[aw-doctor:compiler-security] gh-aw-cao: compiler exit 1 — 2 actionlint errors, 1064 zizmor findings, 588 grype CVEs, 1250 license violations

Compiler run on `githubnext/gh-aw-cao` exited with code 1 (findings, not clean). 47 workflow sources / 47 lock files compiled successfully, but strict-mode validation failed on: 2 actionlint expression errors, 1064 zizmor findings (45 High: dangerous GitHub App token usage), 1 runner-guard medium finding (excessive write permissions on an untrusted trigger), 588 grype container vulnerabilities (34 Critical, 217 High) across 5 images, and grant failing strict license-policy checks with 1250 findings across 9 container images. Highest-severity supported finding: zizmor `github-app` (High) — dangerous use of GitHub App tokens, and grype Critical CVEs (e.g. CVE-2026-19931 curl/libcurl) in firewall/proxy images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step property not defined in expression context | Regenerate lock files from updated `.md` sources after fixing the underlying step reference; do not hand-edit `.lock.yml` |
| zizmor | 45 lock files (e.g. aw-doctor, uk-ai-advisory) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping and follow zizmor guidance at docs.zizmor.sh/audits/#github-app |
| zizmor | 402 occurrences across lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job `environment:` block |
| zizmor | 271 occurrences | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | 29 occurrences | Medium | `artipacked`: credential persistence through Actions artifacts | Avoid uploading credential-bearing paths as artifacts |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc package installation (e.g. `npm install -g`) | Pin package installs via lockfile/manifest where possible |
| zizmor | 3 occurrences | Low | `obfuscation` | Review flagged expressions for obfuscated logic |
| runner-guard | agentic_commands.yml | Medium | RGS-005: write permissions (`contents: write` etc.) on a workflow triggered by untrusted events (`issue_comment`) | Narrow permissions or gate write-level jobs behind an authorization check |
| grype | ghcr.io/github/gh-aw-firewall/agent:0.28.14, api-proxy, cli-proxy, gh-aw-mcpg:v0.4.20, node:lts-alpine | Critical (34), High (217) | brace-expansion, tar, ip-address, grpc, curl/libcurl and other CVEs with available fixed versions | Bump base/dependency versions in image build to the fixed versions listed in each finding |
| grant | alpine:latest (16), gh-aw-firewall/agent (381), api-proxy (185), cli-proxy (178), squid (63), gh-aw-mcpg (80), gh-aw-node (176), github-mcp-server (7), node:lts-alpine (164) | error | 1250 license policy violations (strict mode) across 9 container images | Review `.grant.yaml` allow-list vs. actual package licenses in each image; update policy or image contents to resolve violations |

Deduplication note: CVE-2022-3219 and CVE-2025-60876 rows above are grype (container OS package) findings, not zizmor; they are counted only once in the grype row.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Zizmor summary (by rule, all severities):
```
402 secrets-outside-env (Medium)
271 undocumented-permissions (Low)
45 github-app (High)
29 artipacked (Medium)
26 adhoc-packages (Low)
3 obfuscation (Low)
```

grype summary: 588 total findings across 5 images (34 Critical, 217 High, remainder Medium/Low), e.g.:
```
ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14: error [Critical] CVE-2026-19931: curl@8.21.0-r0 (fix: 8.22.0-r0)
ghcr.io/github/gh-aw-mcpg:v0.4.20: error [High] GHSA-vp52-pcj8-j9qc: google.golang.org/grpc@v1.81.1 (fix: 1.83.1)
```

grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

poutine: no findings reported (scan completed without emitting violation lines).

Compiled-lock diff (pending, uncommitted in the compiler workspace — informational only, not part of this report's remediation):
```
13 files changed, 99 insertions(+), 99 deletions(-)
```
This diff only bumps `github/gh-aw-actions/setup` and `setup-cli` from a `@v0.89.1` tag ref to a pinned commit SHA — unrelated to the findings above.

Control plane context

- Correlation ID: `34503852269-143`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34503852269

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34504538640) · copilot · auto · 53.2 AIC · ⌖ 9.21 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 5:12 PM UTC

Start with the .github/workflows/*.md sources and configure gh aw mcp-server from the target repository, using its fix and compile tools; do not edit generated .lock.yml files. Review the generated lock-file diffs and rerun the listed compiler and security checks, with completion requiring all findings to pass or an explicit explanation for anything that cannot be fixed safely.

Written by the indexing model from the issue text.