[aw-doctor:compiler-security] gh-aw compiler & security scan: 51 workflows, actionlint errors, 49 High github-app findings, 34 Critical container CVEs

Compiled all 51 gh-aw workflow sources in `githubnext/gh-aw-cao` (exit code 1, not clean). Findings span 4 categories: 2 actionlint expression errors, ~1,600 zizmor security-lint findings (49 High `github-app` token-usage, 418 Medium `secrets-outside-env`, plus lower-severity permissions/naming/obfuscation notices), 1 poutine Medium excessive-permissions finding, and container-image issues across 9 scanned images (34 Critical + 221 High CVEs via grype, 5 images affected by a High-severity `brace-expansion` GHSA, and grant's strict-mode license scan failing with 1,250 policy violations). Highest-severity supported finding: Critical CVEs (e.g. CVE-2026-63073, CVE-2026-19931) in `alpine:latest`, `node:lts-alpine`, `github-mcp-server`, and the gh-aw firewall/mcpg images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step-output property referenced but not defined in that job's outputs type | Fix the `.md` source (or shared template) generating this GIT_TOKEN expression so the referenced step id/output exists in scope |
| zizmor | 39 workflows (aw-doctor, aw-failures-investigator, cao-evolution\*, eu-cra-compliance\*, self-care\*, software-development-practices\*, uk-ai-advisory\*, etc.) | High | `github-app`: dangerous use of `actions/create-github-app-token` (from shared `control.md`) | Review token scoping/lifetime for the shared control-plane app-token step; confirm minimal permissions and short-lived usage per zizmor guidance |
| zizmor | ~all 51 workflows (repeated per job) | Medium | `secrets-outside-env` (418 occurrences): secrets referenced without a dedicated `env:` block | Move secret references into job/step `env:` blocks in shared templates |
| zizmor | multiple lock files | Medium | `artipacked` (29 occurrences): credential persistence through uploaded artifacts | Ensure `actions/checkout` steps that upload artifacts don't persist credentials (`persist-credentials: false`) |
| zizmor | pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml, self-care.lock.yml | Informational | `template-injection` (9 occurrences): code injection via template expansion | Quote/sanitize expanded expressions or move to `env:` indirection |
| zizmor | ~51 workflows | Low/Info | `undocumented-permissions` (294), `anonymous-definition` (302), `adhoc-packages` (26), `obfuscation` (3) | Low priority; add permission comments and workflow/job names where practical |
| poutine | agentic_commands.yml | Medium | `RGS-005`: write-level `permissions:` on a workflow triggerable by untrusted events | Confirm this file is intentionally a commands-metadata artifact, not an executable workflow with write perms on untrusted triggers |
| grype | alpine:latest, node:lts-alpine, ghcr.io/github/github-mcp-server:v1.12.1, ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.28.15, ghcr.io/github/gh-aw-mcpg:v0.4.20 | Critical (34), High (221) | OS-package CVEs (curl/libcurl CVE-2026-19931/18924, openssl/libssl3 CVE-2026-63073/75803, glibc CVE-2026-5450, etc.) | Bump base images / pinned tags to patched package versions where fixes are listed; re-run grype after bump |
| grype | ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy}:0.28.15, gh-aw-mcpg:v0.4.20, node | High | `GHSA-rgw5-rvv9-x895` / `GHSA-mh99-v99m-4gvg`: `brace-expansion` npm package vulnerable regex | Upgrade `brace-expansion` to patched version (5.0.8/5.0.9) in image dependency lockfiles |
| grant | 9 scanned container images | error (strict mode) | 1,250 license-policy violations across OS and npm packages (GPL/LGPL family flagged under current policy) | Review `grant` policy allowlist vs. actual base-image licenses; confirm intended policy before treating as a hard gate |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Start with:
1. The two actionlint `safe-outputs-app-token` expression errors in `self-care-dashboard-performance.md` and `self-care-pages-health.md`.
2. The 49 zizmor High `github-app` findings originating from the shared `create-github-app-token` step in `.github/workflows/shared/control.md`.
3. The `brace-expansion` GHSA fixes and Critical/High OS-package CVEs in the pinned container image tags used by the gh-aw firewall/mcpg/node/alpine images (bump tags/digests where upstream fixes exist).
4. The `grant` strict-mode license policy — confirm with a maintainer whether the policy or the flagged packages should change before altering CI gating.

Raw evidence

Compiler run summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary: `Checked 51 workflow(s)`, `Found 2 issue(s) (2 error(s))`, issue type `expression`.

Zizmor severity counts (raw finding lines, not deduplicated across repeated jobs per workflow): Critical 34 (container CVEs only; zizmor itself reported 0 Critical), High 221, Medium 788, Low 377, Informational 311, Unknown 18 (container CVE severity not yet rated).

Zizmor rule-id counts: `secrets-outside-env` 418, `anonymous-definition` 302, `undocumented-permissions` 294, `github-app` 49, `artipacked` 29, `adhoc-packages` 26, `template-injection` 9, `obfuscation` 3.

Grype scanned 9 container images (syft SBOMs generated for all): `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `alpine:latest`, `node:lts-alpine`. 34 Critical + 221 High findings reported (error-level), remainder Medium/Low/Negligible warnings.

Grant (license scanner) exited non-zero in strict mode: "grant found 1250 license policy finding(s) in container images", dominated by GPL/LGPL-family and OS-base-image licenses on `ghcr.io/github/gh-aw-firewall/agent:0.28.15` and similarly-composed images.

No secret- or token-like values were present in the raw tool output; none redacted.

Control plane context

- Correlation ID: `34601004381-163`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34601004381`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34601375001) · copilot · auto · 55.8 AIC · ⌖ 8.47 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 1:14 PM UTC

Start by running the gh-aw MCP server's compile and fix tools against the 51 workflow sources, beginning with self-care-dashboard-performance.md and self-care-pages-health.md. Read the shared token step in .github/workflows/shared/control.md and review the pinned container image references named in the report. Done means generated lock files reflect source-only changes and the full compiler, lint, security, license, SBOM, and image scans pass, or remaining maintainer decisions are documented.

Written by the indexing model from the issue text.