[aw-doctor:compiler-security] Compiler & security scan findings: license, CVE, and lint issues in gh-aw-cao workflows

Compiler run against `githubnext/gh-aw-cao` (target SHA `f3a25803faa0bbbfe2319fee9f556cbe484df472`) exited non-zero (exit code 1) across 51 workflow sources / 51 generated locks. Findings: 2 actionlint expression errors, 1250 grant license-policy violations (blocking failure), plus advisory zizmor (34 Critical/221 High/804 Medium/377 Low across 55 workflows — note: the 34 "Critical" and most High counts are grype container CVEs bucketed alongside zizmor tallies; zizmor itself reports 0 Critical, 49 High, 447 Medium, 323 Low), grype (34 Critical / 172 High CVEs across 9 images, 201 unique CVE IDs), 1 runner-guard medium finding, and routine yamllint/shellcheck warnings. Highest confirmed severity: **Critical** — grype-reported CVEs (e.g. CVE-2026-63073 openssl, CVE-2026-18924/19931 curl) in `node:lts-alpine`, `alpine:latest`, and gh-aw-firewall/mcpg images, none currently pinned with fixes applied.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step-output property not defined in generated expression context | Fix upstream compiler template that emits the `steps.safe-outputs-app-token.outputs.token` reference so it matches the actual step ID/outputs shape, then recompile |
| grant | node:lts-alpine (and 8 other images) | error (build-blocking) | 1250 license-policy violations (ISC 365, MIT 285, Apache-2.0 69, GPL-2.0-only 62, BlueOak-1.0.0 55, BSD variants, GPL-3.0/LGPL, curl, X11, etc.) | Review `.poutine.yml`/grant policy allowlist for base images; pin to distroless/minimal images or extend accepted-license list per legal review |
| grype | node:lts-alpine, alpine:latest, gh-aw-firewall/agent, gh-aw-mcpg, github-mcp-server | Critical | CVE-2026-63073, CVE-2026-75803 (openssl/libssl3/libcrypto3), CVE-2026-18924, CVE-2026-19931 (curl/libcurl), CVE-2026-5450 (libc6, github-mcp-server image) | Rebuild/repull base images to pick up patched packages (openssl≥3.5.8-r0, curl≥8.22.0-r0); bump pinned image digests |
| grype | gh-aw-firewall/agent:0.28.14 | Medium | ~350 CVEs across bind9-libs, perl, other Ubuntu packages | Track upstream firewall image release with patched packages |
| zizmor | 49 workflow locks | High | `github-app`: dangerous use of GitHub App tokens (create-github-app-token step) | Scope App token permissions minimally, confirm short-lived usage, add explanatory comment/suppression if intentional |
| zizmor | ~29 lock files | Medium | `artipacked`: credential persistence risk via `persist-credentials: true` + artifact upload | Set `persist-credentials: false` after checkout or scope artifact retention/exclude `.git` |
| zizmor | 418 occurrences | Medium | `secrets-outside-env`: secrets referenced without dedicated `environment:` | Move secret-consuming jobs to declared `environment:` blocks |
| zizmor | 294 occurrences | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add inline comments justifying each granted permission |
| zizmor | 26 occurrences | Low | `adhoc-packages`: ad-hoc binary/package installs (e.g. AWF binary install script, `npm install -g @earendil-works/pi-coding-agent`) | Pin installer script content or move to vetted setup action |
| zizmor | 3 occurrences | Low | `obfuscation`: obfuscated use of Actions features (e.g. `${{ '' }}` env expressions) | Simplify expression or add clarifying comment |
| runner-guard | agentic_commands.yml | Medium | RGS-005: write-level permissions alongside untrusted trigger (`issue_comment`/similar) | Restrict permissions to read-only where possible, or gate write steps behind explicit authorization checks |
| yamllint/shellcheck | multiple graders | info/warning | Unused shell variables (SC2034) in `*-operational-value.sh` grader scripts | Export or remove unused variables, or add `# shellcheck disable=SC2034` with justification |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint errors (2):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2302:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...; setup: ...; setup-agent-output-env: ...}
.github/workflows/self-care-pages-health.lock.yml:2208:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...; setup: ...; setup-agent-output-env: ...}
```

Grant final status:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Scanned container images (syft/grype/grant): ghcr.io/github/gh-aw-firewall/agent:0.28.14, .../api-proxy:0.28.14, .../cli-proxy:0.28.14, .../squid:0.28.14, ghcr.io/github/gh-aw-mcpg:v0.4.20, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server:v1.12.1, alpine:latest, node:lts-alpine.

Full raw compiler/scanner output (724 KB) is preserved in the workflow run artifact `/tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt` for this run (run ID `34539246839`). No token-like or credential-like values were observed in the excerpted output above.

Control plane context

- Correlation ID: `34538774701-149`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34538774701

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34539246839) · copilot · auto · 51.1 AIC · ⌖ 8.01 AIC · ⊞ 14.1K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 24, 2026, 11:05 PM UTC

Start by reviewing the compiler report at /tmp/gh-aw/agent/aw-maintenance-compiler-security/report.txt and the named self-care-dashboard-performance.lock.yml and self-care-pages-health.lock.yml findings; trace them back to .github/workflows/*.md sources. Use the gh-aw MCP server's fix and compile tools, then verify the full scanner set passes without directly editing generated lock files.

Written by the indexing model from the issue text.