[aw-doctor:compiler-security] gh-aw compiler & security scan findings: 2 actionlint errors, High zizmor github-app (41 files), 8 Critical/32 High container CV

The gh-aw compiler and full security scanner suite ran against `githubnext/gh-aw-cao` (51 workflow sources, 51 generated lock files) and exited non-zero (exit code 1). Findings span 2 actionlint expression errors, 41 workflows with a High-severity zizmor `github-app` finding, widespread Medium `secrets-outside-env`/`artipacked` warnings, one Medium poutine `RGS-005` (excessive permissions on untrusted trigger), and container-image CVEs including 8 Critical and 32 High severity results from grype (mainly OpenSSL/curl/libc in firewall, mcpg, node, and github-mcp-server images). Highest-severity supported finding: **Critical CVE** in container base images (e.g. CVE-2026-5450 in `github-mcp-server:v1.12.1`, CVE-2026-63073/75803 OpenSSL in alpine/squid/mcpg/node images) and **High** zizmor `github-app` token misuse pattern repeated across 41 workflow lock files.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `property "safe-outputs-app-token" is not defined` — expression references a step id not present in the generated job graph | Fix the `.md` source's safe-outputs app-token step reference/id and recompile |
| zizmor | 41 lock files (e.g. `aw-doctor`, `aw-failures-investigator`, `aw-maintenance-*`, `eu-cra-compliance-*`, etc.) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review App-token issuance scope/conditions per zizmor guidance; restrict to minimum required permissions |
| zizmor | most lock files (418 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block |
| zizmor | ~29 occurrences (e.g. `self-care-dashboard-performance.lock.yml`, `dashboard-authoring-corpus.lock.yml`) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure checkout/credential steps don't persist tokens into uploaded artifacts |
| zizmor | 294 occurrences | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments justifying each granted permission |
| zizmor | 302 occurrences | Informational | `anonymous-definition`: workflow/job without a `name:` | Add descriptive `name:` fields |
| zizmor | 26 occurrences (e.g. `aw-doctor`, `eu-cra-compliance-*`, `self-care-*`) | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g`) outside a lockfile-managed step | Pin and manage installs via a manifest where feasible |
| zizmor | `pr-reviewer.lock.yml` (3x) | Informational | `template-injection`: code injection via template expansion | Review expression usage for untrusted input interpolation |
| zizmor | 3 occurrences | Low | `obfuscation`: obfuscated usage of Actions features | Simplify flagged constructs |
| poutine (runner-guard) | `agentic_commands.yml` | Medium | `RGS-005`: job grants write-level permissions while triggered by an event initiable by external users | Scope permissions down or restrict trigger to trusted contexts |
| grype | `alpine:latest` | Critical/High | CVE-2026-63073, CVE-2026-75803 (Critical), CVE-2026-14456/14457/18798/54874/63072/63075/63076 (High) in `libssl3`/`libcrypto3@3.5.7-r0` | Upgrade to `3.5.8-r0` |
| grype | `gh-aw-firewall/api-proxy`, `cli-proxy`, `squid` (0.28.15) | Critical/High | CVE-2026-18924, CVE-2026-19931 (Critical) and CVE-2026-13608/80229/80230/80231 (High) in `curl`/`libcurl@8.21.0-r0` | Upgrade to `8.22.0-r0` |
| grype | `gh-aw-firewall/squid` | Critical | CVE-2026-63073, CVE-2026-75803 in `openssl@3.5.7-r0` | Upgrade to `3.5.8-r0` |
| grype | `gh-aw-mcpg:v0.4.20`, `gh-aw-node`, `node:lts-alpine` | Critical/High | Same OpenSSL/curl CVE family as above | Rebuild image from updated base |
| grype | `github-mcp-server:v1.12.1` | Critical | CVE-2026-5450 (`libc6@2.36-9+deb12u14`), CVE-2026-75803 (`libssl3@3.0.20-1~deb12u2`) | Update upstream base image / vendor version |
| grype | multiple images | Medium/Low/Negligible | 308 Medium, 54 Low, 27 Negligible additional CVEs (mostly bind9-libs, python3.10, perl) | See raw evidence for full list |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint expression errors (both occurrences share the same root cause):

```
.github/workflows/self-care-dashboard-performance.lock.yml:2304:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
2304 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/self-care-pages-health.lock.yml:2210:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

Poutine/runner-guard finding:

```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Example zizmor `github-app` (High) instance:

```
./.github/workflows/aw-doctor.lock.yml:1514:15: error: [High] github-app: dangerous use of GitHub App tokens
1514 | uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
```

Summary tallies from `report.txt` (721 KB total, 10,027 lines): zizmor — 49 High, 418 Medium `secrets-outside-env`, 29 Medium `artipacked`, 294 Low `undocumented-permissions`, 26 Low `adhoc-packages`, 3 Low `obfuscation`, 302 Informational `anonymous-definition`, 9 Informational `template-injection`. Grype across 9 scanned container images (syft SBOM: agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, alpine:latest, node:lts-alpine): 8 Critical, 32 High, 308 Medium, 54 Low, 27 Negligible CVEs.

No token-like or credential-like values were present in the scanned output.

Control plane context

- Correlation ID: `34590632723-161`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34590632723`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34591051724) · copilot · auto · 40.3 AIC · ⌖ 9.41 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 11:10 AM UTC

Start with the .github/workflows/*.md sources corresponding to self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml, and agentic_commands.yml; do not edit generated lock files. Run the gh-aw MCP server's fix and compile tools, then rerun the full compiler and security scan suite. Done means the generated lock files reflect safe source changes and all required validation and scanners pass.

Written by the indexing model from the issue text.