[aw-doctor:compiler-security] gh-aw compiler & security scan findings for githubnext/gh-aw-cao (47 workflows): actionlint errors, zizmor High findings, Critic

The gh-aw compiler failed (exit code 1) on `githubnext/gh-aw-cao` (47 workflow sources, 47 generated locks): 2 actionlint expression errors, 3,048 zizmor findings (45 High, remainder Medium/Low), 1 poutine/runner-guard medium finding, 662 grype container vulnerability findings (34 Critical, 172 High) across 9 images, and 1,250 `grant` license-policy violations that made the license scan fail outright. Highest severity: **Critical** — unpatched CVEs (e.g. CVE-2026-19931, CVE-2026-18924, CVE-2026-63073) in `curl`/`libcurl`/`libssl3` inside the `gh-aw-firewall` proxy/squid images. Recommended next action: assign remediation to Copilot to fix the two actionlint errors and update pinned base images; the license-policy and CVE backlog need a maintainer decision on scanner policy (see below) before automated fixes are safe.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2302, self-care-pages-health.lock.yml:2208 | error | `steps.safe-outputs-app-token.outputs.token` referenced but no step with that ID exists in the job's step context | Regenerate locks from corrected `.md` sources so the `safe-outputs-app-token` step is emitted before it is referenced, or remove the dangling reference |
| zizmor | 45 workflow locks (e.g. aw-doctor, aw-failures-investigator, dependabot-release-train-updater, self-care-*, eu-cra-compliance-*, optimization-*, uk-ai-advisory*, software-development-practices*) | High | `github-app`: dangerous use of `actions/create-github-app-token` (short-lived GitHub App tokens minted and consumed without hardening) | Review and, where possible, scope/expire the app-token step per zizmor's `github-app` guidance |
| zizmor | 402 occurrences across many locks | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs into a dedicated GitHub Environment |
| zizmor | 29 occurrences (dashboard-authoring-corpus, dependabot-release-train-updater, others) | Medium | `artipacked`: credential persistence through uploaded Actions artifacts | Ensure checkout/token steps don't persist credentials into uploaded artifacts (`persist-credentials: false`) |
| zizmor | 271 occurrences | Low | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add inline comments justifying each permission scope |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor installs or document why ad-hoc install is required |
| zizmor | 3 occurrences (optimization-ai-credit-auditor, optimization-ai-credit-optimizer, self-care-docs-build-time-investigator) | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify the flagged expression/step |
| poutine / runner-guard | agentic_commands.yml | Medium | RGS-005: job declares write-level `permissions:` while triggered by an untrusted event context | Scope permissions down or move privileged steps behind an approval gate |
| grype | 9 container images (gh-aw-firewall agent/api-proxy/cli-proxy/squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, alpine, node base images) | Critical (34), High (172) | Unpatched CVEs, notably CVE-2026-19931 & CVE-2026-18924 (curl/libcurl 8.21.0-r0, fix 8.22.0-r0) in api-proxy/cli-proxy, and CVE-2026-63073 (libssl3/libcrypto3 3.5.7-r0, fix 3.5.8-r0) in squid | Bump pinned base-image digests for `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server` to versions with patched packages |
| grant | Same 9 images | error (policy) | 1,250 license-policy findings (531 unique packages) spanning GPL-2.0/3.0, LGPL, and other licenses not currently allow-listed | Requires a maintainer decision: either expand the `grant` allow-list for accepted OS-distro licenses or document accepted risk; this is a policy call, not a code fix |
| yamllint | 47 files | — | 0 findings (clean) | none |
| shellcheck | 2,687 script resources | warning | 12 files with unused-variable (`SC2034`) warnings in `.github/graders/*-operational-value.sh` (WORKFLOW_NAME, SOURCE_PATH, TITLE_PREFIX, etc. declared but unused) | Export or remove unused grader script variables |

Uncommitted repository state at scan time also showed regenerated lock-file diffs (13 files, 99/99 lines) plus an untracked `.poutine.yml` (poutine skip-rule configuration) — these reflect drift between checked-in locks and the current compiler/source, not new findings.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action (e.g. the `grant` license-policy allow-list decision), require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Specifically:
- Fix the two actionlint `safe-outputs-app-token` expression errors in `self-care-dashboard-performance.md` and `self-care-pages-health.md`.
- Bump pinned container image digests for `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, and `ghcr.io/github/github-mcp-server` to resolve the Critical/High grype CVEs (curl/libcurl CVE-2026-19931, CVE-2026-18924; libssl3/libcrypto3 CVE-2026-63073).
- Remove unused shell variables flagged by shellcheck in `.github/graders/*-operational-value.sh`.
- Do NOT attempt to silently resolve the 1,250 `grant` license-policy findings by editing policy files — stop and report that a maintainer decision on the license allow-list is required.

Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary: checked 47 workflows, found 2 issues (2 errors), issue type `expression`.

Zizmor rule totals across 47 lock files: `secrets-outside-env` 402 (Medium), `undocumented-permissions` 271 (Low), `github-app` 45 (High), `artipacked` 29 (Medium), `adhoc-packages` 26 (Low), `obfuscation` 3 (Low).

Grype totals across 9 images: Critical 34, High 172, Medium 357, Low 54, Negligible 27, Unknown 18 (662 total findings). Per-image finding counts: gh-aw-firewall/agent 358, gh-aw-mcpg 84, gh-aw-firewall/squid 54, node 32, gh-aw-firewall/api-proxy 34, gh-aw-firewall/cli-proxy 33, github-mcp-server 26, alpine 23, gh-aw-node 18.

Grant totals: 1,250 license-policy violations (531 unique packages) across the same 9 images; largest contributors gh-aw-firewall/agent (381), api-proxy (185), cli-proxy (178), gh-aw-node (176), node (164).

No token-like or credential-like values were present in the scanner output; none were redacted because none were found.

Control plane context

- Correlation ID: `34472733572-138`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34472733572`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34473123979) · copilot · auto · 39.2 AIC · ⌖ 9.64 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 12:06 PM UTC

Start with self-care-dashboard-performance.md and self-care-pages-health.md for the two actionlint errors, then inspect the pinned images and .github/graders/*-operational-value.sh. Use the gh aw MCP server's fix and compile tools and review generated lock-file diffs rather than editing locks directly. Done requires the requested compiler and security scans to pass, while the grant findings require a maintainer license-policy decision.

Written by the indexing model from the issue text.