[aw-doctor:compiler-security] AW compiler security scan: 34 Critical / 172 High CVEs, 49 zizmor High github-app findings, 1250 license violations

Compiling all 51 workflows in `githubnext/gh-aw-cao` (target sha `70547a8d`) succeeded, but the full validation suite exited with code 1: 2 actionlint expression errors, 49 zizmor High findings (all `github-app` token misuse across 39 lock files), 447 zizmor Medium (`secrets-outside-env` x418, `artipacked` x29), 1 poutine/runner-guard Medium finding, and grype found 34 Critical / 172 High CVEs across 9 scanned container images plus grant reported 1,250 license-policy violations that fail strict mode — the highest-severity findings are the grype Criticals (unpatched `libssl3`/`libcrypto3` in `alpine:latest`, `node:lts-alpine`, and the gh-aw-firewall images) and the zizmor High `github-app` token findings. Recommended next action: assign the remediation prompt below to Copilot to update pinned base images/action versions and add zizmor suppressions/documentation where findings are accepted risk, then re-run the full compiler+scanner suite before merge.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml:2302`, `self-care-pages-health.lock.yml:2208` | error | `steps.safe-outputs-app-token` referenced but not a defined step output in that job context | Fix the generated step-output reference in the workflow source template (compiler bug or missing step id); regenerate locks |
| zizmor | 39 lock files (e.g. `aw-doctor.lock.yml:1513`, `cao-maintenance.lock.yml:1576`) | High | `github-app`: dangerous use of `actions/create-github-app-token` — 49 occurrences | Review each App-token minting step; scope tokens narrowly, ensure they aren't exposed to untrusted contexts, or add a documented zizmor suppression if the pattern is intentional and already isolated |
| zizmor | 39 lock files (e.g. `aw-doctor.lock.yml:128`) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` — 418 occurrences | Move secret-consuming jobs behind a GitHub Environment, or accept/document via `.zizmor.yml` ignore if these are internal control-plane jobs already gated by policy |
| zizmor | e.g. `dashboard-authoring-corpus.lock.yml:1830`, `dependabot-release-train-updater.lock.yml:2600/2606` | Medium | `artipacked`: checkout with `persist-credentials: true` after an artifact download, risking credential persistence — 29 occurrences | Set `persist-credentials: false` on post-artifact checkout steps unless the token is required, or document why persistence is needed |
| zizmor | e.g. `aw-doctor.lock.yml:518` | Low (unknown severity mapping n/a) | `adhoc-packages`: ad-hoc `npm install -g` outside lockfile — 26 occurrences | Pin/vendor tool installs or accept as low-risk (already Low) |
| zizmor | many lock files | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments — 294 occurrences | Add short comments justifying each granted permission scope |
| poutine / runner-guard | `agentic_commands.yml:1` | Medium | RGS-005 Excessive Permissions on Untrusted Trigger (informational; command-dispatch workflow already gated by `.poutine.yml` skip for `activation`, but this specific job wasn't skipped) | Confirm `agentic_commands.yml`'s write permissions are required for its trigger type, or narrow scope |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.28.14`, `ghcr.io/github/gh-aw-mcpg:v0.4.20` | Critical | 34 Critical CVEs, dominated by unpatched `libssl3`/`libcrypto3` 3.5.7-r0 (fix 3.5.8-r0), e.g. CVE-2026-75803, CVE-2026-63073 | Bump base images to a release that includes patched Alpine `libssl3`/`libcrypto3`, or rebuild/repin the affected `ghcr.io/github/gh-aw-firewall/*` and `gh-aw-mcpg` images |
| grype | same set + `ghcr.io/github/gh-aw-firewall/agent:0.28.14`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1` | High | 172 High CVEs (additional `libssl3`/`libcrypto3` CVEs, `ip-address`, `tar`, `brace-expansion` npm advisories) | Same base-image/dependency bump as above; update npm deps bundled in `gh-aw-node`/`gh-aw-mcpg` images |
| grant | all 9 scanned images | error (strict-mode fail) | 1,250 license-policy violations (dominant licenses: ISC 365, MIT 285, Apache-2.0 69, GPL-2.0-only 62, BlueOak-1.0.0 55) | Review `.grant.yaml` policy: either the allow-list needs updating for these common OSS licenses, or these packages must be excluded/replaced. This is very likely a policy-config gap rather than a genuine violation, given the volume of common permissive licenses flagged |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Specific items to address:
1. Fix the actionlint `safe-outputs-app-token` expression error in the workflow source(s) generating `self-care-dashboard-performance.lock.yml` and `self-care-pages-health.lock.yml`.
2. Review the 49 zizmor High `github-app` findings and either tighten token scope/exposure or add a documented, justified suppression.
3. Triage the 418 `secrets-outside-env` and 29 `artipacked` Medium findings; fix `persist-credentials` on post-artifact checkouts, and add GitHub Environments or documented suppressions where secrets access is already policy-gated.
4. Update pinned base images (`alpine`, `node:lts-alpine`) and the `ghcr.io/github/gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server` image references to versions with patched `libssl3`/`libcrypto3` and other flagged CVEs; re-pin digests after verifying with grype.
5. Review `.grant.yaml` license policy against the 1,250 flagged findings (mostly common permissive licenses: ISC, MIT, Apache-2.0, BlueOak-1.0.0) and update the allow-list or exclude non-applicable packages so `grant` passes in strict mode without masking a real GPL/AGPL concern.

Raw evidence

Summary from `summary.txt`:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint: 2 issue(s) (2 errors), category `expression`.

Zizmor: 49 High (`github-app`), 447 Medium (`secrets-outside-env` 418, `artipacked` 29), 320 Low (`undocumented-permissions` 294, `adhoc-packages` 26).

Poutine/runner-guard: 1 Medium finding (`agentic_commands.yml`, RGS-005).

Grype (9 images scanned: `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine:latest`, `node:lts-alpine`): 34 Critical, 172 High, 357 Medium, 54 Low, 27 Negligible, 18 Unknown severity.

Grant: 1,250 license-policy findings across the same 9 images; strict mode failed (`✗ grant failed`). No credential or secret values were present in the collected evidence.

`git-status.txt` shows 55 files changed by recompilation (54 modified `.lock.yml`/generated files plus `.github/aw/actions-lock.json`, and one new `.poutine.yml`), consistent with routine action-pin/timestamp drift rather than source-level regressions.

Control plane context

- Correlation ID: `34549825716-1048`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34549825716`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34549825716) · copilot · auto · 37.5 AIC · ⌖ 17 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 1:33 AM UTC

Start with the workflow sources under .github/workflows/*.md and the findings for the two safe-outputs-app-token references, then inspect .grant.yaml and the image references named in the report. Use the gh-aw MCP server's fix and compile tools without editing generated .lock.yml files. Done means the full compiler, validation, security-scan, and strict grant suite passes, with any accepted findings documented.

Written by the indexing model from the issue text.