[aw-doctor:compiler-security] Compiler and security scan findings: gh-aw compile exit 1, grant license policy failure, grype critical CVEs

Compiler exit code **1** for `githubnext/gh-aw-cao` (51 workflow sources, 51 compiled locks). Findings span 6 categories: 2 actionlint expression errors, 49 zizmor High "dangerous GitHub App token" warnings plus 1,090+ lower-severity zizmor findings, 1 runner-guard medium finding, 10 grype Critical CVEs (curl/libcurl/openssl in 3 firewall/proxy images plus gh-aw-node and github-mcp-server images) with dozens more High findings, and a hard **grant license scanner failure** (1,250 license-policy findings, strict mode) that is the primary reason the compile did not pass cleanly. Highest severity supported by tooling: **Critical** (grype CVE-2026-63073/CVE-2026-19931/CVE-2026-18924/CVE-2026-5450 in container base images). Recommended next action: assign to Copilot to fix the two actionlint expression errors and the 49 zizmor `github-app` High findings first (source-level, safely automatable), then have a maintainer separately decide on the `.poutine.yml` policy scope and grant/grype base-image remediation strategy since those require upstream image or license-policy decisions outside workflow source control.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml:2302`, `self-care-pages-health.lock.yml:2208` | error (expression) | `safe-outputs-app-token` step output referenced but not defined in that job's `needs` object type | Fix the referencing `.md` source so the step ID/output matches the actual upstream job outputs; recompile |
| zizmor | 41 `.lock.yml` files (49 occurrences) | High | `github-app`: dangerous use of GitHub App tokens | Review app-token issuance/usage pattern per zizmor guidance; scope token to minimum needed permissions |
| zizmor | 100+ `.lock.yml` files (418 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `env:` block | Move secret references into a dedicated `env:` mapping |
| zizmor | 16 `.lock.yml` files (29 occurrences) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Avoid persisting credentials in uploaded artifacts (e.g., checkout with `persist-credentials: false`) |
| zizmor | many files (294 occurrences) | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | many files (26 occurrences) | Low | `adhoc-packages`: ad-hoc package installation | Pin package versions/sources for installed packages |
| zizmor | (302 occurrences) | Informational | `anonymous-definition`: workflow/action without a `name:` | Add descriptive `name:` fields |
| zizmor | `pr-reviewer.lock.yml` and others (9 occurrences) | Informational | `template-injection`: possible code injection via `${{ }}` template expansion | Use intermediate `env:` variables instead of direct template interpolation in run steps |
| zizmor | 3 files | Low | `obfuscation`: obfuscated usage of Actions features | Simplify flagged expressions/usages |
| runner-guard | `agentic_commands.yml` (RGS-005) | Medium | Excessive write permissions on a workflow triggered by untrusted events (`issue_comment` etc.) | Scope down `permissions:` or restrict trigger conditions for write-capable jobs |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `github-mcp-server:v1.12.1` | Critical | `CVE-2026-63073`/`CVE-2026-75803` (openssl/libssl3/libcrypto3), `CVE-2026-5450` (libc6) | Upstream base-image update; not fixable via workflow source |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15`, `cli-proxy:0.28.15` | Critical | `CVE-2026-19931`/`CVE-2026-18924` (curl/libcurl) | Upstream base-image update |
| grype | `ghcr.io/github/gh-aw-node:1` | Critical | `CVE-2026-19931`/`CVE-2026-18924` (libcurl) | Upstream base-image update |
| grype | 7 container images (721+219+211+117+194+164+33 total findings across all severities) | High/Medium/Low | Numerous CVEs in curl, libexpat, bind9-libs, openssl, GO stdlib, and other packages | Upstream base-image update; out of scope for `.md` workflow source edits |
| grant | 9 container images | error | 1,250 license-policy violations (GPL/LGPL family predominant: 433 GPL-tagged, 281 LGPL-tagged packages) | Requires maintainer decision on license policy scope (`.poutine.yml`/grant policy) rather than a code fix |
| shellcheck | multiple `.github/graders/*.sh` files | warning | `SC2034` unused-variable warnings (68 total) in grader scripts | Prefix intentionally-unused exported vars or remove dead assignments |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priority order: (1) fix the two actionlint `safe-outputs-app-token` expression errors, (2) address the 49 zizmor High `github-app` findings and the `secrets-outside-env`/`artipacked` Medium findings, (3) fix the `SC2034` shellcheck warnings in `.github/graders/*.sh`, (4) address the runner-guard `RGS-005` finding in `agentic_commands.yml`. Do not attempt to alter base container images, `.poutine.yml`/grant license policy, or pinned image digests — those require a separate maintainer decision; stop and explain instead of guessing at a fix for the grype/grant findings.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Severity/category counts (zizmor):
```
418 [Medium] secrets-outside-env
302 [Informational] anonymous-definition
294 [Low] undocumented-permissions
49 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

Container images scanned by grype (finding-line counts, all severities): `gh-aw-firewall/agent:0.28.15` (721), `gh-aw-firewall/api-proxy:0.28.15` (219), `gh-aw-firewall/cli-proxy:0.28.15` (211), `gh-aw-firewall/squid:0.28.15` (117), `gh-aw-mcpg:v0.4.20` (164), `gh-aw-node:1` (194), `github-mcp-server:v1.12.1` (33).

No token-like or credential-like strings were found in the raw tool output; none redacted.

The full 721,016-byte raw report and diff-stat were reviewed but are too large to include verbatim; excerpts above are representative and exhaustive at the category level.

Control plane context

- Correlation ID: `34563720575-1066`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34563720575`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34563720575) · copilot · auto · 49.9 AIC · ⌖ 9 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 5:21 AM UTC

Start by running the gh-aw compiler and reviewing the source behind self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml, agentic_commands.yml, and .github/graders/*.sh; do not edit generated lock files. Use the reported actionlint, zizmor, shellcheck, and runner-guard findings to define source-level changes, then recompile and document the grype and grant findings that require maintainer or upstream decisions.

Written by the indexing model from the issue text.