[aw-doctor:compiler-security] githubnext/gh-aw-cao: compiler+security scan failed — 34 critical & 221 high CVEs, 1250 license violations, 2 actionlint errors

Compiling all 51 GitHub Agentic Workflows in `githubnext/gh-aw-cao` (SHA `478a3072a2ece07823d2158137a0f7cc725cb78b`) with the full validation and security suite exited with code 1. Findings span 2 actionlint expression errors, 1 poutine excessive-permissions warning, 34 zizmor security-lint findings by severity (0 critical / 221 high-ish incl. 49 High `github-app`, 788 medium, 377 low, 311 informational — deduplicated by rule below), and container supply-chain issues: grype reports **34 Critical + 221 High CVEs** across 9 scanned images, and grant's strict license-policy check failed with **1250 license violations** (498 unique packages) — both hard failures. No workflow source failed to compile; all 51 `.lock.yml` files were generated, but `grant` and the linter gate fail the run.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`:2304, `self-care-pages-health.lock.yml`:2210 | error | `steps.safe-outputs-app-token` not defined in these jobs' step-outputs type (other lock files reference it validly) — likely a missing/misordered `safe-outputs-app-token` step or `needs:` edge for these two workflows | Regenerate from `.md` sources after fixing the app-token step wiring (job dependency or step id) for these two workflows; recompile |
| poutine | `.github/workflows/agentic_commands.yml` (generated command dispatcher) | medium (RGS-005) | Excessive write permissions (`contents`/`actions`/etc.) combined with an externally-triggerable event (`issue_comment`/`pull_request_target`-class trigger) | Scope this job's `permissions:` to the minimum needed, or gate write steps behind an authorization check before broadening trigger scope |
| zizmor | `dependabot-release-train-updater.lock.yml`, `dependabot.lock.yml`, `aw-doctor.lock.yml`, `aw-failures-investigator.lock.yml`, +45 others | high (49×) `github-app` | `actions/create-github-app-token` usage flagged as dangerous GitHub App token pattern | Review token scope/audience per zizmor guidance; restrict app permissions and add explicit environment/step guards where flagged |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`, `design-decision-gate.lock.yml`, +many | medium (418×) `secrets-outside-env` | Secrets referenced in job `env`/`with` without a dedicated `environment:` | Move secret-consuming jobs behind a dedicated GitHub Environment or restructure secret access per zizmor docs |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`, `docs-explanatory-diagrams.lock.yml`, +others | medium (29×) `artipacked` | Potential credential persistence via uploaded Actions artifacts | Avoid uploading `.git`/credential-bearing paths as artifacts, or scrub tokens before upload |
| zizmor | most `*.lock.yml` (302 jobs/294 perms blocks) | low/info (294× `undocumented-permissions`, 302× `anonymous-definition`, 26× `adhoc-packages`, 3× `obfuscation`) | Style/hardening notes: undocumented `permissions:` blocks, unnamed jobs, ad-hoc package installs, minor obfuscation | Low priority; add comments to `permissions:` blocks and job `name:` fields where convenient |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml` | informational (9×) `template-injection` | Template expansion patterns worth reviewing for injection risk | Verify expressions don't interpolate untrusted input directly into shell/script bodies |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{squid,api-proxy,cli-proxy}:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1` | critical (34 findings; e.g. `CVE-2026-75803`/`CVE-2026-63073` in `libssl3`/`libcrypto3`, `CVE-2026-18924`/`CVE-2026-19931` in `libcurl`/`curl`, `CVE-2026-5450` in `libc6`) | Known-fixed OS package CVEs in base/tool images | Bump base images (`alpine`, `node:lts-alpine`) and pin newer `gh-aw-firewall`/`gh-aw-mcpg`/`github-mcp-server` tags that include patched `libssl3@3.5.8-r0+`, `libcurl@8.22.0-r0+`, `libc6` fixes |
| grype | same images as above | high (221 findings; e.g. `CVE-2026-13608`, `CVE-2026-80229`..`80255`, `CVE-2026-82208/82209`, `CVE-2026-76641`/`76956`/`76957`, `CVE-2026-5435`/`5928`) | Additional high-severity OS/library CVEs | Same remediation — refresh/rebuild images to latest patched tags |
| grant (license policy) | all 9 scanned images | error (1250 findings, 498 unique packages) | Strict license policy failed — packages with disallowed/unreviewed licenses (mix of MIT/ISC/Apache/GPL/LGPL/etc. combinations flagged by policy) bundled in container images | Review `grant`/license policy allowlist for these transitive OS and npm packages, or exclude non-shipped build-time packages from the scanned image layers; this is the blocking failure for `grant` |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary (from `summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Zizmor finding counts by severity tag observed in report.txt:
```
34 [Critical] (note: these are grype CVE lines using the same tag format, not zizmor findings — zizmor itself reported only High/Medium/Low/Informational)
221 [High]
311 [Informational]
377 [Low]
788 [Medium]
```
Zizmor unique rule counts:
```
418 [Medium] secrets-outside-env
302 [Informational] anonymous-definition
294 [Low] undocumented-permissions
49 [High] github-app
29 [Medium] artipacked
26 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```
Poutine:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```
Grype: 9 container images scanned (`gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`) — 34 Critical + 221 High CVE findings (full list in raw scanner output, redacted here for length).

Grant (license policy): `grant found 1250 license policy finding(s) in container images` — strict mode failure, this is the terminal error line (`✗ grant failed`).

No token-like or credential-like values were present in the report; git status shows only an untracked `.poutine.yml` config file with no diff to review.

Control plane context

- Correlation ID: `34586153466-1099`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34586153466`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34586153466) · copilot · auto · 43.8 AIC · ⌖ 10.3 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 10:09 AM UTC

Start with the compiler report and the affected .github/workflows/*.md sources, especially the sources for self-care-dashboard-performance and self-care-pages-health, rather than editing generated .lock.yml files. Run the gh-aw MCP server's fix and compile tools with the full validation and security suite, then review the generated lock-file diffs. Done means all 51 workflows compile and actionlint, zizmor, poutine, grant, grype, and the other listed checks pass.

Written by the indexing model from the issue text.