[aw-doctor:compiler-security] Compiler and security scan findings: 2 actionlint errors, critical container CVEs, license policy failures

Compilation of all 47 GitHub Agentic Workflows in `githubnext/gh-aw-cao` failed (exit code 1) due to 2 actionlint expression errors, plus the security-scanner suite reported 34 critical / 130 high container CVEs across 8 base images, 1,250 license-policy violations (`grant` failed in strict mode), and zizmor findings (45 high `github-app` token risks, 402 medium `secrets-outside-env`, 29 medium `artipacked`, 271 low `undocumented-permissions`, 26 low `adhoc-packages`, 3 low `obfuscation`). Highest-severity supported finding: **Critical container CVEs** (e.g. CVE-2026-19931/CVE-2026-18924 in curl/libcurl, CVE-2026-63073/CVE-2026-75803 in openssl/libssl3/libcrypto3) across `alpine:latest`, `node:lts-alpine`, `github-mcp-server:v1.12.1`, and all `gh-aw-firewall` proxy images. Recommended next action: patch the two actionlint expression errors first (blocking compile), then rebuild/upgrade the flagged container base images and address the `grant` license-policy failure.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml:2302`, `self-care-pages-health.lock.yml:2208` | error | `steps.safe-outputs-app-token.outputs.token` referenced but step id not defined in job's step set (expression type-check failure) | Fix the `.md` source generating these two workflows so the `safe-outputs-app-token` step is declared before use, then recompile |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1` | Critical (34 total) | CVE-2026-19931/CVE-2026-18924 (curl/libcurl), CVE-2026-63073/CVE-2026-75803 (openssl/libssl3/libcrypto3), CVE-2026-5450 (libc6) | Bump base images / pinned digests to patched releases (fixes available per-CVE, e.g. curl 8.22.0-r0, openssl 3.5.8-r0) |
| grype | same images as above | High (130 total) | Additional High-severity CVEs bundled with the same package upgrades | Same image/package bumps resolve most High findings alongside Critical ones |
| grant | 9 container images | error (strict mode failure) | 1,250 license-policy violations across `node:lts-alpine` and other images (many MIT/Apache-2.0/ISC/BlueOak packages flagged by current allow-list) | Review and update the `grant` license policy allow-list, or replace/slim images to remove disallowed transitive packages |
| zizmor | 45 workflow `.lock.yml` files (e.g. `uk-ai-advisory.lock.yml:1393`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) — flagged pattern is shared across the `control.md` template | Review token-scoping/dry-run guard usage in the shared control template; confirm mitigations are in place or add zizmor suppressions with justification |
| zizmor | 45 workflow `.lock.yml` files | Medium (402) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into a job/step with an explicit `environment:` block where feasible |
| zizmor | multiple `.lock.yml` files | Medium (29) | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure checkout/token steps don't persist credentials into uploaded artifacts (`persist-credentials: false`) |
| zizmor | multiple `.lock.yml` files | Low (271) | `undocumented-permissions`: job `permissions:` blocks without explanatory comments | Add comments justifying each granted permission scope |
| zizmor | multiple `.lock.yml` files | Low (26) | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor installs through a controlled setup step or lockfile |
| zizmor | few `.lock.yml` files | Low (3) | `obfuscation`: potentially obfuscated workflow content | Manually review flagged steps for unintended obfuscation |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Excessive permissions (write-level) on a workflow triggered by an untrusted event context | Confirm trigger context is safe or reduce granted permissions to read-only where possible |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary: 2 issues found (2 errors, both `expression` type: `safe-outputs-app-token` step undefined).

Zizmor severity totals: 34 Critical (container CVEs, reported separately by grype), 217 High (45 `github-app` + grype High subset), 788 Medium (402 `secrets-outside-env` + 29 `artipacked` + others), 354 Low (271 `undocumented-permissions` + 26 `adhoc-packages` + 3 `obfuscation` + others).

Grype: 34 Critical CVEs, 130 High CVEs across 9 scanned container images (syft SBOMs generated for each: `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`).

Grant: strict mode failed with 1,250 license-policy findings, largest volume from `node:lts-alpine` transitive npm dependencies (MIT/Apache-2.0/ISC/BlueOak-1.0.0 licenses flagged by current policy).

Note: `git-status.txt` from the compiler run shows one untracked file, `.poutine.yml`, created during the scan; no other repository state changes were recorded (`diff-stat.txt` empty).

Control plane context

- Correlation ID: `34509899709-144`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34509899709

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34510375069) · copilot · auto · 35.5 AIC · ⌖ 9.35 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 6:08 PM UTC

Start with the .github/workflows/*.md sources that generate self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml, then run the gh aw MCP server's compile and fix tools. Review control.md and agentic_commands.yml for the shared security findings, and inspect generated lock-file diffs without editing them. Done means strict compilation and the listed actionlint, security, policy, and scanning checks pass.

Written by the indexing model from the issue text.