[aw-doctor:compiler-security] gh-aw compiler & security scan findings for githubnext/gh-aw-cao (2 actionlint errors, license/CVE failures)

Compiled all 47 gh-aw workflow sources in `githubnext/gh-aw-cao` (47 generated locks). The compiler run **failed** (exit code 1): 2 actionlint errors, 45 High zizmor findings, 34 Critical + 172 High container CVEs (grype), and 1250 license-policy violations (grant, which caused the overall failure). Highest-severity supported finding: **Critical CVEs** (e.g. CVE-2026-63073 in libssl3/libcrypto3, CVE-2026-18924/CVE-2026-19931 in curl/libcurl) across 8 of 9 scanned container images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token.outputs.token` referenced but step id not defined in that job context | Fix the generated step reference in the workflow `.md` source (job/step wiring for the safe-outputs app-token step) and recompile |
| zizmor | 36 lock files (e.g. `aw-doctor.lock.yml`, `uk-ai-advisory.lock.yml`) | High | `github-app`: dangerous use of `actions/create-github-app-token` GitHub App tokens (45 occurrences) | Review App-token scope/lifetime; ensure token is minimally scoped and not persisted beyond the job |
| zizmor | 402 occurrences across most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs into a declared `environment:` |
| zizmor | 29 occurrences | Medium | `artipacked`: potential credential/artifact persistence pattern | Review artifact upload/checkout steps for lingering credentials |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` | Informational | `template-injection`: untrusted expression interpolation (9 occurrences) | Use intermediate env vars instead of direct `${{ }}` interpolation in `run:` blocks |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin via lockfile/manifest instead of ad-hoc install steps |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` | Low | `obfuscation` | Review flagged expressions for indirect/obfuscated construction |
| zizmor | 271 occurrences | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | most lock files | Informational | `anonymous-definition`: unnamed workflow/job definitions (279 occurrences) | Cosmetic; add `name:` fields if desired |
| grype | 8 of 9 images (alpine, gh-aw-firewall/api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, node:lts-alpine) | Critical | 34 CVEs, notably CVE-2026-63073/CVE-2026-75803 (libssl3/libcrypto3), CVE-2026-18924/CVE-2026-19931 (curl/libcurl), CVE-2026-5450 (libc6) | Bump base images / packages to patched versions (e.g. libcrypto3/libssl3 3.5.8-r0, curl/libcurl 8.22.0-r0) |
| grype | multiple images | High | 172 findings, incl. GHSA-rgw5-rvv9-x895 (brace-expansion, fix 5.0.9) | Update vulnerable package versions in image build/deps |
| grype | multiple images | Medium | 357 findings (mostly `bind9-libs`, `libexpat1`, etc.) | Track via base-image updates; not blocking |
| grant | all 9 images | error (license policy) | 1250 license-policy violations (this is what made the compiler exit non-zero) | Review `grant` license policy config vs. actual dependency licenses; either adjust policy allow-list or replace disallowed dependencies |
| shellcheck | 12 grader scripts under `.github/graders/*-operational-value.sh` | warning (SC2034) | Unused variables (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) appear unused | Export or remove unused grader-script variables |
| yamllint | 47 files | — | clean, no findings | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 47
Compiled locks: 47
```

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
i Issues by type:
• expression: 2
```

Grant (license scanner) summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

zizmor severity totals (informational/low/medium/high, no criticals): High 45, Medium 431, Low 300, Informational 288.

grype severity totals: Critical 34, High 172, Medium 357, Low 54, Negligible 27, Unknown 18.

Full raw report (698 KB) is available in the workflow run artifacts; not reproduced here due to size. An unrelated untracked `.poutine.yml` file was observed in git status from the scanner run (not a compiler finding).

Control plane context

- Correlation ID: `34522563914-1015`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34522563914

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34522563914) · copilot · auto · 40.9 AIC · ⌖ 9.38 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 8:07 PM UTC

Start with the 47 workflow sources under `.github/workflows/*.md` and the two actionlint-reported workflow contexts. Use `gh aw mcp-server` with its `fix` and `compile` tools, never editing generated `.lock.yml` files. Done means the full strict compiler and security scan passes, including actionlint, zizmor, grant, grype, shellcheck, yamllint, poutine, runner-guard, and syft.

Written by the indexing model from the issue text.