[aw-doctor:compiler-security] Compiler & security scan findings: 45 High github-app tokens, grant license failure, actionlint errors (githubnext/gh-aw-cao)

Compiler and security scan of **githubnext/gh-aw-cao** (47 workflow sources / 47 generated locks, at SHA `06fdee98264012132a5e65d40740945f790f7721`) exited with code **1** (findings, not clean). Highest-severity supported finding: **45 High-severity zizmor `github-app`** warnings (dangerous use of GitHub App tokens) across nearly every workflow. Also present: 2 actionlint expression errors, 402 Medium `secrets-outside-env`, 29 Medium `artipacked`, 271 Low `undocumented-permissions`, 1 Medium runner-guard `RGS-005` (excessive permissions on untrusted trigger), 357 Medium grype CVEs (no Critical/High), and a blocking **grant license-policy failure** (1250 violations across 9 container images). Recommended next action: assign to Copilot to fix source-level actionlint/zizmor/runner-guard issues and re-evaluate the grant license policy/allowlist for base images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression checker) | `self-care-dashboard-performance.lock.yml:2302`, `self-care-pages-health.lock.yml:2208` | error | `safe-outputs-app-token` step output referenced in `GIT_TOKEN` expression but not defined in the job's step-outputs type | Fix step id/output wiring in the source `.md` so the referenced step id exists before use; recompile |
| zizmor | 45 workflows (`aw-doctor`, `aw-failures-investigator`, `aw-maintenance-*`, `eu-cra-compliance-*`, `self-care-*`, `optimization-*`, `uk-ai-advisory*`, `software-development-practices*`, `dependabot*`) | High | `github-app`: dangerous use of `actions/create-github-app-token` | Scope/justify the App token use per zizmor guidance (`docs.zizmor.sh/audits/#github-app`), or restrict permissions requested for the token |
| zizmor | most workflows (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-referencing jobs/steps under a dedicated `environment:` |
| zizmor | ~15 workflows (29 occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts (checkout with `persist-credentials: true` followed by artifact upload) | Set `persist-credentials: false` on checkout or clear credentials before artifact upload |
| zizmor | most workflows (271 occurrences) | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments | Add inline comments justifying each granted permission |
| zizmor | several workflows (26 occurrences) | Low | `adhoc-packages`: ad-hoc package installation (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin exact versions/hashes and document justification |
| zizmor | `optimization-ai-credit-*`, `self-care-docs-build-time-investigator` (3 occurrences) | Low | `obfuscation`: obfuscated usage of Actions features (e.g. `${{ '' }}`) | Replace obfuscated expressions with literal/plain values |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an untrusted-actor event (command trigger) | Drop to read-only permissions or gate write steps behind an explicit trusted-actor check |
| grype | 9 container images (357 occurrences, e.g. `ghcr.io/github/gh-aw-firewall/agent:0.28.14` CVE-2023-50387 `bind9-libs`) | Medium (none Critical/High) | Known CVEs in image OS/library packages | Rebuild/update base images to pull patched package versions |
| grant | 9 container images (1250 occurrences, e.g. `ghcr.io/github/gh-aw-firewall/agent:0.28.14` — GPL-3.0, LGPL, etc. in `sed`, `findutils`, `libatk-bridge2.0-0`, `readline-common`, and others) | unknown (blocking policy violation) | `grant failed`: strict-mode license policy violations across container images | Review and update the license allowlist/policy (`grant` config) or replace/rebuild images with compliant packages |

Note: local `git status` shows 13 modified files (workflow sources and lock files) plus an untracked `.poutine.yml`, reflecting the compiler re-generating locks during this scan; this drift is evidence only and not scored as a separate finding.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary (`summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Zizmor severity totals (across 47 files):
```
402 [Medium] secrets-outside-env
271 [Low] undocumented-permissions
45 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
3 [Low] obfuscation
```

Grype severity totals (9 container images):
```
357 [Medium] (no Critical/High reported)
```

Full raw tool output (698 KB) is retained in the run's `report.txt` evidence artifact; excerpts above are representative and no token-like or credential-like values were found in the output requiring redaction.

Control plane context

- Correlation ID: `34484885125-975`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34484885125

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34484885125) · copilot · auto · 48.8 AIC · ⌖ 12.2 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 2:04 PM UTC

Start with the source workflow files under .github/workflows/*.md and the actionlint findings corresponding to self-care-dashboard-performance.lock.yml:2302 and self-care-pages-health.lock.yml:2208; do not edit generated lock files. Use the gh-aw MCP server's fix and compile tools, then rerun the listed validation tools. Done means the full compiler and security scan passes, or an unsafe finding is clearly documented for human action.

Written by the indexing model from the issue text.