[aw-doctor:compiler-security] Compiler and security scan findings on githubnext/gh-aw-cao (47 workflows)

Compiler run on `githubnext/gh-aw-cao` (47 workflow sources, 47 compiled locks) exited with code 1. Findings across five categories: 2 actionlint validation errors, 45 zizmor High findings (`github-app` risky token usage) plus 431 Medium/300 Low/288 Informational, 1 runner-guard Medium taint finding, 166 High/Critical grype container CVEs (39 distinct advisories across 9 images), and grant strict-mode license-policy failure (1,250 findings, mostly in `node:lts-alpine`). Recompiling also produced uncommitted `.lock.yml` drift on 13 files plus a new untracked `.poutine.yml`, meaning checked-in locks are stale relative to current sources. Highest-severity supported finding: grype Critical/High CVEs in container images used by workflow steps (e.g. `libssl3`/`openssl` CVE-2026-63072/63073/54874, `curl`/`libcurl` CVE-2026-18924/19931, `libc6` CVE-2026-5435/5450/5928). Recommended next action: assign remediation to Copilot to fix the two actionlint errors and address the highest-confidence zizmor/runner-guard findings; the container CVE and license-policy findings mostly need upstream base-image/dependency bumps rather than workflow-source edits.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in step-outputs type | Fix step reference/ordering in the `.md` source so the referenced step ID exists before use; recompile |
| zizmor | 45 workflows (e.g. `aw-doctor`, `eu-cra-compliance*`, `self-care*`, `optimization*`) | High | `github-app`: dangerous use of GitHub App tokens | Review App token scope/handling per zizmor `github-app` guidance; narrow token exposure |
| zizmor | 402 occurrences across workflows | Medium | `secrets-outside-env`: secrets referenced outside `env:` context | Move secret references into `env:` blocks per zizmor guidance |
| zizmor | 29 occurrences (e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`) | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid persisting credentials in uploaded artifacts |
| zizmor | 271 occurrences | Low | `undocumented-permissions`: permissions blocks without explanatory comments | Add comments explaining each granted permission |
| zizmor | 26 occurrences (e.g. `aw-doctor.lock.yml`) | Low | `adhoc-packages`: ad-hoc package installation | Pin package installs via lockfile/manifest instead of ad-hoc `npm install -g` |
| zizmor | 3 occurrences (e.g. `optimization-ai-credit-auditor.lock.yml`) | Low | `obfuscation`: obfuscated usage of Actions features | Simplify/clarify flagged expression usage |
| zizmor | 279 occurrences | Informational | `anonymous-definition` | No action required; informational only |
| zizmor | 9 occurrences | Informational | `template-injection` | Review flagged expressions for injection risk even though rated informational |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a job triggered by `issue_comment`/similar untrusted-trigger event | Reduce permissions to least privilege for the untrusted-trigger job, or gate the write steps behind an authorization check |
| grype | 9 container images (`gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`) | High/Critical | 166 High/Critical CVE instances (39 distinct advisories), e.g. `openssl`/`libssl3`/`libcrypto3` CVE-2026-63072/63073/54874/14456/14457/18798, `curl`/`libcurl` CVE-2026-18924/19931/13608, `libc6` CVE-2026-5435/5450/5928, `docker-cli` CVE-2026-17106, plus `brace-expansion` GHSA-rgw5-rvv9-x895 / GHSA-mh99-v99m-4gvg in `gh-aw-firewall/agent` | Bump pinned base/container image digests to versions carrying patched packages; cannot be fixed via workflow `.md` source edits alone |
| grant | `node:lts-alpine` (primary) plus other scanned images | error (policy) | 1,250 license-policy findings in strict mode (many ISC/MIT/BlueOak-1.0.0/GPL-2.0 dependencies flagged by current policy) | Review `grant` policy allow-list vs. actual dependency licenses in `node:lts-alpine`; adjust policy or base image if over-broad |
| shellcheck | 12 grader scripts under `.github/graders/*-operational-value.sh` | warning (SC2034) | Unused-variable warnings for grader metadata (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) | Export or use the flagged variables, or add `# shellcheck disable=SC2034` with justification |
| compiler drift | 13 `.lock.yml` files + new `.poutine.yml` | n/a | Recompiling from current `.md` sources produced diffs vs. committed lock files (uncommitted working tree changes) | Run `gh aw compile` and commit the regenerated lock files so checked-in locks match sources |

yamllint reported no findings on any of the 47 files.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint errors (verbatim, 2 total):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2302:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {conclusion: string; outcome: string; outputs: {string => string}}; setup: {conclusion: string; outcome: string; outputs: {string => string}}; setup-agent-output-env: {conclusion: string; outcome: string; outputs: {string => string}}}
.github/workflows/self-care-pages-health.lock.yml:2208:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {conclusion: string; outcome: string; outputs: {string => string}}; setup: {conclusion: string; outcome: string; outputs: {string => string}}; setup-agent-output-env: {conclusion: string; outcome: string; outputs: {string => string}}}
```

Grant strict-mode summary (verbatim):
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Zizmor rule counts (severity, rule, count):
```
error High github-app: 45
warning Medium secrets-outside-env: 402
warning Medium artipacked: 29
info Low undocumented-permissions: 271
info Low adhoc-packages: 26
info Low obfuscation: 3
info Informational anonymous-definition: 279
info Informational template-injection: 9
```

runner-guard finding (verbatim):
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger - A job specifies `permissions:` with write-level access ... but the workflow is triggered by `pull_request_target`, `issue_comment`, `pull_request_review_comment`, or another event that can be initiated by external users.
```

grype High/Critical instance counts by image:
```
18 alpine
4 ghcr.io/github/gh-aw-firewall/agent
22 ghcr.io/github/gh-aw-firewall/api-proxy
22 ghcr.io/github/gh-aw-firewall/cli-proxy
45 ghcr.io/github/gh-aw-firewall/squid
52 ghcr.io/github/gh-aw-mcpg
13 ghcr.io/github/gh-aw-node
8 ghcr.io/github/github-mcp-server
22 node
```
(166 total High/Critical instances, 39 distinct CVE/GHSA identifiers; no token- or credential-like values present in scanner output.)

`git status` after recompiling (working-tree drift vs. committed locks):
```
M .github/workflows/agentic-auto-upgrade.yml
M .github/workflows/agentic_commands.yml
M .github/workflows/agentics-maintenance.yml
M .github/workflows/dashboard-authoring-corpus.lock.yml
M .github/workflows/design-decision-gate.lock.yml
M .github/workflows/docs-explanatory-diagrams.lock.yml
M .github/workflows/eu-cra-compliance-package-maintainer.lock.yml
M .github/workflows/mattpocock-skills-reviewer.lock.yml
M .github/workflows/multi-device-docs-tester.lock.yml
M .github/workflows/pr-reviewer.lock.yml
M .github/workflows/pr-sous-chef.lock.yml
M .github/workflows/svg-visual-audit.lock.yml
M .github/workflows/uk-ai-advisory-package-maintainer.lock.yml
?? .poutine.yml
```

Control plane context

- Correlation ID: `34467592345-137`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34467592345

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34468023091) · copilot · auto · 42.3 AIC · ⌖ 11.2 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 11:08 AM UTC

Start with the two actionlint errors in the generated locks for self-care-dashboard-performance and self-care-pages-health, then inspect their corresponding .github/workflows/*.md sources. Run gh aw compile and review findings in agentic_commands.yml, the grader scripts, container images, and workflow security scans. Done means supported findings are resolved, generated locks are synchronized, and the full compiler and security scan passes.

Written by the indexing model from the issue text.