[aw-doctor:compiler-security] Compiler & security scan findings: 2 actionlint errors, 45 High zizmor findings, container CVEs & license violations

Compiling all 47 GitHub Agentic Workflow sources in `githubnext/gh-aw-cao` (exit code 1) surfaced a broad mix of findings across the full validator/linter/scanner suite: 2 actionlint expression errors, 45 zizmor High `github-app` dangerous-token-use findings plus hundreds of Medium/Low/Informational zizmor findings, 1 runner-guard Medium excessive-permissions finding (`RGS-005`), 34 Critical and 217 High container vulnerabilities (grype) across the firewall/mcpg/node/github-mcp-server images, and 1250 license policy violations (grant, strict mode failed) in the same images. Highest severity: Critical CVEs (e.g. CVE-2026-18924, CVE-2026-19931, CVE-2026-63073, CVE-2026-75803) in `curl`/`libcurl`/`openssl` packages inside `ghcr.io/github/gh-aw-firewall/*` and `ghcr.io/github/gh-aw-mcpg` images. Recommended next action: assign remediation to Copilot for the actionlint/zizmor/runner-guard source-level fixes; the container CVE and license findings stem from upstream base images and should be tracked for image bumps.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | self-care-dashboard-performance.lock.yml:2302, self-care-pages-health.lock.yml:2208 | error | `safe-outputs-app-token` step output referenced but not defined in that job's needs/outputs type | Fix the `.md` source's safe-outputs token wiring so the referencing job declares the producing step as a dependency, then recompile |
| zizmor | 45 lock files (e.g. aw-doctor, aw-failures-investigator, dependabot, self-care-*, eu-cra-compliance-*, optimization-*, software-development-practices-*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens | Review each flagged step's use of app-token outputs; scope token usage per zizmor guidance ((docs.zizmor.sh/redacted) |
| zizmor | ~402 occurrences across many workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Route secret references through a job/step `environment:` block |
| zizmor | ~29 occurrences | Medium | `artipacked`: credential persistence risk in checkout/artifacts | Review checkout/artifact steps per zizmor guidance |
| zizmor | ~271 occurrences | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | ~26 occurrences | Low | `adhoc-packages`: ad-hoc package installs | Pin/vendor package installs per zizmor guidance |
| zizmor | ~279 occurrences | Informational | `anonymous-definition`: workflow/action lacks a `name:` | Add descriptive `name:` fields |
| zizmor | 9 occurrences | Informational | `template-injection` | Review flagged expressions for injection risk |
| runner-guard | agentic_commands.yml:1 | Medium (RGS-005) | Excessive permissions (write-level) on a workflow triggered by an untrusted event type | Reduce permissions to read-only or gate write scopes behind trusted-trigger conditions |
| grype | ghcr.io/github/gh-aw-firewall/api-proxy, cli-proxy, squid:0.28.14 | Critical | CVE-2026-18924, CVE-2026-19931: curl/libcurl (fix 8.22.0-r0) | Bump base image / package to patched curl release |
| grype | ghcr.io/github/gh-aw-firewall/squid:0.28.14, ghcr.io/github/gh-aw-mcpg:v0.4.20 | Critical | CVE-2026-63073, CVE-2026-75803: libcrypto3/libssl3/openssl (fix 3.5.8-r0) | Bump base image to patched OpenSSL release |
| grype | ghcr.io/github/gh-aw-firewall/agent:0.28.14 | High | GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg: brace-expansion (fix 5.0.9/5.0.8); GHSA-r292-9mhp-454m: tar (fix 7.5.21); GHSA-mwp4-54f8-5fhr: ip-address (fix 10.3.1) | Update npm dependencies bundled in the firewall agent image |
| grype | 34 Critical / 217 High total across 7 scanned images | Critical/High | Aggregate container vulnerability count (agent, api-proxy, cli-proxy, squid, mcpg, gh-aw-node, github-mcp-server) | Track upstream image updates; not fixable from workflow `.md` sources |
| grant | 9 container images | error (strict mode) | 1250 license policy findings (e.g. `libfribidi0` LGPL-2.1, `liberror-perl` GPL/Artistic mix, many ISC/MIT/BSD packages) | Review license policy exceptions or track upstream base-image licensing; not fixable from workflow `.md` sources |
| shellcheck | 12 grader scripts (e.g. `.github/graders/*-operational-value.sh`) | warning (SC2034) | Unused variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) assigned but apparently unused | Export or remove unused grader variables |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary counts from the compiler run:
- actionlint: 47 files checked, 2 issues (2 errors, both `expression` category)
- zizmor: 402 Medium `secrets-outside-env`, 279 Informational `anonymous-definition`, 271 Low `undocumented-permissions`, 45 High `github-app`, 29 Medium `artipacked`, 26 Low `adhoc-packages`, 9 Informational `template-injection`, 3 Low `obfuscation`
- runner-guard: 1 Medium finding (`RGS-005`) in `agentic_commands.yml`
- grype (9 container images scanned via syft first): 34 Critical, 217 High, plus Medium/Low/Negligible/Unknown across `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`
- grant: strict mode failed with 1250 license policy findings across the same 9 images
- shellcheck: warnings in 12 `.sh` grader scripts (all SC2034 unused-variable style)
- yamllint: ran on 47 files (no findings surfaced beyond the above)

No token-like or credential-like values were present in the scanned output.

Control plane context

- Correlation ID: `34516878347-1006`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34516878347

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34516878347) · copilot · auto · 37.9 AIC · ⌖ 8.65 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 7:11 PM UTC

Start with the compiler findings for `.github/workflows/*.md`, especially the sources for `self-care-dashboard-performance` and `self-care-pages-health`, then inspect `agentic_commands.yml` and the affected `.github/graders/*.sh` scripts. Use the gh-aw MCP server's `fix` and `compile` tools and do not edit generated `.lock.yml` files. Done means the full compiler and security scan passes, or remaining upstream image and license findings are clearly documented.

Written by the indexing model from the issue text.