[aw-doctor:compiler-security] AW compiler/security scan: 2 blocking errors, 34 Critical CVEs, 49 High github-app findings, grant license failure

Compiler run on `githubnext/gh-aw-cao` exited with code `1` after compiling 51 workflow sources into 51 lock files. Actionlint found 2 blocking expression errors (undefined `safe-outputs-app-token` step reference), zizmor flagged 49 High-severity `github-app` token-handling findings plus widespread Medium `secrets-outside-env` (51/51 workflows) and `artipacked` findings (16 workflows), the poutine/runner-guard scanner flagged 1 Medium excessive-permissions finding on a `pull_request_target`-triggered workflow, grype found 34 Critical and 786 Medium CVEs across 8 container images (mostly `curl`/`libcurl`, `openssl`/`libssl3`, `libc6`), and grant failed strict-mode license policy with 1250 findings in container images. Highest-severity supported finding: **Critical CVEs** (e.g. CVE-2026-18924/19931 in curl, CVE-2026-63073/75803 in openssl) present in `gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, and `github-mcp-server` images, alongside the 2 blocking actionlint expression errors that make the compiled workflows syntactically invalid.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step id referenced in `GIT_TOKEN` expression is not defined in the job's step outputs (expression type-check failure) | Fix the `.md` source's app-token step id/reference so the compiled step id matches, then recompile |
| zizmor | 41 lock files (e.g. aw-doctor, aw-failures-investigator, aw-maintenance-*, cao-maintenance*, eu-cra-compliance*, self-care*) | High | `github-app`: dangerous use of GitHub App tokens | Review CAO pre-activation app-token steps; ensure tokens are minimally scoped and not exposed to untrusted context |
| zizmor | 51/51 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block per zizmor guidance |
| zizmor | 16 lock files (e.g. dashboard-authoring-corpus, dependabot-release-train-updater, self-care-dashboard-*) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Avoid persisting credentials in uploaded artifacts; scrub before upload |
| runner-guard (poutine) | agentic_commands.yml | Medium (RGS-005) | Excessive permissions (write-level) on a workflow triggered by `pull_request_target`/`issue_comment`-class events | Reduce to least-privilege permissions or gate write access behind an approval step |
| grype | ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}, gh-aw-mcpg, gh-aw-node, github-mcp-server, alpine, node | Critical (34 findings) | CVE-2026-18924/19931 (curl/libcurl), CVE-2026-63073/75803 (openssl/libssl3/libcrypto3), CVE-2026-5450 (libc6) | Bump base images / packages to patched versions (curl 8.22.0-r0, openssl 3.5.8-r0, updated libc6) |
| grype | same images | Medium (786 findings) | Numerous bind9-libs, perl, libexpat1 CVEs | Rebuild images against updated Alpine/Ubuntu/Debian package sets |
| grype | same images | Low (377 findings) | Lower-severity package CVEs (php8.1-*, libjpeg-turbo8, libcairo2, libzstd1, etc.) | Track for next scheduled image refresh |
| grant | 9 container images | error (strict) | 1250 license policy violations (GPL-2.0/3.0, LGPL, BSD variants, ISC, MIT, BlueOak-1.0.0, etc.) across bundled OS/npm packages | Review grant policy allowlist vs. actual bundled licenses; update policy or replace non-compliant dependencies |

Zizmor also reported informational-only `undocumented-permissions` (294), `anonymous-definition` (302), `template-injection` (9), and `obfuscation` (3) findings not included in the table above as they carry no actionable severity beyond documentation hygiene.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint expression errors (2):
```
.github/workflows/self-care-dashboard-performance.lock.yml:2302:26: error: [expression] property "safe-outputs-app-token" is not defined ...
GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/self-care-pages-health.lock.yml:2208:26: error: [expression] property "safe-outputs-app-token" is not defined ...
```

Zizmor finding counts (rule: count):
```
secrets-outside-env: 418
anonymous-definition: 302
undocumented-permissions: 294
github-app: 49
artipacked: 29
adhoc-packages: 26
template-injection: 9
obfuscation: 3
```

Grype severity totals across 9 scanned container images: 34 Critical, 786 Medium, 377 Low.

Grant: `strict mode: grant found 1250 license policy finding(s) in container images`.

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Control plane context

- Correlation ID: `34560011260-1062`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34560011260`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34560011260) · copilot · auto · 39.5 AIC · ⌖ 9.89 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 4:11 AM UTC

Start with the `.github/workflows/*.md` sources corresponding to `self-care-dashboard-performance.lock.yml` and `self-care-pages-health.lock.yml`; the generated lock files are evidence and must not be edited. Run the gh-aw compiler and its security scans from the target repository, then review the reported workflow and container-image findings. Done means the full strict compiler, security, license, and image scan passes without actionable findings.

Written by the indexing model from the issue text.