxy (185), cli-proxy (178), gh-aw-node (176), node:lts-alpine (164), gh-aw-mcpg (80), squid (63), alpine (16), github-mcp-server (7) | error (strict mode) | 1,250 license policy violations, dominated by ISC (365), MIT (285), Apache-2.0 (69), GPL-2.0-only (62) | Review the grant license allowlist/policy for these transitive dependencies; either accept permissive licenses in policy or replace GPL-licensed components where required |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: `Checked 47 workflow(s)`, `Found 2 issue(s) (2 error(s))` — both `[expression]` type.

Zizmor severity totals across 47 files: 217 High, 788 Medium, 354 Low, 18 Unknown.

Grype severity totals across 9 scanned images: 34 Critical, 172 High, 357 Medium, 54 Low, 27 Negligible.

Grant (strict mode): `grant found 1250 license policy finding(s) in container images` → `grant failed`.

Container images scanned by syft/grype/grant (9): `ghcr.io/github/gh-aw-firewall/agent:0.28.14`, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14`, `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.14`, `ghcr.io/github/gh-aw-firewall/squid:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`.

Shellcheck flagged only unused-variable style warnings (`SC2034`) in 16 `graders/*-operational-value.sh` scripts — no security-relevant findings.

No token-like or credential-like values were present in the tool output; nothing was redacted.

Control plane context

- Correlation ID: `34451910987-936`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34451910987`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34451910987) · copilot · auto · 40.3 AIC · ⌖ 7.31 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 8:07 AM UTC

Start with the `.github/workflows/*.md` sources and the shared control template related to the `safe-outputs-app-token` wiring; do not edit generated `.lock.yml` files. Run `gh aw compile` and review the listed actionlint, zizmor, runner-guard, image, and grant findings. Done means the generated workflows and full compiler and security scan pass, or an unresolved human-policy finding is explicitly documented.

Written by the indexing model from the issue text.