[aw-doctor:compiler-security] gh-aw compiler run found 2 actionlint errors, 45 High zizmor findings, 528 grype CVEs (34 Critical), and 1250 grant license find

Compiler run against `githubnext/gh-aw-cao` (47 workflow sources, 47 lock files, exit code 1) found actionable findings across 4 categories: 2 actionlint validation errors, 45 zizmor High-severity `github-app` findings plus ~1000 lower-severity zizmor findings, 1 runner-guard excessive-permissions warning, and 528 grype container CVEs (34 Critical / 130 High / 324 Medium / 54 Low) across 9 scanned base images, plus a `grant` license-policy failure (1250 findings). Poutine reported no findings. Highest-severity supported finding: **Critical CVE-2026-18924 / CVE-2026-19931 (curl/libcurl)** and **CVE-2026-63073 / CVE-2026-75803 (openssl)** in multiple pinned container images (`gh-aw-firewall/api-proxy`, `cli-proxy`, `squid`, `alpine`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `expression`: `safe-outputs-app-token` property not defined on the referenced step-output object type | Fix the underlying `.md` source expression referencing `safe-outputs-app-token`; regenerate locks with `gh aw compile` |
| zizmor | 45 lock files (e.g. `uk-ai-advisory.lock.yml`, `self-care*.lock.yml`, `optimization*.lock.yml`, `eu-cra-compliance*.lock.yml`, `dependabot*.lock.yml`, `aw-doctor.lock.yml`, `aw-maintenance-compiler-security.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens | Review app-token usage in the shared control/safe-outputs template; scope token minting per docs.zizmor.sh/audits/#github-app |
| zizmor | many lock files | Medium | `secrets-outside-env` (402 findings): secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block where feasible |
| zizmor | many lock files | Low | `undocumented-permissions` (271), `adhoc-packages` (26), `obfuscation` (3) | Add explanatory comments to `permissions:` blocks; pin/document ad-hoc package installs |
| zizmor | many lock files | Informational | `anonymous-definition` (279), `template-injection` (9, `pr-reviewer.lock.yml`, `self-care.lock.yml`, `self-care-primer-brand-checker.lock.yml`) | Name workflow/action definitions; audit template-expansion sinks for injection risk |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an event triggerable by external users | Restrict permissions or move privileged steps behind an approval gate |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14`, `cli-proxy:0.28.14`, `squid:0.28.14`, `alpine:latest` | Critical | CVE-2026-18924, CVE-2026-19931 (curl/libcurl), CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3/openssl) | Bump base images / packages to patched versions (curl ≥8.22.0-r0, openssl ≥3.5.8-r0) |
| grype | 9 scanned images (`gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node`) | High/Medium/Low | 130 High, 324 Medium, 54 Low CVEs across bind9-libs, perl, undici, and other packages | Rebuild/update pinned image digests to latest patched releases |
| grant | 9 scanned images | error | 1250 license-policy violations (GPL-2.0, GPL-3.0, and other flagged licenses) in base-image packages | Review `grant` license policy configuration and either accept/allowlist known base-OS licenses or select images with compliant licensing |
| poutine | — | — | No findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary:
```
✓ Checked 47 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
i Issues by type:
• expression: 2
```

Zizmor category totals (across 47 files):
```
402 [Medium] secrets-outside-env
279 [Informational] anonymous-definition
271 [Low] undocumented-permissions
45 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

Runner-guard:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Grype (9 images scanned via syft SBOM):
```
34 Critical, 130 High, 324 Medium, 54 Low CVE findings
Critical CVE IDs: CVE-2026-18924, CVE-2026-19931, CVE-2026-5450, CVE-2026-63073, CVE-2026-75803
Affected images: ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14,
ghcr.io/github/gh-aw-mcpg:v0.4.20, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server:v1.12.1,
alpine:latest, node:lts-alpine
```

Grant:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Poutine: no findings reported.

Compiled workflow inventory: 47 workflows, 279 jobs, 5883 steps, 2671 scripts, total 7.0 MB.

Control plane context

- Correlation ID: `34528022546-147`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34528022546

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34528422072) · copilot · auto · 38.2 AIC · ⌖ 8.08 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 9:04 PM UTC

Start with the `.github/workflows/*.md` sources behind `self-care-dashboard-performance.lock.yml` and `self-care-pages-health.lock.yml`, then review the shared control/safe-outputs template and `agentic_commands.yml`. Run `gh aw compile` with strict validation and the listed security scanners; done means source changes regenerate clean lock files and the full compiler and security scan passes without editing generated `.lock.yml` files.

Written by the indexing model from the issue text.