[aw-doctor:compiler-security] gh-aw compiler & security scan findings on githubnext/gh-aw-cao (2 actionlint errors, critical CVEs, license policy failures)

**Target:** `githubnext/gh-aw-cao` (SHA `c649e17b1c1461cbe0a56845fee009efccd9dc5f`) — gh-aw compiled 51 workflow sources / 51 lock files successfully, but the full validation+lint+security suite exited with code `1` (not clean). Highest-severity supported finding: **5 unique Critical CVEs** (grype, e.g. CVE-2026-63073 in openssl/libcrypto3/libssl3, CVE-2026-18924/CVE-2026-19931 in curl/libcurl, CVE-2026-5450 in libc6) across container images used by workflow jobs. The run also failed strict-mode `grant` license-policy checks (1250 findings, mostly copyleft/ISC/MIT packages inside the `node:lts-alpine` base image) and 2 `actionlint` type errors referencing an undefined `safe-outputs-app-token` step output. Zizmor flagged 49 High-severity `github-app` findings (GitHub App token minting steps) plus 447 Medium / 323 Low / 311 Informational findings across the 51 lock files. Recommended next action: assign to Copilot to fix the actionlint expression errors first (compiler bug, likely template issue), then re-run compile/scan to re-baseline the container CVE and license findings, which mostly require upstream base-image/dependency bumps outside workflow sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in that job's step-output type (expression check failure at `GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token ... }}`) | Fix the compiler template so the `safe-outputs-app-token` step ID/output is only referenced where the step is actually emitted, or ensure the step is always generated when referenced; regenerate lock files |
| zizmor | 41 lock files (e.g. `aw-doctor.lock.yml`, `uk-ai-advisory.lock.yml`) | High | `github-app`: dangerous use of `actions/create-github-app-token` for minting scoped tokens (49 occurrences) | Review whether each App-token mint is scoped/guarded as intended; document/justify in workflow source if accepted risk |
| zizmor | 51 lock files | Medium | `secrets-outside-env` (418 occurrences): secrets referenced without a dedicated `environment:` | Move jobs referencing secrets into a dedicated `environment:` block where feasible |
| zizmor | multiple lock files | Medium | `artipacked` (29 occurrences): credential persistence via uploaded artifacts | Scrub/avoid persisting credentials in artifact upload steps |
| zizmor | 51 lock files | Low | `undocumented-permissions` (294), `adhoc-packages` (26) | Add explanatory comments to `permissions:` blocks; prefer pinned package installs |
| zizmor | 51 lock files | Informational | `anonymous-definition` (302), `template-injection` (9), `obfuscation` (3) | Low priority; review `template-injection` occurrences in `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` for expression-injection risk |
| runner-guard (poutine) | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a job reachable from an untrusted trigger (`pull_request_target`/`issue_comment`-style event) | Reduce permissions to read-only for the affected job, or scope write access behind an explicit authorization gate |
| grype | 9 container images (unique CVEs: 201) | Critical | 5 unique CVEs, incl. CVE-2026-63073/CVE-2026-75803 (openssl/libssl3/libcrypto3, alpine-based images), CVE-2026-18924/CVE-2026-19931 (curl/libcurl, firewall proxy + `gh-aw-node` images), CVE-2026-5450 (libc6, `github-mcp-server:v1.12.1`) | Bump base images (`alpine:latest`, `node:lts-alpine`, `gh-aw-firewall/*:0.28.15`, `github-mcp-server:v1.12.1`) to versions with patched OpenSSL/curl/libc; these are upstream image pins, not workflow-source changes |
| grype | 9 container images | High | 25 unique CVEs (e.g. bind9-libs, libperl5.34 CVEs on `gh-aw-firewall/agent:0.28.15`) | Same remediation path: update pinned image digests once upstream fixes land |
| grant | 9 container images | error (strict mode) | 1250 license-policy findings, predominantly in `node:lts-alpine` (365 ISC, 285 MIT, 69 Apache-2.0, 62 GPL-2.0-only, and others) | Confirm whether these licenses are intentionally allow-listed; if so, update the license policy allow-list rather than the workflow sources; if not, replace/slim the base image |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 2 issue(s) (2 error(s))
Issues by type:
• expression: 2
```

Actionlint findings:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2306:26: error: [expression] property "safe-outputs-app-token" is not defined in object type ...
.github/workflows/self-care-pages-health.lock.yml:2212:26: error: [expression] property "safe-outputs-app-token" is not defined in object type ...
```

Zizmor severity totals across 51 lock files: 49 High, 447 Medium, 323 Low, 311 Informational.
Zizmor finding-type totals: secrets-outside-env=418, anonymous-definition=302, undocumented-permissions=294, github-app=49, artipacked=29, adhoc-packages=26, template-injection=9, obfuscation=3.

Poutine/runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Grype scanned 9 container images; severity totals: 34 Critical, 172 High, 341 Medium, 54 Low, 27 Negligible (201 unique CVEs). Critical CVE ids: CVE-2026-18924, CVE-2026-19931, CVE-2026-5450, CVE-2026-63073, CVE-2026-75803.

Grant (license scanner) failed strict mode with 1250 findings across 9 images; final line: `strict mode: grant found 1250 license policy finding(s) in container images`.

No secret-like or credential-like values were observed in the raw tool output; none were redacted beyond this note.

Control plane context

- Correlation ID: `34611952682-165`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34611952682

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34612376740) · copilot · auto · 41 AIC · ⌖ 7.66 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 3:08 PM UTC

Start by reading the generated findings for .github/workflows/self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml, and agentic_commands.yml, then run the gh-aw MCP server’s fix and compile tools against the workflow sources. Do not edit generated .lock.yml files. Done means the full strict compiler and security scan passes, or remaining upstream image and policy findings are clearly reported.

Written by the indexing model from the issue text.