[aw-doctor:compiler-security] Compiler & security scan findings: 2 actionlint errors, 49 High zizmor github-app, 1250 grant license violations, 34 Critical gr

Compilation of all 51 gh-aw workflows in `githubnext/gh-aw-cao` finished with **exit code 1** (findings, not clean). 2 actionlint expression errors, 49 High-severity zizmor `github-app` findings across all 51 lock files, 1250 grant license-policy violations across all 9 scanned container images, and 34 Critical / 172 High grype CVEs in base images (curl/openssl/libcrypto stack). Poutine and yamllint reported clean; runner-guard flagged one Medium finding on a command-trigger workflow. Highest-severity supported finding: grype Critical CVEs (fixed upstream) in `alpine`, `api-proxy`, `cli-proxy`, and `squid` images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in that job's step context | Fix the compiler template/source generating this step reference so the output exists before use, then recompile |
| zizmor | all 51 `.lock.yml` files (41 distinct workflows with 49 occurrences) | High | `github-app`: dangerous use of GitHub App tokens | Review GitHub App token handling per zizmor guidance; scope token permissions and avoid unsafe propagation |
| zizmor | multiple lock files | Medium | `secrets-outside-env` (418 occurrences): secrets referenced without a dedicated `env:` block | Move secret references into a dedicated `env:` mapping per zizmor guidance |
| zizmor | multiple lock files | Medium | `anonymous-definition` (302), `undocumented-permissions` (294): permissions/step blocks lack explanatory comments or named definitions | Add explanatory comments to `permissions:` blocks; name anonymous definitions |
| zizmor | multiple lock files | Medium | `artipacked` (29 occurrences, e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`): credential persistence through Actions artifacts | Avoid persisting credentials in uploaded artifacts per zizmor guidance |
| zizmor | multiple lock files | Low | `adhoc-packages` (26), `obfuscation` (3) | Low-severity hygiene findings; address opportunistically |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` | Informational | `template-injection` (9 occurrences): code injection via template expansion | Review templated expressions for injection risk |
| runner-guard | `.github/workflows/agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level permissions while triggered by an untrusted command-comment event | Reduce permissions to read-only or gate write scopes behind explicit approval for this trigger |
| grype | `alpine:latest`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid` | Critical | 5 unique CVEs (CVE-2026-18924, CVE-2026-19931, CVE-2026-5450, CVE-2026-63073, CVE-2026-75803) in `curl`/`libcurl`/`libcrypto3`/`libssl3`/`openssl` | Bump base images to versions with vendor fixes (e.g. Alpine `libcrypto3`/`libssl3` 3.5.8-r0, `curl`/`libcurl` 8.22.0-r0) |
| grype | all 9 scanned images | High (172), Medium (328), Low (54), Negligible (27), Unknown (18) | Numerous upstream package CVEs (e.g. `bind9-libs`, `perl`) | Track via routine base-image updates; prioritize Critical/High first |
| grant | all 9 scanned images | error | 1250 license policy violations (e.g. GPL-2.0 in `sysvinit-utils`, `hostname`, `apk-tools`, `ssl_client`) across npm and OS packages | Review `grant` license policy for these images; either allow-list known-acceptable licenses or replace flagged packages |
| shellcheck | 12 grader scripts (e.g. `.github/graders/*-operational-value.sh`) | warning (SC2034) | Env vars (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) appear unused | Verify each variable is actually consumed or export/remove it |
| yamllint / poutine | — | clean | No findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Compiler summary:**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

**Actionlint errors (both occurrences, same root cause):**
```
.github/workflows/self-care-dashboard-performance.lock.yml:2304:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
.github/workflows/self-care-pages-health.lock.yml:2210:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
```

**zizmor severity totals:** 49 High, 447 Medium, 323 Low/Informational (rule breakdown: `secrets-outside-env` 418, `anonymous-definition` 302, `undocumented-permissions` 294, `github-app` 49, `artipacked` 29, `adhoc-packages` 26, `template-injection` 9, `obfuscation` 3)

**grype severity totals (across 9 images):** 34 Critical, 172 High, 328 Medium, 54 Low, 27 Negligible, 18 Unknown

**grant:** 1250 license-policy violations across 9 images (`gh-aw-firewall/agent` 381, `api-proxy` 185, `cli-proxy` 178, `gh-aw-mcpg` 80, `gh-aw-node` 176, `github-mcp-server` 7, `squid` 63, `alpine` 16, `node:lts-alpine` 164)

**runner-guard finding (full text):**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger - A job specifies `permissions:` with write-level access ... but the workflow is triggered by `pull_request_target`, `issue_comment`, `pull_request_review_comment`, or another event that can be initiated by external users.
```

**Untracked file present in target checkout after compile:** `.poutine.yml` (new poutine scanner config, not committed).

**Uncompiled workflows/images inventory:** 51 workflow sources, 51 compiled lock files, 9 container images scanned (syft/grype/grant), 2905 shellcheck run-step resources scanned.

No token-like or credential-like values were present in the tool output.

Control plane context

- Correlation ID: `34595348815-162`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34595348815`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34595831886) · copilot · auto · 43.6 AIC · ⌖ 9.4 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 12:08 PM UTC

Start with the workflow sources under .github/workflows/*.md and the gh-aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Recompile with the listed validation and security scans, including actionlint, zizmor, runner-guard, grant, and grype. Done means the compiler and full scan pass, or any unsafe finding is clearly reported for human action.

Written by the indexing model from the issue text.