[aw-doctor:compiler-security] Compiler & security scan findings for githubnext/gh-aw-cao

The compiler run against `githubnext/gh-aw-cao` exited with code 1 (`clean: false`). Across 51 compiled workflows, actionlint found 2 expression errors, zizmor reported 1,130 findings (49 High, rest Medium/Low/Informational), runner-guard flagged 1 excessive-permissions taint issue, grype found 34 Critical and 221 High container CVEs (plus 10 High npm/Go supply-chain advisories) across 9 scanned images, and grant failed strict-mode license policy with 1,250 findings. Highest severity: **Critical** container CVEs (e.g. CVE-2026-63073 in `libssl3`/`libcrypto3`, CVE-2026-18924/CVE-2026-19931 in `curl`/`libcurl`) affecting the gh-aw firewall proxy images, `alpine:latest`, and `node`. Recommended action: assign remediation to Copilot per the agent prompt below.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | High (error) | `safe-outputs-app-token` step-output property not defined in expression context (`GIT_TOKEN` interpolation) | Fix the `.md` source's git-token expression so it only references defined step outputs; recompile |
| grant (strict license policy) | 9 container images | High | 1,250 license policy violations (e.g. GPL-3.0-or-later `readline-common`/`libreadline8`, LGPL/GPL family packages, Artistic-licensed `git`/`iptables`) in `gh-aw-firewall/agent:0.28.15` and related images | Review/update `.poutine.yml`/license allowlist policy or pin images without disallowed licenses; confirm intentional exceptions |
| grype | alpine:latest, node, gh-aw-firewall/{api-proxy,cli-proxy,squid}, gh-aw-mcpg, gh-aw-node, github-mcp-server | Critical | 34 findings incl. CVE-2026-63073/CVE-2026-75803 (`libssl3`/`libcrypto3` 3.5.7-r0, fix 3.5.8-r0), CVE-2026-18924/CVE-2026-19931 (`curl`/`libcurl` 8.21.0-r0, fix 8.22.0-r0), CVE-2026-5450 (`libc6`, no fix yet) | Bump base images / pinned package versions to patched releases; re-scan |
| grype | multiple images | High | 221 findings incl. CVE-2026-13608, CVE-2026-14456/14457, CVE-2026-17106 (`docker-cli`), CVE-2026-66046/76641/76956/76957 (`libexpat`) | Update affected packages to listed fix versions where available |
| grype (npm/Go supply chain) | gh-aw-node / gh-aw-mcpg images | High | GHSA-rgw5-rvv9-x895 & GHSA-mh99-v99m-4gvg (`brace-expansion` 5.0.7, fix 5.0.8/5.0.9), GHSA-r292-9mhp-454m (`tar` 7.5.19, fix 7.5.21), GHSA-mwp4-54f8-5fhr (`ip-address` 10.2.0, fix 10.3.1), GHSA-2v4p-qf9q-27wj/GHSA-hrxh-6v49-42gf/GHSA-vp52-pcj8-j9qc (`google.golang.org/grpc`, fix 1.82.1–1.83.2), GHSA-f5mr-q85p-6hh6 (`sigstore/fulcio`, fix 1.8.6), GHSA-hfg8-hc9c-6c3h (`moby/go-archive`, fix 0.3.0) | Update pinned dependency versions in the image build to the listed fix versions |
| zizmor | uk-ai-advisory.lock.yml and 50 other locks | High | 49 `github-app` findings — dangerous use of `actions/create-github-app-token` results | Review App-token usage scope/permissions per zizmor guidance; suppress only with justified `#zizmor: ignore` if verified safe |
| zizmor | most locks | Medium | 418 `secrets-outside-env` — secrets referenced without a dedicated environment | Wrap secret-consuming jobs in a dedicated `environment:` block where feasible |
| zizmor | several locks | Medium | 29 `artipacked` — credential persistence through GitHub Actions artifacts | Avoid uploading credential-bearing paths as artifacts |
| zizmor | most locks | Low/Informational | 294 `undocumented-permissions`, 302 `anonymous-definition`, 26 `adhoc-packages`, 9 `template-injection` (informational), 3 `obfuscation` | Add explanatory comments to `permissions:` blocks; name jobs; review ad-hoc installs and templated expressions |
| runner-guard | agentic_commands.yml | Medium | RGS-005 — write-level `permissions:` combined with an untrusted-trigger-capable event pattern in the commands dispatch header | Confirm the workflow's trigger is not directly exploitable by untrusted actors, or narrow permissions/trigger scope |
| shellcheck | 12 grader scripts (`.github/graders/*-operational-value.sh`) | unknown | Shell-scripting findings in operational-value grader scripts | Review and fix flagged shellcheck issues in grader scripts |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint (2 expression errors):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2302:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2208:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Grant strict-mode summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Zizmor rule counts (across 51 lock files):
```
418 warning: [Medium] secrets-outside-env
302 info: [Informational] anonymous-definition
294 info: [Low] undocumented-permissions
49 error: [High] github-app
29 warning: [Medium] artipacked
26 info: [Low] adhoc-packages
9 info: [Informational] template-injection
3 info: [Low] obfuscation
```

Grype severity counts (9 images: alpine:latest, node:lts-alpine, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server):
```
34 error: [Critical]
221 error: [High]
```

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

No token-like or credential-like values were present in the reviewed evidence.

Control plane context

- Correlation ID: `34556280605-1058`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34556280605

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34556280605) · copilot · auto · 42.9 AIC · ⌖ 9.77 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 3:11 AM UTC

Start with the 51 `.github/workflows/*.md` sources and run the gh-aw compiler with its full validation suite; do not edit generated `.lock.yml` files. Prioritize the reported expression errors, `agentic_commands.yml`, the container image findings, and `.github/graders/*-operational-value.sh`. Done means the compiler and security scan pass cleanly, with generated lock-file diffs reviewed.

Written by the indexing model from the issue text.