[aw-doctor:compiler-security] githubnext/gh-aw-cao compiler & security scan findings: 34 Critical/221 High grype vulns, 49 High zizmor github-app, 1250 grant

Compiling all 51 GitHub Agentic Workflows in `githubnext/gh-aw-cao` (exit code 1) surfaced findings across actionlint, zizmor, runner-guard, grype, and grant. Highest severity: **Critical** (grype: `libssl3`/`libcrypto3`/`libcurl` CVEs in base container images, e.g. CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931). Also flagged: 2 actionlint expression errors, 49 zizmor High "dangerous GitHub App token use" findings, 418 zizmor Medium `secrets-outside-env` findings, 1 runner-guard Medium excessive-permissions finding, and 1250 grant license-policy violations causing `grant failed (strict mode)`. Recommended next action: assign to Copilot to fix the actionlint/zizmor/runner-guard source issues via the shared control template, then separately triage base-image CVEs/license findings (may require upstream image bumps outside workflow `.md` sources).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding (count) | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `[expression]` property `safe-outputs-app-token` not defined in step-outputs object type (2) | Fix the shared control template generating these lock files, then recompile |
| zizmor | 27 workflow lock files | High | `github-app`: dangerous use of GitHub App tokens (49 occurrences) | Review `actions/create-github-app-token` usage in `.github/workflows/shared/control.md`; scope token lifetime/permissions per zizmor guidance |
| zizmor | multiple workflow lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (418) | Route job-level secret references through a scoped `environment:` block where the audit applies |
| zizmor | multiple workflow lock files | Medium | `artipacked`: artifact/credential persistence risk (29) | Review checkout/cache steps for `persist-credentials`/cache-poisoning exposure |
| zizmor | multiple workflow lock files | Low (info) | `undocumented-permissions` (294), `adhoc-packages` (26), `obfuscation` (3) | Lower priority; document permissions blocks, avoid ad-hoc `npm install -g`/`pip install` in run steps |
| runner-guard (poutine) | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on workflow triggerable by untrusted `issue_comment`/`pull_request_target` (1) | Scope job permissions to read-only or gate write jobs behind trusted-actor checks |
| grype | `ghcr.io/github/gh-aw-firewall/*` (agent, api-proxy, cli-proxy, squid), `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server`, `node:lts-alpine`, `alpine:latest` | Critical (34), High (221), Medium (788), Low (377) | Outdated OS/npm packages: `libssl3`/`libcrypto3`/`openssl` (CVE-2026-63073, CVE-2026-75803, CVE-2026-14456/14457/54874/63072/63075/63076/18798), `curl`/`libcurl` (CVE-2026-18924, CVE-2026-19931, CVE-2026-80229/80230/80231/80255/82208/82209/13608), `libexpat` (CVE-2026-66046/76641/76956/76957), `libblkid`/`libmount` (CVE-2026-76642/78408/78409/78410), `libc6` (CVE-2026-5450), plus npm-side `brace-expansion`/`tar`/`ip-address`/`grpc`/`fulcio`/`go-archive` GHSA findings | Bump base/tool image tags (`gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server` versions) referenced by the compiler/runtime and re-run `syft`/`grype`; not fixable by editing workflow `.md` sources alone — track as an upstream image update |
| grant | same 9 container images | error | 1250 license-policy findings (mostly ISC/MIT/Apache-2.0/BlueOak-1.0.0 packages flagged under strict mode) causing `grant failed` | Review the strict license policy allowlist (or `.poutine.yml`/grant config) for these already-permissive licenses; confirm policy intent before broadly suppressing |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely (for example, base container image CVEs or license-policy findings that require an upstream image bump or a policy decision rather than a source-code fix).

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Grant summary:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

No token-like or credential-like values were found in the tool output.

Control plane context

- Correlation ID: `34580946577-159`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34580946577`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34581353874) · copilot · auto · 44.3 AIC · ⌖ 8.62 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 9:12 AM UTC

Start with .github/workflows/shared/control.md and the agentic_commands.yml permissions referenced by the findings; do not edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, then run the strict compiler and security checks. Done means source-level findings are resolved and the full scan passes, or remaining image CVEs and license findings are clearly documented as requiring upstream or policy decisions.

Written by the indexing model from the issue text.