[cao-evolution:compiler-security] githubnext/gh-aw-cao: 49 High github-app findings, 34 Critical CVEs, grant license-policy failure across all 50 workflows

Compiler run over 50 workflow sources / 50 lock files in `githubnext/gh-aw-cao` exited with code 1: `actionlint` found 74 issues (2 expression-schema errors, 72 shellcheck notes), `zizmor` reported 49 High-severity `github-app` findings plus 445 Medium `secrets-outside-env` and 31 Medium `artipacked`, `grype` found 34 Critical / 172 High vulnerabilities across 9 container images, and `grant` failed strict mode with 1,250 license-policy findings (mostly copyleft/GPL packages baked into base images). `poutine`/`runner-guard` flagged one Medium excessive-permissions issue on a `pull_request_target`-triggered command router. Highest-severity supported finding: **Critical CVE-2026-63073 / CVE-2026-75803 in `node:lts-alpine` (libcrypto3/libssl3)** and **Critical CVE-2026-5450 in `ghcr.io/github/github-mcp-server:v1.12.1` (libc6)**, both with available fixed versions. No compiler changes are needed for `.poutine.yml` (untracked, harmless config file).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step-outputs object type | Fix the source template's expression to reference a valid step output property |
| actionlint (shellcheck SC1003) | 18 lock files, step "Execute Pi CLI" | error | Unescaped single quote in generated shell heredoc (`echo 'This is how it's done'`) | Fix quoting in the shared Pi CLI install/example script template |
| zizmor | 49 lock files (one job each) | High | `github-app`: dangerous use of `actions/create-github-app-token` — token scope/lifetime not constrained | Review app-token step; scope permissions and short-lived token usage per zizmor guidance |
| zizmor | 49+ lock files | Medium | `secrets-outside-env`: secrets referenced without dedicated `environment:` | Move secret-consuming jobs into a named GitHub Environment |
| zizmor | multiple lock files | Medium | `artipacked`: artifact upload may retain credentials/tokens | Scope `actions/upload-artifact` paths away from credential-bearing directories |
| runner-guard/poutine | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a workflow reachable via `pull_request_target`/`issue_comment` triggers | Drop to read-only permissions or gate write jobs behind an approval/authorization check |
| grype | `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3` 3.5.7-r0 (fix: 3.5.8-r0) | Bump base image / rebuild to pick up patched `openssl` package |
| grype | `github-mcp-server:v1.12.1` | Critical | CVE-2026-5450: `libc6` 2.36-9+deb12u14 (Debian glibc) | Update/rebuild upstream image with patched glibc; track upstream release |
| grype | `node:lts-alpine`, `gh-aw-firewall/cli-proxy`, `alpine:latest` | High | CVE-2026-18798 (`libcrypto3`), CVE-2026-80230/82208 (`curl`/`libcurl`) — fixes available | Rebuild/refresh pinned image digests to pull patched packages |
| grype | `gh-aw-mcpg`, `gh-aw-firewall/agent`, others | High/Medium | 172 High and 313 Medium CVEs total across images (see raw evidence) | Refresh pinned image digests on a regular cadence; track via `syft`/`grype` diffs |
| grant | 9 container images | error (strict) | 1,250 license-policy findings, largely GPL-2.0-only/GPL-2.0-or-later packages in base OS layers (`busybox`, `alpine-baselayout`, `perl`, etc.) plus many ISC/MIT deps flagged by policy | Review `grant` policy allowlist for expected OS-base licenses (GPL in `apk`/`dpkg` base packages is typically acceptable); tighten policy or add documented exceptions rather than suppressing wholesale |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priority order: (1) fix the two actionlint `expression` errors referencing `safe-outputs-app-token` in `self-care-dashboard-performance.md` and `self-care-pages-health.md`; (2) fix the shellcheck SC1003 quoting issue in the shared Pi CLI install script template used by 18 workflows; (3) address the `runner-guard` RGS-005 excessive-permissions finding on `agentic_commands.yml` by scoping permissions or adding an authorization gate; (4) review zizmor's `github-app` High findings and `secrets-outside-env`/`artipacked` Medium findings and apply the recommended hardening where safe; (5) bump pinned container image digests (`node:lts-alpine`, `github-mcp-server`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `alpine`) to pick up patched packages for the Critical/High grype CVEs; (6) review the `grant` license-policy configuration and tighten the allowlist for expected base-image licenses instead of ignoring findings.

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 50
Compiled locks: 50

Actionlint Summary
✓ Checked 50 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2

zizmor: 49 High (github-app), 445 Medium (secrets-outside-env), 31 Medium (artipacked),
306 Informational (anonymous-definition), 320 Low (adhoc-packages/undocumented-permissions)

poutine/runner-guard: 1 Medium (RGS-005) on agentic_commands.yml

syft: scanned 9 container images (alpine:latest, gh-aw-firewall/{agent,api-proxy,squid,cli-proxy},
gh-aw-mcpg, gh-aw-node, github-mcp-server, node:lts-alpine)

grype severity totals across 9 images: 34 Critical, 172 High, 313 Medium, 54 Low, 27 Negligible, 18 Unknown

grant: strict mode failed with 1250 license policy finding(s) in container images

git-status.txt: "?? .poutine.yml" (untracked local config artifact, not a source change)
```

Full report.txt is 10,383 lines / ~741 KB; only representative excerpts are included above. Token-like strings were not present in the excerpted output.

Control plane context

- Correlation ID: `34725625177-1`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34725625177

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34725625177) · copilot · auto · 54.1 AIC · ⌖ 10.3 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 26, 2026, 11:52 PM UTC

Start with the compiler and security scan, then inspect the source templates for the two expression errors in self-care-dashboard-performance.md and self-care-pages-health.md, the shared Pi CLI script used by 18 workflows, and agentic_commands.yml. Review generated lock-file diffs without editing them; done means the full compiler, security, permissions, image, and license checks pass or any unsafe remediation is clearly documented.

Written by the indexing model from the issue text.