[aw-doctor:compiler-security] gh-aw compiler & security scan findings: githubnext/gh-aw-cao (2 actionlint errors, 45 zizmor High, license/CVE findings in 9 im

Compiler run against `githubnext/gh-aw-cao` at SHA `1b9935661cda1e30d46d50713fc14fa7b24985de` exited with code 1 (findings, not clean). Across 47 workflow sources / 47 compiled locks: 2 actionlint expression errors, 45 zizmor `github-app` High findings, ~9 container images with Critical/High CVEs (grype), 1,250 grant license-policy violations across the same 9 images, 30 Go stdlib vulnerabilities in `gh-aw-mcpg`, and 1 poutine/runner-guard Medium finding (`RGS-005`, excessive permissions on untrusted trigger in `agentic_commands.yml`). Highest-severity supported finding: **Critical** CVE-2026-75803 (libssl3/libcrypto3) present in 5 of 9 scanned base images. Recommended next action: assign the remediation prompt below to Copilot to bump base images and fix the actionlint schema error; license/CVE findings mostly stem from upstream base images (`node:lts-alpine`, `alpine:latest`, `ghcr.io/github/*`) and require version bumps rather than workflow-source edits.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (expression) | `steps.safe-outputs-app-token.outputs.token` referenced but `safe-outputs-app-token` step not defined in that job's context | Fix the `.md` source's GIT_TOKEN expression / add the missing step id so actionlint's type-check passes |
| zizmor | 37 workflow locks | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/lifetime per zizmor guidance; confirm minimal permissions for the app token use |
| zizmor | 47 workflow locks | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-referencing steps into a job `environment:` block per zizmor docs |
| zizmor | 47 workflow locks | Low | `undocumented-permissions` (271), `adhoc-packages` (26) | Add explanatory comments to `permissions:` blocks; pin/document ad-hoc package installs |
| zizmor | 47 workflow locks | Informational | `anonymous-definition` (279), `template-injection` (9) | Name job/workflow definitions; review template-injection audit guidance |
| poutine / runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job requests write-level permissions while workflow responds to `issue_comment`/similar untrusted trigger | Confirm least-privilege permissions; scope write access only to trusted, validated commands |
| grype | `node:lts-alpine`, `alpine:latest`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server` | Critical/High | CVE-2026-75803, CVE-2026-63073, CVE-2026-19931, CVE-2026-18924 (libssl3/libcrypto3/curl/libc6) and others; fixes available (e.g. libssl3 3.5.8-r0, curl 8.22.0-r0) | Bump base images to versions carrying patched Alpine/Debian packages |
| grype (Go stdlib) | `ghcr.io/github/gh-aw-mcpg:v0.4.20` | High | 30 findings incl. GO-2026-6090/6089/5972/5942/5026 (stdlib@go1.26.4, fix 1.25.13/1.26.6/1.27.0-rc.3) and 6 GHSA findings in grpc/sigstore/moby deps | Rebuild `gh-aw-mcpg` image with patched Go toolchain and updated Go module deps |
| grant | Same 9 container images | error | 1,250 license-policy violations (GPL-2.0-only, GPL-3.0-only, and many complex multi-license package manifests) across base-image OS/npm packages | Review `.poutine.yml`/grant policy against actual base-image license inventory; either accept documented exceptions or switch base images |
| yamllint / shellcheck | — | none / 68 warnings (SC2034 unused vars in grader scripts) | No yamllint errors; shellcheck flags unused env vars in `.github/graders/*-operational-value.sh` scripts | Low priority — remove or use the unused grader script variables |

Uncommitted local diffs present at compile time (`git-status.txt`): 13 files (workflow `.md` sources + regenerated `.lock.yml`) plus an untracked `.poutine.yml`, produced by the deterministic compile step itself, not part of this report's findings.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary: `Checked 47 workflow(s)`, `Found 2 issue(s) (2 error(s))`, issues by type: `expression: 2`.

Zizmor severity totals across 47 lock files: Critical 34, High 217, Medium 788, Low 354, Informational 288 (totals include grype/grant findings surfaced through the same actionlint-style output; workflow-source-only zizmor rule totals: High 45 `github-app`, Medium 402 `secrets-outside-env`, Low 271 `undocumented-permissions` + 26 `adhoc-packages`, Informational 279 `anonymous-definition` + 9 `template-injection`, Low 3 `obfuscation`).

Grant: `✗ grant failed — strict mode: grant found 1250 license policy finding(s) in container images`. Redacted — no token-like values observed in report output.

Poutine/runner-guard: 1 finding, `RGS-005` Medium, in `.github/workflows/agentic_commands.yml` (excessive write permissions on untrusted-trigger workflow).

Syft scanned 9 images (567–16 packages each); grype found Critical CVEs in 5 of 9 (alpine, node:lts-alpine, gh-aw-mcpg, gh-aw-firewall/squid, github-mcp-server) and additional High-severity Go-stdlib/module vulnerabilities specific to `gh-aw-mcpg:v0.4.20`.

Diff stat from the compiler's own regeneration (13 files changed, 99 insertions, 99 deletions) reflects routine lock-file/timestamp drift from running `gh aw compile`, not a security finding.

Control plane context

- Correlation ID: `34479868090-972`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34479868090`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34479868090) · copilot · auto · 44.1 AIC · ⌖ 8.48 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 1:18 PM UTC

Start with `gh aw compile` and inspect the two actionlint-reported sources, `self-care-dashboard-performance.lock.yml` and `self-care-pages-health.lock.yml`, through their `.md` sources. Review `.github/workflows/agentic_commands.yml`, the referenced container image definitions, and the gh-aw MCP `fix` and `compile` entry points. Done means the generated locks are reviewed and the full compiler, security, license, and dependency scan passes without unsafe changes.

Written by the indexing model from the issue text.