[aw-doctor:compiler-security] githubnext/gh-aw-cao compiler & security scan: Critical/High CVEs, license, and zizmor findings

`githubnext/gh-aw-cao` failed its full gh-aw compiler + security scan (exit code 1, 47/47 workflow sources compiled). Findings: 176 container license-policy violations (`grant`), 34 Critical + 172 High CVEs across 9 scanned images (`grype`), 45 `zizmor` High-severity `github-app` findings (dangerous GitHub App token pattern repeated across generated lock files), 2 `actionlint` expression errors (unresolved `safe-outputs-app-token` property), 402 Medium `secrets-outside-env` warnings, plus lower-severity `poutine`/`runner-guard`/`shellcheck` notes. Highest-severity supported finding: **Critical CVEs (grype)** in `alpine`, `node:lts-alpine`, `github-mcp-server`, and `gh-aw-firewall/*` base images (e.g. CVE-2026-63073, CVE-2026-75803, CVE-2026-18924/19931 in libssl3/libcrypto3/curl).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `[expression]` property `safe-outputs-app-token` not defined on step outputs object | Fix upstream expression/schema mismatch in the compiler's app-token step output typing, then recompile |
| zizmor | 45 generated lock files (aw-doctor, aw-failures-investigator, aw-maintenance-*, eu-cra-compliance*, self-care*, uk-ai-advisory*, etc.) | High | `github-app`: dangerous use of `actions/create-github-app-token@bcd2ba4...` for CAO pre-activation token | Confirm token scope/lifetime is minimized; if false positive for this generated pattern, add a documented zizmor suppression at the compiler-template level |
| zizmor | most generated lock files | Medium (402 occurrences) | `secrets-outside-env`: secrets referenced without dedicated environment | Route secret references through job/step `environment:` where feasible in the shared workflow template |
| zizmor | 29 lock files | Medium | `artipacked`: artifact/cache poisoning pattern | Review cache/artifact key scoping in shared template |
| poutine | agentic_commands.yml (`activation` job) | medium | RGS-005 excessive permissions on write-capable job triggered by `issue_comment`/`pull_request_target`-class event | Confirm least-privilege scoping is intentional/necessary; narrow permissions if not required |
| grype | alpine:latest, node:lts-alpine, ghcr.io/github/gh-aw-firewall/{squid,api-proxy,cli-proxy}, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/github-mcp-server | Critical (34) | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3), CVE-2026-18924/19931 (curl/libcurl), CVE-2026-5450 (libc6) | Bump base images / rerun package updates so patched versions are pulled; re-scan |
| grype | same images + gh-aw-mcpg Go binary | High (172) | Numerous High CVEs incl. CVE-2026-14456/14457/18798/54874/63072/63075/63076 (openssl), CVE-2026-5435/5928 (libc6), CVE-2026-66046/76641/76956/76957 (libexpat), GO-2026-* (Go stdlib/grpc/x-crypto/x-text) | Update base images and Go module dependencies (grpc, golang.org/x/crypto, golang.org/x/text) to patched versions |
| grant | node:lts-alpine and other npm-based images | error (176) | License policy violations across numerous alpine system packages (GPL-2.0-only, MIT, ISC, etc.) and npm deps | Review/adjust grant license allow-list policy or replace non-compliant dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Actionlint summary:** Checked 47 workflow(s); found 2 issue(s) (2 errors), category: expression.

**Grype scan:** 9 container images scanned (`alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`). 34 Critical, 172 High findings (deduplicated CVE/package pairs listed above), remainder Medium/Low/Negligible.

**Grant scan:** `grant failed — strict mode: grant found 1250 license policy finding(s) in container images` (176 unique package/license combinations after dedup across images).

**Zizmor scan:** 47 files scanned. Findings by category: 45 `[High] github-app`, 402 `[Medium] secrets-outside-env`, 29 `[Medium] artipacked`, 279 `[Informational] anonymous-definition`, 271 `[Low] undocumented-permissions`, 26 `[Low] adhoc-packages`, 9 `[Informational] template-injection` (pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml, self-care.lock.yml), 3 `[Low] obfuscation`.

**Poutine/runner-guard:** 1 medium finding — RGS-005 excessive permissions on `agentic_commands.yml` `activation` job for an externally-triggerable event class.

**Shellcheck:** SC2034 (unused variable) warnings across ~14 `*-operational-value.sh` grader scripts (unused sourced env vars: `WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`/`FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`).

**Yamllint:** no findings reported beyond the above.

**Diff/git-status:** The compiler dry-run reported diffs across 47 `.lock.yml` files plus 3 source `.md`-adjacent files (`agentic-auto-upgrade.yml`, `agentic_commands.yml`, `agentics-maintenance.yml`), 403 insertions / 403 deletions total, and a newly generated `.poutine.yml` config (not committed — dry-run artifact only). No secret- or token-like values were present in the captured output.

Control plane context

- Correlation ID: `34457072411-135`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34457072411`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34457411213) · copilot · auto · 47.8 AIC · ⌖ 10.6 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 9:11 AM UTC

Start with the gh-aw compiler and the .github/workflows/*.md sources, especially agentic-auto-upgrade.yml, agentic_commands.yml, and agentics-maintenance.yml; do not edit generated .lock.yml files. Run the gh-aw MCP server's fix and compile tools with the full scan suite, then verify that compilation and security scans pass or document findings requiring human action.

Written by the indexing model from the issue text.