[aw-doctor:compiler-security] aw-doctor: compiler & security findings for githubnext/gh-aw-cao (2 actionlint errors, zizmor/grype/grant findings)

Compiler run for `githubnext/gh-aw-cao` exited non-zero (exit code 1) across 51 workflow sources / 51 lock files. Findings span 5 categories: 2 actionlint expression errors, 883 zizmor security findings (49 High, 447 Medium, 323 Low, 311 Informational — plus 1 RGS-005 taint finding from runner-guard), 599 grype container CVEs (34 Critical, 172 High, 339 Medium, 54 Low across 9 images, notably curl/libcurl and libssl3/libcrypto3 CVEs), and 1250 grant license-policy violations across 9 container images causing the `grant` step to fail outright. Highest severity: **Critical** — multiple unpatched CVEs (CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931) in alpine/gh-aw-firewall base images. Recommended next action: assign to Copilot to fix the two actionlint expression errors and review/triage the zizmor `github-app` High findings first, then re-run to confirm grype/grant status (container base-image CVEs and license findings may require image/base updates outside workflow `.md` sources and should be flagged back if unfixable by source changes alone).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|--------------|
| actionlint | self-care-dashboard-performance.lock.yml:2302, self-care-pages-health.lock.yml:2208 | error | `safe-outputs-app-token` step output referenced but not defined in step outputs type | Fix the `.md` source generating these lock files so the `GIT_TOKEN` expression references a step id that actually emits `outputs.token` |
| zizmor | 51 lock files (418 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job `environment:` block per zizmor docs |
| zizmor | 51 lock files (302 occurrences) | Informational | `anonymous-definition`: workflow/job definitions without a `name:` | Add explanatory `name:` fields to jobs |
| zizmor | 51 lock files (294 occurrences) | Low | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | uk-ai-advisory.lock.yml and others (49 occurrences) | High | `github-app`: dangerous use of GitHub App tokens (e.g. `actions/create-github-app-token@bcd2ba4...`) | Review each App-token step for least-privilege scoping and confirm the pattern is expected/safe |
| zizmor | 51 lock files (29 occurrences) | Medium | `artipacked`: potential credential persistence in artifacts | Review artifact upload steps for leaked credentials |
| zizmor | 51 lock files (26 occurrences) | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g`, `install_awf_binary.sh`) | Pin/vendor installers where feasible |
| zizmor | 51 lock files (9 occurrences) | Informational | `template-injection`: potential expression injection pattern | Review flagged expressions for untrusted input interpolation |
| zizmor | 51 lock files (3 occurrences) | Low | `obfuscation`: obfuscated content detected | Review flagged content |
| runner-guard (poutine) | agentic_commands.yml:1 | Medium (RGS-005) | Job specifies write-level `permissions:` on an untrusted-trigger workflow (`pull_request_target`/`issue_comment`-style event) | Scope down permissions or move privileged steps behind a reviewed/approved job |
| grype | alpine:latest, node:lts-alpine, gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, gh-aw-mcpg, gh-aw-node, github-mcp-server (599 findings total) | Critical (34), High (172), Medium (339), Low (54) | Container base images carry unpatched CVEs, e.g. CVE-2026-63073/CVE-2026-75803 (libssl3/libcrypto3), CVE-2026-18924/CVE-2026-19931 (curl/libcurl), GHSA-rgw5-rvv9-x895 (brace-expansion), GHSA-r292-9mhp-454m (tar) | Bump base image tags / pinned digests to patched versions where the `.md` source controls the image reference; otherwise this is an upstream image update outside workflow source control |
| grant | Same 9 images (1250 findings, tool failed in strict mode) | policy violation | License policy violations across many transitive packages (ISC, ISC/BlueOak, GPL-2.0-or-later+LGPL combos, etc.) | Confirm which licenses are actually disallowed by policy; either update the `grant` allow-list config or address via image updates — not fixable purely from workflow `.md` sources |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Summary**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

**Actionlint** — 2 issues (2 errors), type: expression (see table above for exact locations)

**Zizmor** — 883 total findings across 51 lock files: 49 High, 418+29 Medium (secrets-outside-env, artipacked), 294+26+3 Low (undocumented-permissions, adhoc-packages, obfuscation), 302+9 Informational (anonymous-definition, template-injection)

**Runner-guard / poutine** — 1 finding: RGS-005 medium severity in `agentic_commands.yml`

**Grype** — 599 findings across 9 images: 34 Critical, 172 High, 339 Medium, 54 Low. Images scanned: `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`

**Grant** — 1250 license policy findings, tool failed in strict mode (`✗ grant failed: strict mode: grant found 1250 license policy finding(s) in container images`)

**Diff stat** (uncommitted local lock-file drift observed during compile, not part of findings): 55 files changed, 448 insertions(+), 438 deletions(-) — routine lock-file regeneration from action-pin/version bumps.

No credential-like or token-like values were present in the reviewed evidence.

Control plane context

- Correlation ID: `34567075073-156`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34567075073`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34567334394) · copilot · auto · 35.9 AIC · ⌖ 7.68 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 6:09 AM UTC

Start with the two actionlint locations in self-care-dashboard-performance.lock.yml:2302 and self-care-pages-health.lock.yml:2208, then trace them back to their .md sources; also review agentic_commands.yml for the RGS-005 finding. Run the gh-aw MCP server's fix and compile tools with the full validation suite, never editing generated .lock.yml files. Done means the compiler and scans pass, or remaining image and policy findings are documented as external blockers.

Written by the indexing model from the issue text.