[aw-doctor:compiler-security] AW compiler & security scan findings: 34 critical CVEs, grant license-policy failure, 2 actionlint errors

Compiling all 47 gh-aw workflow sources (47 generated lock files) in `githubnext/gh-aw-cao` completed with **exit code 1** (findings, not incomplete). The compiler itself succeeded; failures come from actionlint, the zizmor/runner-guard security scanners, and the grype/grant container scanners. Highest severity: **34 Critical** grype CVEs across 6 of 9 pinned container images, plus a strict-mode `grant` failure (1,250 license-policy violations) that currently blocks a clean pipeline. Two actionlint expression errors point to a likely compiler-template regression (`safe-outputs-app-token` reference not defined in the job's `needs` outputs type) affecting 2 lock files. No code executed unsafely; these are static findings requiring triage and remediation.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `property "safe-outputs-app-token" is not defined` in the step-outputs object type used by `GIT_TOKEN` expression | Regenerate lock files from `.md` sources after fixing the underlying job/step `id`/`needs` wiring for the `safe-outputs-app-token` step; if the template itself is at fault, this may need a gh-aw compiler fix rather than a workflow-source edit |
| zizmor | 37 of 47 lock files | High (45 findings) | `github-app`: dangerous use of GitHub App tokens | Review each flagged job's use of the App token; scope token permissions and confirm the token isn't exposed to untrusted input paths |
| zizmor | all 47 lock files | Medium (402 findings) | `secrets-outside-env`: secrets referenced outside a step's `env:` block | Move secret references into `env:` mappings instead of inline expression interpolation in `run:`/`with:` |
| zizmor | 16 lock files | Medium (29 findings) | `artipacked`: risk from persisted-credentials/artifact packing in checkout steps | Set `persist-credentials: false` (or scope artifact retention) on flagged `actions/checkout` steps |
| zizmor | 271 findings across most lock files | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add short comments justifying each granted permission (informational; low priority) |
| zizmor | 26 findings | Low | `adhoc-packages`: ad-hoc package installs without pinned versions | Pin package versions/checksums where flagged |
| zizmor | 3 findings | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Inspect flagged expressions for clarity/simplification |
| zizmor | 9 findings (`pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`) | Informational | `template-injection`: code injection via template expansion | Review flagged expressions; confirm inputs are not attacker-controlled or add sanitization |
| runner-guard | `agentic_commands.yml` (source) | Medium | `RGS-005`: excessive write permissions on a workflow reachable via untrusted trigger paths (`issue_comment`/`pull_request_target`-style commands) | Confirm the command dispatch job does not itself carry write permissions on untrusted-trigger paths, or add stricter gating |
| poutine | — | — | No findings | none |
| grype | 6 of 9 pinned container images (`gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node`) | **Critical (34)** | CVE-2026-18924, CVE-2026-19931 (curl/libcurl), CVE-2026-63073 (libcrypto3/libssl3), CVE-2026-5450, CVE-2026-75803 | Bump base images / pinned digests to versions with patched packages (fixed versions listed per-CVE in raw evidence) |
| grype | same images | High (172), Medium (357), Low (54), Negligible (27), Unknown (18) | OS-package and npm-dependency CVEs (e.g. `bind9-libs`, `brace-expansion`, `undici`, `libexpat1`, `perl*`) | Update pinned image digests in workflow manifests to versions carrying patched packages |
| grant | all 9 pinned container images | error (strict mode, 1,250 findings) | License-policy violations against the configured allow-list (e.g. `treeverse@3.0.0` ISC, `@sigstore/sign@4.1.1` Apache-2.0, many BSD/MIT/ISC OS packages) | Either update `grant`'s license allow-list to include the flagged (permissive) licenses already in use, or replace/remove packages carrying disallowed licenses; this single misconfiguration/policy gap is currently the largest blocker to a clean `grant` pass |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priority order: (1) fix the 2 actionlint `safe-outputs-app-token` expression errors — these may require a gh-aw compiler-side fix rather than a workflow-source change, so investigate the compiler's job-output typing for that step before editing sources; (2) resolve the `grant` strict-mode license-policy failure (1,250 findings) by updating the license allow-list configuration or replacing offending dependencies in the pinned container images; (3) bump pinned container image digests to remediate the 34 Critical / 172 High grype CVEs; (4) address zizmor `github-app` (High) and `secrets-outside-env`/`artipacked` (Medium) findings across affected workflow sources; (5) address the single `RGS-005` runner-guard finding in `agentic_commands.yml`.

Raw evidence

Deterministic evidence collected in `/tmp/gh-aw/agent/aw-maintenance-compiler-security/`:

- `summary.txt`: Target `githubnext/gh-aw-cao`, exit code 1, 47 workflow sources, 47 compiled locks.
- `git-status.txt`: only untracked `.poutine.yml` (scanner config artifact, not a source change).
- `diff-stat.txt`: empty (no source diffs).
- `report.txt` (698 KB, 9,581 lines) contains full per-tool output. No token-like or credential-like values were present in the excerpts reviewed; none reproduced here.

Severity tallies (from `report.txt`):
- zizmor: 45 High, 431 Medium (402 secrets-outside-env + 29 artipacked), 300 Low, 288 Informational
- grype: 34 Critical, 172 High, 357 Medium, 54 Low, 27 Negligible, 18 Unknown
- grant: 1,250 license-policy violations (strict mode failure — this alone causes the non-zero exit code alongside the 2 actionlint errors)
- actionlint: 2 errors (expression), 0 other issue types
- runner-guard: 1 Medium (RGS-005)
- poutine: 0 findings
- yamllint / shellcheck: only informational SC2034 "unused variable" warnings in grader scripts (non-security)

Control plane context

- Correlation ID: `34534016650-1027`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34534016650`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34534016650) · copilot · auto · 45.2 AIC · ⌖ 7.35 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 10:07 PM UTC

Start by reproducing the compiler and security scans for the `.github/workflows/*.md` sources, with attention to `agentic_commands.yml` and the two lock files reporting `safe-outputs-app-token` errors. Trace that finding to the source or compiler behavior, then review the grant, grype, zizmor, and runner-guard reports. Done means source changes compile cleanly and the full required scan passes without directly editing generated `.lock.yml` files.

Written by the indexing model from the issue text.