[aw-doctor:compiler-security] AW compiler & security scan findings: actionlint, zizmor, poutine, grype, grant (githubnext/gh-aw-cao)

Compiling all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` (SHA `f35aa46f`) with the full validation/lint/container/security-scanner suite exited non-zero. Findings span 2 actionlint expression errors, 5 zizmor rule categories (45 High "dangerous GitHub App token use", 402+29+271+26+3 Medium/Low), 1 poutine/runner-guard Medium permissions warning, grype container vulnerabilities (34 Critical / 172 High / 357 Medium / 54 Low) across 9 images, and a `grant` strict-mode failure with 1250 license-policy violations in base-image OS packages. Highest severity: **Critical** container CVEs (curl, libssl3/libcrypto3, libc6) with available upstream fixes. Recompiling also produced uncommitted local diffs on 10 lock files and 3 source `.yml` files, indicating the committed locks are stale relative to the current compiler (v0.89.1).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Property `safe-outputs-app-token` not defined in referenced step-outputs object (`GIT_TOKEN` expression) | Fix the workflow source's step-id reference for the conditional app-token step, then recompile |
| zizmor | 45 lock files | High | `github-app`: dangerous use of GitHub App tokens (`create-github-app-token`) | Review flagged steps; confirm least-privilege scoping or document/suppress with justification |
| zizmor | 47 lock files (402 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Add an `environment:` block to jobs referencing secrets, or document suppression |
| zizmor | multiple lock files (29 occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts (`persist-credentials: true` + artifact upload) | Set `persist-credentials: false` on checkout steps that upload artifacts, or scrub `.git` before upload |
| zizmor | multiple lock files (271 occurrences) | Low | `undocumented-permissions`: permission blocks without explanatory comments | Add comments explaining each granted permission |
| zizmor | multiple lock files (26 occurrences) | Low | `adhoc-packages`: ad-hoc package installation | Pin/verify installer scripts and versions |
| zizmor | 3 lock files | Low | `obfuscation`: obfuscated usage of Actions features | Simplify per zizmor audit guidance |
| poutine / runner-guard | `agentic_commands.yml` | Medium | `RGS-005`: job specifies write-level permissions while triggered by `issue_comment` (untrusted trigger) | Scope job permissions down to read-only or split privileged steps into a separate job gated by approval |
| grype | 9 images: `gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine` | Critical (34) / High (172) / Medium (357) / Low (54) | Known CVEs in base-image packages, e.g. `curl`/`libcurl` (CVE-2026-19931, CVE-2026-18924), `libssl3`/`libcrypto3`/`openssl` (CVE-2026-63073, CVE-2026-75803), `libc6` (CVE-2026-5450), agent image `brace-expansion`/`tar` advisories | Rebuild or bump pinned base/tool images to patched versions (fixes available per advisory) |
| grant | same 9 images | error (1250 total) | License-policy violations in base-image OS/tooling packages (GPL-2.0/3.0, LGPL, ISC, BSD variants, etc.) | Tune `grant` policy allowlist for expected base-OS licenses, or accept a documented exception |
| shellcheck | 16 grader wrapper scripts (`.github/graders/*-operational-value.sh`) | Low (warning) | `SC2034`: template env vars (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) appear unused | Cosmetic; suppress in the grader script template or mark vars as intentionally exported |
| compiler drift | 3 `.yml` sources + 10 `.lock.yml` files | info | Recompiling with compiler v0.89.1 produced local diffs vs. committed files, plus an untracked `.poutine.yml` | Recompile and commit the regenerated lock files so committed artifacts match the current compiler output |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Summary: Target githubnext/gh-aw-cao, exit code 1, 47 workflow sources, 47 compiled locks.
Compile: guard policy dry-run reports OK; "Ignoring includes entry .github/workflows/aw.json" info-level warning (non-fatal).

actionlint: 47 files checked, 2 errors (both "expression" category: safe-outputs-app-token undefined property).

zizmor: 47 files scanned.
Critical: 0 rule findings (all Critical items below are grype container CVEs, not zizmor).
High: 45 (github-app)
Medium: 431 (402 secrets-outside-env + 29 artipacked)
Low: 300 (271 undocumented-permissions + 26 adhoc-packages + 3 obfuscation)

poutine/runner-guard: 1 warning — RGS-005 in agentic_commands.yml (write perms on issue_comment trigger).

syft: SBOM generated for 9 container images.

grype: 9 images scanned.
Critical: 34, High: 172, Medium: 357, Low: 54
Images: alpine:latest, node:lts-alpine, gh-aw-firewall/agent:0.28.14, gh-aw-firewall/api-proxy:0.28.14,
gh-aw-firewall/cli-proxy:0.28.14, gh-aw-firewall/squid:0.28.14, gh-aw-mcpg:v0.4.20, gh-aw-node,
github-mcp-server:v1.12.1
Representative CVEs: CVE-2026-19931/18924 (curl/libcurl), CVE-2026-63073/75803 (libssl3/libcrypto3/openssl),
CVE-2026-5450 (libc6), GHSA-rgw5-rvv9-x895/GHSA-mh99-v99m-4gvg (brace-expansion), GHSA-r292-9mhp-454m (tar).

grant: strict mode FAILED — 1250 license policy findings across the same 9 images (mostly GPL/LGPL/ISC/BSD
base-OS package licenses, e.g. grep GPL-3.0, adduser GPL-2.0, libssl3 base-image variant).

yamllint: no findings reported.
shellcheck: ran on 2687 run-step resources; findings limited to SC2034 (unused var) warnings in 16
operational-value grader wrapper scripts — cosmetic only.

Experimental features in use: graders (16 workflows), gh-aw-detection (2 workflows).
Total: 279 jobs, 5883 steps, 2671 scripts, 7.0 MB across 47 workflows.

git status after recompile: 13 files modified (3 source .yml, 10 .lock.yml) + untracked .poutine.yml,
99 insertions / 99 deletions net across lock files — indicates lock drift vs. compiler v0.89.1.
```

Redaction note: no token-like or credential-like values were present in the reviewed report; none were reproduced above.

Control plane context

- Correlation ID: `34491095785-141`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34491095785`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34491927036) · copilot · auto · 37.2 AIC · ⌖ 9.07 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 3:12 PM UTC

Start with the two workflows flagged by actionlint, agentic_commands.yml, and the .github/workflows/*.md sources; use the gh aw MCP server's fix and compile entry points rather than editing generated .lock.yml files. Re-run the full compiler, actionlint, shellcheck, zizmor, poutine, runner-guard, grant, grype, and syft suite. Done means the findings are resolved or safely explained and the complete scan passes.

Written by the indexing model from the issue text.