[aw-doctor:compiler-security] Compiler & security scan findings: 51 workflows, actionlint errors, zizmor High, container CVEs, license policy violations

Compiling all 51 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with `gh aw compile` and the full validation/lint/container-security suite failed (exit code 1). Findings: actionlint 2 errors, zizmor 49 High + 447 Medium + 323 Low + 311 Informational, runner-guard 1 Medium taint finding, grype 34 Critical + 172 High + 341 Medium CVEs across 9 container images, grant 1250 license-policy violations (strict mode), plus shellcheck warnings in 12 grader scripts. Highest severity supported by tooling: **Critical** — 219 distinct CVE IDs rated Critical/High by grype, concentrated in `ghcr.io/github/gh-aw-firewall/squid:0.28.15` (10 Critical, e.g. CVE-2026-63073, CVE-2026-19931, CVE-2026-18924 in openssl/curl) and `ghcr.io/github/gh-aw-mcpg:v0.4.20` (4 Critical, 48 High). Recommended next action: assign to Copilot to fix the two actionlint expression errors and the `github-app` zizmor High findings first (in-repo, fixable), then track the container CVE/license findings separately since they originate from upstream base images outside this repo's control.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | High (error) | `property "safe-outputs-app-token" is not defined` — expression references a step ID (`safe-outputs-app-token`) not present in the referenced job's outputs object | Fix the `.md` source's safe-outputs app-token step ID/reference so it matches the generated job outputs, then recompile |
| zizmor | 49 lock files (e.g. aw-doctor, aw-failures-investigator, cao-evolution*, eu-cra-compliance*, self-care*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` without scoping/expiry controls | Review `docs.zizmor.sh/audits/#github-app`; scope the app token step's permissions/lifetime in the shared control source |
| zizmor | ~418 occurrences across most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into a job `environment:` block |
| zizmor | ~294 occurrences | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments | Add short comments explaining each granted permission |
| zizmor | ~29 occurrences | Medium | `artipacked`: artifact/credential packing risk | Review flagged steps per zizmor docs |
| zizmor | ~26 occurrences | Low | `adhoc-packages`: ad-hoc package installs (npm/apt) in workflow steps | Pin installs via lockfiles/manifests where feasible |
| runner-guard | agentic_commands.yml | Medium | RGS-005: write-level `permissions:` on a workflow triggered by `issue_comment`/`pull_request_target`-class events | Restrict permissions or move privileged steps behind approval/reusable workflow boundary |
| grype | ghcr.io/github/gh-aw-firewall/squid:0.28.15 | Critical (10) | CVE-2026-63073, CVE-2026-19931, CVE-2026-18924 in openssl/libssl3/libcrypto3/curl/libcurl (Alpine base) | Bump base image / packages to fixed versions (3.5.8-r0 openssl, 8.22.0-r0 curl) once upstream image publishes them |
| grype | ghcr.io/github/gh-aw-mcpg:v0.4.20 | Critical (4) / High (48) | CVE-2026-18798, CVE-2026-63076, CVE-2026-14457 and others in libssl3/libcrypto3 | Track upstream `gh-aw-mcpg` image update |
| grype | node:lts-alpine, alpine:latest, gh-aw-node, gh-aw-firewall/{agent,api-proxy,cli-proxy}, github-mcp-server | Critical/High (various, 219 distinct CVE IDs total) | OS-package CVEs (bind9-libs, python3.10, curl, glib2.0, brace-expansion, etc.) | Track upstream image maintainers; not directly fixable in this repo's sources |
| grant | 9 container images | High (error, strict mode) | 1250 license-policy violations across bundled OS/npm packages (GPL variants, custom licenses, etc. against strict policy) | Review `.poutine.yml`/grant policy for intended license allowlist; likely needs policy tuning rather than code fix, since these are transitive image dependencies |
| shellcheck | 12 `.github/graders/*-operational-value.sh` scripts | Low (warning, SC2034) | Unused-looking variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) — likely used only for documentation/export, false positive if intentional | Add `# shellcheck disable=SC2034` with a comment, or export the variables if consumed externally |
| yamllint | 51 files | none reported | No yamllint findings surfaced in the report excerpt | n/a |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priority order: (1) fix the 2 actionlint `safe-outputs-app-token` expression errors, (2) address the 49 zizmor High `github-app` findings, (3) address `secrets-outside-env` and `undocumented-permissions` findings where low-risk, (4) evaluate whether the 12 shellcheck SC2034 warnings in `.github/graders/*-operational-value.sh` are false positives and suppress with justification if so. Container image CVEs (grype) and license-policy findings (grant) originate from third-party base images (`gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`) and are not fixable by editing this repository's workflow sources — do not attempt to patch them; note them as tracked separately for upstream image updates or `.poutine.yml`/grant policy review.

Raw evidence

Summary counts from the compiler run:
- Workflow sources: 51, Compiled locks: 51, Exit code: 1
- actionlint: 2 issues (2 errors), both `expression` type
- zizmor: 49 High, 447 Medium, 323 Low, 311 Informational (finding types: `secrets-outside-env` 418, `anonymous-definition` 302, `undocumented-permissions` 294, `github-app` 49, `artipacked` 29, `adhoc-packages` 26, `template-injection` 9, `obfuscation` 3)
- runner-guard: 1 Medium (RGS-005) in `agentic_commands.yml`
- grype: 34 Critical, 172 High, 341 Medium, 54 Low, 27 Negligible across images `alpine:latest`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`
- grant: `grant failed` — strict mode found 1250 license policy findings across the 9 scanned container images
- shellcheck: findings reported for 12 `.github/graders/*-operational-value.sh` scripts (all SC2034 unused-variable warnings)
- yamllint: ran on 51 files, no findings captured in the excerpt

No token-like or credential-like values were present in the evidence reviewed.

Control plane context

- Correlation ID: `34575830938-158`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34575830938

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34576190025) · copilot · auto · 51.3 AIC · ⌖ 9.97 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 8:10 AM UTC

Start with the two actionlint findings in the relevant .github/workflows/*.md sources, using gh aw compile and its generated lock files for validation; then review the shared GitHub App token controls and the .github/graders/*-operational-value.sh scripts. Done means the in-repository compiler, lint, and security checks pass, while upstream container CVEs and grant findings are documented separately rather than patched here.

Written by the indexing model from the issue text.