[aw-doctor:compiler-security] githubnext/gh-aw-cao: compiler+security findings (2 actionlint errors, 34 critical/172+ high grype CVEs, 1250 grant license find

Compiling all 51 gh-aw workflow sources (51 generated lock files) in `githubnext/gh-aw-cao` finished with **exit code 1** — the run is not clean. Two `actionlint` type errors (High, blocking) reference an undefined `safe-outputs-app-token` step output in two generated lock files, `zizmor` reported 49 High "github-app" token-scope findings plus ~1,150 Medium/Low/Informational findings across all 51 workflows, `poutine`/`runner-guard` flagged one Medium excessive-permissions-on-untrusted-trigger finding, `grype` found 34 Critical and 172 High CVEs across the 9 scanned container images (worst: OpenSSL `CVE-2026-63073`/`CVE-2026-75803` in `alpine:latest`, `libcurl` CVEs in `gh-aw-mcpg`), and `grant` failed strict-mode license-policy checks with 1,250 findings across those same images. Highest-severity supported finding: **Critical** (grype container CVEs). Recommended next action: assign the remediation issue to Copilot to fix the actionlint/zizmor workflow-source issues first (compiler-blocking), then track image/license findings separately since they originate from upstream base images, not this repo's workflow sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | High (blocking) | `safe-outputs-app-token` step output referenced in an expression but not defined in the generated step-outputs type (2 errors) | Compiler-generated defect: fix the gh-aw template/source emitting this reference so the referenced step exists, then recompile |
| zizmor | 41 of 51 workflows | High | `github-app`: dangerous use of GitHub App tokens (49 findings) | Review each flagged token usage against zizmor's github-app guidance; scope/rotate as needed |
| zizmor | all 51 workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (418 findings) | Move secret-referencing jobs into a dedicated `environment:` or confirm this is an accepted generated-template pattern |
| zizmor | ~15 workflows (e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`) | Medium | `artipacked`: credential persistence through uploaded artifacts (29 findings) | Ensure checkout/credential steps don't persist tokens into artifacts |
| poutine / runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a job reachable from an untrusted-trigger command file | Confirm this command dispatch path can't be triggered by external/untrusted actors, or reduce permissions |
| zizmor | many workflows | Low | `undocumented-permissions` (294), `adhoc-packages` (26), `obfuscation` (3) | Add explanatory comments to `permissions:` blocks; pin ad-hoc package installs |
| zizmor | `pr-reviewer.lock.yml` and others | Informational | `anonymous-definition` (302), `template-injection` (9) | Non-blocking; optional cleanup |
| grype | 9 container images (`alpine:latest`, `gh-aw-mcpg:v0.4.20`, `gh-aw-firewall/*:0.28.15`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `node:lts-alpine`) | Critical / High | 34 Critical + 172 High CVEs; worst include `CVE-2026-63073`/`CVE-2026-75803` (OpenSSL `libcrypto3`/`libssl3` in `alpine:latest`), `CVE-2026-18924`/`CVE-2026-19931` (`libcurl`, multiple images) | Bump base images / vendor package versions to patched releases; these originate upstream, not from this repo's workflow sources |
| grant | same 9 container images | error (strict-mode policy) | 1,250 license-policy violations causing `grant` to exit non-zero | Review `.poutine.yml`/grant license allowlist policy against the flagged packages, or confirm strict mode is intentional for these upstream images |

Per-image grype Critical/High counts: `gh-aw-firewall/agent` 0C/4H, `gh-aw-firewall/api-proxy` 4C/18H, `gh-aw-firewall/cli-proxy` 4C/18H, `gh-aw-firewall/squid` 10C/35H, `gh-aw-mcpg` 4C/48H, `gh-aw-node` 2C/11H, `github-mcp-server` 2C/6H, `alpine:latest` 4C/14H, `node:lts-alpine` 4C/18H.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Prioritize the two actionlint "expression" errors referencing `safe-outputs-app-token` in `self-care-dashboard-performance.md` and `self-care-pages-health.md` since these block a clean compile. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely (for example, container-image CVEs or license findings that originate from upstream base images rather than this repository's workflow sources).

Raw evidence

Severity totals across all tools in this run: 34 Critical, 221 High, 788 Medium, 377 Low, 18 Unknown/Negligible-adjacent.

Zizmor rule totals: `secrets-outside-env` 418, `anonymous-definition` 302, `undocumented-permissions` 294, `github-app` 49, `artipacked` 29, `adhoc-packages` 26, `template-injection` 9, `obfuscation` 3.

Actionlint summary: checked 51 workflows, found 2 issues (2 errors), both `expression` type.

Grant summary: `grant found 1250 license policy finding(s) in container images` (strict mode failure).

Untracked file noted in git status after the run: `.poutine.yml` (new, not yet committed — likely a runner-guard/poutine policy file generated or added during this scan; review before committing).

Full raw compiler/scanner output (`report.txt`) is 721 KB / 10,027 lines and has been redacted of any token-like values in this summary; no credential values were reproduced here.

Control plane context

- Correlation ID: `34618204185-1138`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34618204185`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34618204185) · copilot · auto · 48.5 AIC · ⌖ 16.1 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 4:08 PM UTC

Start with the gh-aw workflow sources self-care-dashboard-performance.md and self-care-pages-health.md, then run the compiler and inspect the generated lock-file diffs without editing those files directly. Review the actionlint, zizmor, poutine, runner-guard, grant, and grype results; done means the compiler and security scans pass or remaining upstream image and license findings are explicitly documented.

Written by the indexing model from the issue text.