[aw-doctor:compiler-security] gh-aw compiler & security scan: 51 workflows fail (2 actionlint errors, 49 High zizmor findings, Critical CVEs in 9 images, gran

Compiling all 51 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the full gh-aw validation/lint/security suite failed with **exit code 1**. Actionlint found 2 expression errors, zizmor flagged 49 High-severity "dangerous GitHub App token" findings (one per workflow) plus hundreds of Medium/Low findings, runner-guard flagged 1 Medium excessive-permissions issue, grype found Critical/High CVEs (curl, openssl, libc6) across all 9 scanned container images, and grant's strict license-policy check hard-failed with 1250 findings — this last failure is why the compile run reports non-clean. Highest severity: **Critical** (multiple CVEs, e.g. CVE-2026-19931/CVE-2026-18924/CVE-2026-63073/CVE-2026-75803/CVE-2026-5450) in base images used by gh-aw-firewall, gh-aw-mcpg, gh-aw-node, and github-mcp-server.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2302, self-care-pages-health.lock.yml:2208 | High (error) | `steps.safe-outputs-app-token.outputs.token` referenced but that step ID is not defined in the job's `steps` object type — undefined property expression error | Fix the `.md` workflow source so the referenced step ID matches an actual step, or remove the stale reference; recompile |
| zizmor | All 49 workflows using `actions/create-github-app-token` | High | `github-app`: dangerous use of GitHub App tokens | Review token scoping/usage per zizmor's `github-app` guidance; suppress only if usage is verified safe |
| zizmor | All workflows (418 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block where feasible |
| zizmor | Multiple workflows (29 occurrences) | Medium | `artipacked`: credential persistence / artifact packing risk | Review checkout/artifact steps per zizmor's `artipacked` guidance |
| runner-guard | agentic_commands.yml | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an untrusted event (`pull_request_target`/`issue_comment`-like trigger) | Reduce permissions to read-only for untrusted-trigger jobs, or gate write access behind an authorization check |
| zizmor | All workflows | Low/Informational | `undocumented-permissions`, `adhoc-packages`, `anonymous-definition` | Add explanatory comments to `permissions:` blocks; pin/document ad-hoc package installs; name workflow/job definitions |
| grype | ghcr.io/github/gh-aw-firewall/api-proxy, cli-proxy, squid; ghcr.io/github/gh-aw-mcpg; ghcr.io/github/gh-aw-node; ghcr.io/github/github-mcp-server; alpine:latest; node:lts-alpine | Critical | CVE-2026-19931, CVE-2026-18924 (curl/libcurl 8.21.0-r0, fix 8.22.0-r0); CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3/openssl 3.5.7-r0, fix 3.5.8-r0); CVE-2026-5450 (libc6, github-mcp-server) | Bump base images / rebuild with patched Alpine/Debian packages; update pinned image digests in gh-aw source |
| grype | All 9 scanned images | High (dozens of unique CVEs, e.g. CVE-2026-63076, CVE-2026-63072, CVE-2026-54874, CVE-2026-63075, CVE-2026-18798, CVE-2026-14456/14457, CVE-2026-82208/82209, CVE-2026-80229/80230/80231/80255, CVE-2026-13608, several GHSA/GO advisories) | Package-level OS/npm/Go vulnerabilities in base images | Rebuild images against latest patched base layers; update vendored dependency versions |
| grype | All 9 images | Medium (hundreds, e.g. CVE-2025-60876, CVE-2026-63074, bind9-libs/perl CVEs) | Lower-severity OS package CVEs | Track via routine base-image refresh; not release-blocking alone |
| grant | ghcr.io/github/gh-aw-firewall/agent (and other images) | error (strict mode) | 1250 license policy violations (e.g. GPL-2.0-only, GPL-3.0-only, LGPL packages present in images) flagged under the configured strict license policy | Review `.poutine.yml`/grant license policy configuration; either adjust the allowed-license policy to match actual acceptable licenses or replace/remove disallowed-license packages from images |
| poutine | — | none | Scanner ran, no findings reported | none |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Actionlint summary**: Checked 51 workflow(s), found 2 issue(s) (2 errors) — both `expression` type, undefined `safe-outputs-app-token` step property.

**Zizmor**: ran across 51 files; findings counted above by rule (github-app: 49 High; secrets-outside-env: 418 Medium; artipacked: 29 Medium; undocumented-permissions/adhoc-packages/anonymous-definition: Low/Informational, one set per workflow).

**Runner-guard**: 1 Medium finding — RGS-005 in `agentic_commands.yml` (excessive permissions on untrusted trigger).

**Poutine**: ran, no findings printed in the report.

**Syft**: scanned 9 container images and generated SBOMs — `gh-aw-firewall/agent:0.28.14`, `gh-aw-firewall/api-proxy:0.28.14`, `gh-aw-firewall/cli-proxy:0.28.14`, `gh-aw-firewall/squid:0.28.14`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`.

**Grype**: ran on the same 9 images; ~5 unique Critical CVEs and dozens of unique High CVEs (full per-package detail omitted here for brevity — see the compiler's `report.txt` artifact for exhaustive CVE-to-package mapping).

**Grant**: strict-mode license scan on the 9 images **failed** the run with 1250 total license-policy findings (this is the reason the compile job exit code is 1 in addition to the actionlint errors).

**Working tree diff**: git status shows the compiler regenerated `.github/aw/actions-lock.json` and 54 `.lock.yml`/`.yml` files (whitespace/ordering-only diffs per the diffstat, ~448 insertions / 438 deletions across 55 files) plus an untracked `.poutine.yml`; these are compiler-normalization artifacts from this dry run, not findings themselves.

No token-like or credential-like values were observed in the reviewed evidence.

Control plane context

- Correlation ID: `34543363631-150`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34543363631`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34543644787) · copilot · auto · 37.8 AIC · ⌖ 9.01 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 12:05 AM UTC

Start with the two actionlint findings in .github/workflows/self-care-dashboard-performance.md, self-care-pages-health.md, and the permissions finding in agentic_commands.md; review the other .github/workflows/*.md sources and .poutine.yml as needed. Run the gh-aw MCP server's compile tool with the full validation and security suite, and inspect generated lock-file diffs without editing them. Done means the source workflows preserve existing behavior and the complete compiler and security scan passes cleanly.

Written by the indexing model from the issue text.