[aw-doctor:compiler-security] gh-aw compiler security findings: 34 critical CVEs, 45 high github-app risks, license/grant failure

Compiled all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` (47 lock files) with the full validation and security suite. **Compiler exit code: 1 (findings, not clean).** Highest-severity supported finding: **Critical** — grype reports 34 critical CVEs (e.g. CVE-2026-63073 in libssl3/libcrypto3, CVE-2026-19931/18924 in curl/libcurl) across the `gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, and `node` container images. Zizmor also flags 45 High-severity "dangerous use of GitHub App tokens" findings, and `grant` (license scanner) failed in strict mode with 1250 license policy violations across 9 images. Recommended next action: assign this issue to Copilot to remediate workflow-source-level findings (actionlint expression errors, zizmor secrets-outside-env/artipacked, runner-guard permission warning) and separately triage the container-image CVE/license findings, which require base-image/dependency updates outside `.github/workflows/*.md` sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|--------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token` property not defined in expression type (GIT_TOKEN env) | Fix the compiler-generated expression typing for the `safe-outputs-app-token` step reference in these two workflow's `.md` sources, then recompile |
| zizmor | 45 lock files (e.g. `aw-doctor.lock.yml:1513`, `aw-failures-investigator.lock.yml:1896`, `aw-maintenance-compiler-security.lock.yml:1836`) | High | `github-app`: dangerous use of `actions/create-github-app-token` output token | Review each flagged step and scope/guard the minted app token per zizmor's `github-app` audit guidance |
| zizmor | multiple lock files | Medium | `secrets-outside-env` (402 occurrences) | Move secret references into `env:` blocks instead of inline step `with`/`run` expressions |
| zizmor | multiple lock files | Medium | `artipacked` (29 occurrences) | Avoid persisting credentials in checkout steps flagged by zizmor's `artipacked` audit |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: excessive write permissions on `pull_request_target`/`issue_comment`-triggered job | Reduce job permissions to least privilege or scope the trigger |
| runner-guard | `pr-sous-chef.md` | info/warning | `push-to-pull-request-branch` target `"*"` has no `required-title-prefix`/`required-labels` constraint | Add `required-title-prefix:` or `required-labels:` to restrict which PRs can receive pushes |
| grype | `gh-aw-firewall/api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node` (9 images) | Critical (34), High (172), Medium (357), Low (54), Unknown (18) | 219 unique CVEs, e.g. CVE-2026-63073 (libssl3/libcrypto3), CVE-2026-19931/18924 (curl/libcurl), CVE-2026-5450 (github-mcp-server) | Update base images / pinned digests to versions with available fixes (e.g. libcurl 8.22.0-r0, libssl3/libcrypto3 3.5.8-r0) |
| grant | 9 container images | error (strict mode) | 1250 license policy violations (e.g. `libbz2-1.0` BSD-variant/GPL-2.0-only, `ubuntu-keyring` GPL-2.0-or-later) | Review license policy configuration or replace/rebuild images with license-compliant packages |
| shellcheck | `.github/graders/*.sh` (68 occurrences) | warning | `SC2034`: variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) appear unused in grader scripts | Export or remove unused variables in grader shell scripts |
| yamllint | 47 files | — | none | n/a |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: the container-image CVE and license-policy findings originate from upstream base images (`gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node`) and may require coordinating a base-image version bump rather than a workflow-source change; if so, stop and report that this needs a separate image-update change.

Raw evidence

Full compiler/scanner output (698 KB, 9581 lines) was collected in `/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt` by the deterministic evidence step. Key section markers:

- `i Running actionlint on 47 file(s)` — 2 expression errors
- `i Running zizmor security scanner on 47 files` — 34 Critical / 217 High / 788 Medium / 354 Low / 18 Unknown raw finding lines (zizmor-only subset: 45 High github-app, 402 Medium secrets-outside-env, 29 Medium artipacked, 271 Low undocumented-permissions, 26 Low adhoc-packages, 3 Low obfuscation)
- `i Running poutine security scanner` / `i Running runner-guard taint analysis scanner` — 1 medium RGS-005 finding plus guard-policy dry-run notes for 16 command-triggered workflows
- `i Running syft SBOM scanner on 9 container images` — SBOMs generated for all 9 images
- `i Running grype vulnerability scanner on 9 container images` — 219 unique CVEs (34 Critical, 172 High, 357 Medium, 54 Low, 18 Unknown)
- `i Running grant license scanner on 9 container images` — 1250 license policy violations; `✗ grant failed`
- `i Running yamllint on 47 files` — no issues
- `i Running shellcheck on 2761 run step resources` — 68 SC2034 warnings in grader scripts
- Final actionlint summary: `✓ Checked 47 workflow(s)` / `⚠ Found 2 issue(s) (2 error(s))`

No token-like or credential-like values were present in the reviewed excerpts.

Control plane context

- Correlation ID: `34462756457-948`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34462756457`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34462756457) · copilot · auto · 54.3 AIC · ⌖ 10.3 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 10:10 AM UTC

Start with the `.github/workflows/*.md` sources named in the findings, especially the two self-care workflow sources, `agentic_commands.yml`, and `pr-sous-chef.md`; also inspect `.github/graders/*.sh`. Run the `gh aw mcp-server` compile and full validation/security suite, then review generated lock-file diffs. Done means workflow-source findings are resolved and scans pass, or image CVE/license findings are clearly reported as a separate base-image update.

Written by the indexing model from the issue text.