[aw-doctor:compiler-security] Compiler & security scan findings: gh-aw-cao (51 workflows) — actionlint, zizmor, grype, grant

The gh-aw compiler run against `githubnext/gh-aw-cao` (51 workflow sources, 51 lock files, HEAD `7226ffb`) exited with code 1. The compiler and full scanner suite found real issues in four categories: 2 actionlint expression errors, 878 zizmor findings (49 High, 447 Medium, 356 Low/Informational) across workflow lock files, 1 Medium runner-guard permissions finding, and container-image scan results from grype (34 Critical / 172 High vulnerabilities) and grant (1250 license-policy violations, dominated by permissive ISC/MIT/Apache-2.0 packages that suggest the license policy allowlist may need tuning). Highest-severity supported finding: grype Critical CVEs (CVE-2026-19931, CVE-2026-18924) in curl/libcurl inside `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml:2304, self-care-pages-health.lock.yml:2210 | error | `steps.safe-outputs-app-token.outputs.token` referenced but step `safe-outputs-app-token` not defined in that job's step context (typed-expression check) | Fix the generating workflow-compiler template so the `GIT_TOKEN` fallback expression only references `safe-outputs-app-token` outputs in jobs where that step exists |
| zizmor | Multiple `*.lock.yml` (e.g. aw-doctor, aw-failures-investigator, aw-maintenance-compiler-security, aw-maintenance-upgrade) | High (49 total) | `github-app`: dangerous use of `actions/create-github-app-token@bcd2ba4...` (v3.2.0) for `cao_pre_activation_app_token` — flagged because App tokens minted here can grant broad repo access if inputs are attacker-influenced | Constrain step `if:`/inputs to trusted context only, or scope the App's permissions/repository selection tighter; review zizmor guidance at the `github-app` audit link |
| zizmor | Multiple `*.lock.yml` | Medium (418) | `secrets-outside-env`: secrets referenced directly in `run:`/`env:` blocks without a dedicated environment | Move secret references into a job/step `environment:` block per zizmor's `secrets-outside-env` guidance |
| zizmor | dashboard-authoring-corpus.lock.yml, dependabot-release-train-updater.lock.yml, design-decision-gate.lock.yml (+ others, 29 total) | Medium | `artipacked`: checkout steps with `persist-credentials: true` (default) followed by artifact upload risk credential leakage via artifacts | Set `persist-credentials: false` on checkout steps that don't need to push, or ensure no credentials-bearing paths are uploaded as artifacts |
| zizmor | pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml, self-care.lock.yml (9 total) | Informational | `template-injection`: template expansion adjacent to MCP Gateway startup script | Review for injectable values reaching `run:` blocks; confirm inputs are sanitized before templating |
| zizmor | All 51 lock files | Low/Info (294 + 302 + 26 + 3) | `undocumented-permissions` (294), `anonymous-definition` (302), `adhoc-packages` (26), `obfuscation` (3, e.g. `GH_AW_WIKI_NOTE: ${{ '' }}`) | Low priority; add comments to `permissions:` blocks, name workflow/job definitions, pin package installs, and remove the always-empty `${{ '' }}` expression pattern |
| runner-guard (poutine) | .github/workflows/agentic_commands.yml:1 | Medium | RGS-005: job carries write-level `permissions:` while triggered by an event that can be initiated by external users (command-dispatch trigger) | Verify the command trigger is gated by an authorization check before any write-permission job runs; tighten `permissions:` scope if not already minimal |
| grype | ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15 | Critical | CVE-2026-19931, CVE-2026-18924: `curl`/`libcurl@8.21.0-r0` (fix: 8.22.0-r0) | Rebuild/bump base image to pick up patched `curl`/`libcurl` |
| grype | ghcr.io/github/gh-aw-firewall/agent:0.28.15 | High | GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg (`brace-expansion@5.0.7`), GHSA-r292-9mhp-454m (`tar@7.5.19`), GHSA-mwp4-54f8-5fhr (`ip-address@10.2.0`) | Update bundled npm packages to the listed fixed versions |
| grype | Multiple images | High/Medium/Low (172 High, 341 Medium, 54 Low, 27 Negligible, 18 Unknown total across 9 images) | Assorted CVEs, notably `CVE-2026-5450` (libc6), `CVE-2026-63073`/`CVE-2026-75803` (openssl/libssl3/libcrypto3) | See raw evidence; prioritize images with Critical/High counts first (api-proxy, agent, mcpg) |
| grant | 9 container images | error (1250 findings) | License policy violations dominated by ISC (365), MIT (285), Apache-2.0 (69), GPL-2.0-only (62) — many of these are standard permissive licenses | Verify `.poutine.yml`/grant license allowlist is correctly scoped; an untracked `.poutine.yml` was present in the working tree (`git-status.txt`), suggesting the license policy configuration may need review before treating all 1250 as true violations |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Start with the actionlint `safe-outputs-app-token` expression error and the 49 zizmor `github-app` High findings, then address `secrets-outside-env` and `artipacked` Medium findings, then verify whether the grant license-policy findings reflect a genuine allowlist gap versus benign permissive-license noise before making any policy changes.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

git-status.txt:
```
?? .poutine.yml
```

Finding counts (grep-derived, deduplicated by category):
- actionlint: 2 errors (expression type checks)
- zizmor: 49 High (github-app), 418 Medium (secrets-outside-env), 29 Medium (artipacked), 294 Low (undocumented-permissions), 302 Informational (anonymous-definition), 26 Low (adhoc-packages), 9 Informational (template-injection), 3 Low (obfuscation)
- runner-guard: 1 Medium (RGS-005, agentic_commands.yml)
- grype: 34 Critical, 172 High, 341 Medium, 54 Low, 27 Negligible, 18 Unknown (across 9 scanned images: gh-aw-firewall/agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, alpine, node:lts-alpine)
- grant: 1250 license policy violation lines (error severity), across the same 9 images

Full raw report.txt is 721 KB / 10,027 lines and was scanned locally for this summary; not reproduced in full here to keep this report bounded. No token-like or credential-like values were observed in the scanned output.

Control plane context

- Correlation ID: `34606412608-1127`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34606412608`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34606412608) · copilot · auto · 45.3 AIC · ⌖ 15.2 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 2:09 PM UTC

Start with the .github/workflows/*.md sources and the actionlint errors involving safe-outputs-app-token, then inspect .github/workflows/agentic_commands.yml for the runner-guard finding. Use the gh-aw MCP server's fix and compile tools without editing generated .lock.yml files. Done means the full compiler, security, and validation suite passes, or an unsafe finding is clearly documented.

Written by the indexing model from the issue text.