[cao-evolution:compiler-security] Compiler/security scan findings: actionlint, zizmor, runner-guard, grype, and grant violations

Compiling all 50 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the gh-aw compiler's full validation, lint, container, and security-scanner suite finished with **exit code 1** (not clean). Findings span 4 categories: 2 actionlint expression errors, 8 zizmor rule categories (49 High-severity `github-app` findings plus lower-severity noise), 1 runner-guard taint finding, 34 Critical / 221 High / 758 Medium CVEs across 9 container images (grype), and 1250 license-policy violations across those same images (grant, strict mode). Highest-severity supported finding: **Critical CVEs** in `alpine`, `node`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, and `github-mcp-server` base images (e.g. `CVE-2026-63073`/`CVE-2026-75803` in openssl/libssl3, `CVE-2026-18924`/`CVE-2026-19931` in curl/libcurl, `CVE-2026-5450` in libc6). Recommended next action: assign to Copilot to update lock-file container pins and fix the two actionlint expression errors; license and taint findings likely need human policy review.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|--------------|
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | property `safe-outputs-app-token` not defined in job outputs object type | Fix the `.md` source's step output/expression reference so it matches the actual job outputs schema; recompile. |
| actionlint (shellcheck SC1003) | `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml`, + others (72 total) | error (info-level SC1003) | inline `run:` script contains an unescaped single quote in a sample string (`echo 'This is how it'\''s done'`) | Escape or rewrite the offending sample string in the `.md` source; harmless but should be cleaned for a clean actionlint run. |
| zizmor | 39 lock files (e.g. `cao-evolution.lock.yml`, `dependabot.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care*.lock.yml`, `optimization*.lock.yml`) | High (49 occurrences) | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` gated on `CAO_GITHUB_APP_ID`/`CAO_GITHUB_APP_PRIVATE_KEY` env vars | Review whether the conditional-`if` gating is a recognized zizmor false-positive pattern for this shared control snippet; if so, add a documented suppression, otherwise scope the token more tightly. |
| zizmor | most lock files | Medium (414 occurrences) | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into `environment:` blocks where feasible, or accept as known pattern for shared control workflows. |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`, + others (31 occurrences) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure checkout/artifact steps don't persist credentials (`persist-credentials: false` or scrub before upload). |
| zizmor | most lock files | Low (292) / Informational (297) | `undocumented-permissions`, `anonymous-definition`: permissions blocks without comments; unnamed workflow/job definitions | Add explanatory comments to `permissions:` blocks and `name:` fields in shared control `.md` sources. |
| zizmor | subset of lock files | Low (25) | `adhoc-packages`: ad-hoc package installation | Pin package installs via lockfiles or documented package managers where practical. |
| zizmor | subset (9) / (3) | Informational / Low | `template-injection`, `obfuscation` | Review flagged expressions for untrusted input interpolation into shell/template contexts. |
| runner-guard (poutine) | `agentic_commands.yml` | Medium | `RGS-005`: job specifies write-level `permissions:` while triggered by an event that can be initiated by external users (command dispatch trigger) | Confirm this workflow's trigger is restricted to trusted actors/commands as designed; if so, document the accepted risk, otherwise narrow permissions or trigger scope. |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server` | Critical (34) | 5 distinct Critical CVEs incl. `CVE-2026-63073`/`CVE-2026-75803` (openssl/libssl3/libcrypto3), `CVE-2026-18924`/`CVE-2026-19931` (curl/libcurl), `CVE-2026-5450` (libc6) | Bump base image tags / rebuild to pick up patched packages (fixes already published upstream, e.g. libssl3 3.5.8-r0). |
| grype | same images | High (221, 25 distinct CVEs) | additional High-severity CVEs in libcrypto3/libssl3 and other packages | Same remediation: update base images. |
| grype | same images | Medium (758) | additional Medium CVEs | Track via routine base-image refresh. |
| grant | all 9 images | error (strict mode) | 1250 license-policy violations across container image dependencies (spans GPL-2.0, LGPL, MPL-2.0, Artistic-2.0, and many permissive licenses) | Requires human license-policy review — confirm which licenses are actually disallowed vs. `.poutine.yml`/grant policy needing an allowlist update; not a pure code fix. |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Bounded excerpts from the full compiler/scanner run (`report.txt`, 10383 lines total; full artifact retained in the workflow run):

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 50
Compiled locks: 50

Actionlint Summary
✓ Checked 50 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type: shellcheck: 72, expression: 2

grype: 34 Critical, 221 High, 758 Medium CVE findings across 9 container images
grant: strict mode failed — 1250 license policy findings in container images
runner-guard: 1 Medium finding (RGS-005) in agentic_commands.yml
zizmor: 49 High (github-app), 414 Medium (secrets-outside-env), 31 Medium (artipacked),
292 Low (undocumented-permissions), 297 Informational (anonymous-definition),
25 Low (adhoc-packages), 9 Informational (template-injection), 3 Low (obfuscation)
```

Container images scanned by syft/grype/grant: `alpine:latest`, `ghcr.io/github/gh-aw-firewall/agent:0.28.15`, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15`, `ghcr.io/github/gh-aw-firewall/squid:0.28.15`, `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`.

No token-like or credential-like values were present in the scanned output.

Control plane context

- Correlation ID: `34729738276-45`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34729738276`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34730009961) · copilot · auto · 40.6 AIC · ⌖ 8.6 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 1:33 AM UTC

Start with the .github/workflows/*.md sources named by the actionlint findings, especially the sources generating self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml, and agentic_commands.yml; do not edit generated lock files. Run the gh-aw compiler with its full validation and security-scanner suite, then verify the generated locks and scan report are clean. License-policy and taint findings require documented human review if they cannot be safely resolved.

Written by the indexing model from the issue text.