[aw-doctor:compiler-security] gh-aw compiler & security scan findings in githubnext/gh-aw-cao (grant license-policy failure, 34 critical CVEs, 49 High zizmor

Compiled all 51 gh-aw workflow sources (51 generated lock files) in `githubnext/gh-aw-cao` with the full validation, lint, container, and security-scanner suite. The compiler run exited with code `1` — blocked by the `grant` license-policy gate, which found **1250 license policy findings** across the 9 container images used by workflows. Beyond that hard failure: **actionlint** found 2 expression errors (a step output referenced that doesn't exist in 2 lock files), **zizmor** flagged 49 High-severity `github-app` token findings plus 418 Medium `secrets-outside-env` and 29 Medium `artipacked` findings, **runner-guard** flagged 1 Medium excessive-permissions finding on a comment-triggered workflow, and **grype** found 34 Critical / 130 High CVEs across the scanned images (curl, openssl, libc6 among the critical packages). **poutine** reported no findings. Highest-severity supported finding: grype **Critical** CVEs (curl/libcurl, openssl, libc6) in base images, tied with the blocking `grant` license-policy failure that prevents a clean compile.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `GIT_TOKEN` expression references undefined step output `steps.safe-outputs-app-token.outputs.token` (2 occurrences) | Fix the compiler workflow template so the `GIT_TOKEN` fallback only references the app-token step when that step is actually emitted for the job, or guard with a conditional |
| zizmor | 49 lock files (all workflows generating a GitHub App token) | High | `github-app`: dangerous use of GitHub App tokens | Review App-token scope/persistence per zizmor `github-app` guidance; scope tokens narrowly and avoid persisting them beyond the minting step |
| zizmor | 51 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (418 occurrences) | Move secret references into `environment:` blocks per zizmor `secrets-outside-env` guidance |
| zizmor | multiple lock files (e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts (29 occurrences) | Avoid uploading credential-bearing paths as artifacts; scrub or exclude before upload |
| zizmor | all lock files | Low/Informational | `undocumented-permissions` (294), `anonymous-definition` (302), `adhoc-packages` (26), `obfuscation` (3), `template-injection` (9, informational) | Add explanatory comments to `permissions:` blocks; name workflow/job definitions; pin ad-hoc installs; review template-expansion sinks |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a workflow triggered by `issue_comment`/`pull_request_review_comment` (untrusted trigger) | Restrict permissions to read-only for the untrusted-trigger job, or move privileged steps behind a separate reusable workflow gated by validation |
| grype | 9 images: `alpine`, `node`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}`, `ghcr.io/github/github-mcp-server` | Critical | 34 Critical CVEs incl. `CVE-2026-18924`/`CVE-2026-19931` (curl/libcurl), `CVE-2026-63073`/`CVE-2026-75803` (openssl/libssl3), `CVE-2026-5450` (libc6) | Update/repin base images to versions with patched packages; rebuild `gh-aw-node`/`gh-aw-mcpg`/`gh-aw-firewall` images |
| grype | same 9 images | High | 130 High-severity CVEs (additional packages) | Same as above |
| grype | same 9 images | Medium/Low/Negligible | 306 Medium, 54 Low, 27 Negligible CVEs | Track via routine image updates |
| grant | same 9 images | Blocking | 1250 license policy violations (e.g. GPL-2.0-only, LGPL-2.1-or-later packages in `node:lts-alpine`, `gh-aw-firewall/*`) causing `grant failed` and compiler exit `1` | Update the license-policy allowlist in `.poutine.yml`/grant config if the licenses are acceptable, or swap non-compliant packages/images |
| poutine | n/a | Clean | No findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Compiler summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 51`, `Compiled locks: 51`.
- Actionlint: `Checked 51 workflow(s)`, `Found 2 issue(s) (2 error(s))`, issue type `expression: 2`.
- Zizmor: scanned 51 files; severities observed — High: 49, Medium: 447, Low: 323, Informational: 311.
- Runner-guard: 1 taint-analysis finding (`RGS-005`, Medium) on `agentic_commands.yml`.
- Syft: SBOMs generated for 9 container images (567/193/347/63/288/177/165/16/41 packages respectively).
- Grype: CVE severity counts — Critical: 34, High: 130, Medium: 306, Low: 54, Negligible: 27 (568 total CVE line items across images).
- Grant: `strict mode: grant found 1250 license policy finding(s) in container images` → `grant failed`.
- Poutine: ran with no findings reported.
- No secret or credential values were present in the scanned output.

Control plane context

- Correlation ID: `34572343254-1080`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34572343254

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34572343254) · copilot · auto · 41.7 AIC · ⌖ 12.6 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 7:16 AM UTC

Start with the gh-aw workflow sources under .github/workflows/*.md, especially the source for agentic_commands.yml, and review .poutine.yml or the related grant configuration. Run the gh-aw MCP server's compile and fix tools with the listed validation and security scanners; do not edit generated .lock.yml files. Done means the compiler and full scan suite pass without the reported actionlint, zizmor, runner-guard, grant, or grype findings.

Written by the indexing model from the issue text.