[cao-evolution:compiler-security] gh-aw compiler and security scan findings across 50 workflows

Compiling all 50 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the gh-aw compiler's full validation, lint, container, and security-scanner suite finished with **exit code 1 (findings present)**. Highest-severity supported findings: 34 Critical / 221 High zizmor findings and 34 Critical / 172 High grype CVEs across 9 container images; poutine and yamllint are clean. Recommended next action: assign this issue to Copilot to remediate lint/style and workflow-source findings, and separately track the container-image CVE/license findings which require base-image or policy updates rather than workflow-source edits.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 18 `.lock.yml` files (dashboard-authoring-corpus, eu-cra-compliance*, uk-ai-advisory*, self-care*, software-development-practices*) | Low | SC1003: unescaped single quote in example "Execute Pi CLI" step script (`echo 'This is how it's done'`) | Escape the quote in the shared Pi CLI step template source |
| shellcheck (standalone) | operational-value grader scripts (e.g. `*-operational-value.sh`) | Low | SC2034: variables `WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED` appear unused | Export or consume the variables, or add a `# shellcheck disable=SC2034` if intentionally unused |
| zizmor | 40+ `.lock.yml` files | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Review app-token scope/usage in each workflow that mints a GitHub App token |
| zizmor | most `.lock.yml` files (414 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Reference secrets via a job `environment:` block per zizmor guidance |
| zizmor | multiple `.lock.yml` files (31 occurrences) | Medium | `artipacked`: credential persistence through Actions artifacts after checkout | Ensure `persist-credentials: false` or scrub credentials before uploading artifacts |
| zizmor | most `.lock.yml` files (292 occurrences) | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add a comment documenting the purpose of each granted permission |
| zizmor | most `.lock.yml` files (297 occurrences) | Informational | `anonymous-definition`: job/workflow definitions without a `name:` | Add `name:` fields to the flagged job definitions |
| zizmor | pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml, self-care.lock.yml (9 occurrences) | Informational | `template-injection`: code injection via template expansion | Route the flagged template expressions through an `env:` indirection instead of direct interpolation |
| zizmor | optimization-ai-credit-auditor/optimizer.lock.yml, self-care-docs-build-time-investigator.lock.yml (3 occurrences) | Low | `obfuscation`: no-op `${{ '' }}` expression | Replace with a plain empty string literal |
| zizmor | 25 occurrences | Low | `adhoc-packages`: ad-hoc installation of packages (e.g. `npm install -g`) | Pin package installs via a manifest/lockfile where feasible |
| zizmor | 2 occurrences | Unknown | `property` audit finding | Needs manual triage; severity not resolved by tool |
| runner-guard | agentic_commands.yml | Medium | RGS-005: job specifies write-level `permissions:` while triggerable by an externally-initiated event, amplifying blast radius of any injection bug | Scope down permissions for the flagged trigger context or require `pull_request_target`/`issue_comment`-safe guards |
| poutine | — | — | Clean — no findings | None |
| grype | alpine:latest, 8 `ghcr.io/github/*` and `node:lts-alpine` images (9 total) | Critical (34) / High (172) / Medium (313) / Low (54) / Negligible (27) / Unknown (18) | CVEs in base-image packages (e.g. libssl3/libcrypto3 on alpine:latest — CVE-2026-63073/75803 Critical; bind9-libs, python3.10, brace-expansion@5.0.7 High on `ghcr.io/github/gh-aw-firewall/agent:0.28.15`) | Update pinned base image tags/digests to patched releases; re-run grype after bump |
| grant (license scanner) | all 9 container images (1250 violations) | policy violation | Base OS/npm packages flagged against configured license allowlist (GPL-2.0-only, LGPL, Apache-2.0, MIT, etc. on system packages present in every scanned image) | Review `grant`/license policy configuration — current allowlist appears to reject common base-image licenses; likely needs allowlist tuning rather than image changes |
| yamllint | — | — | Clean — no findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: the grype (container CVE) and grant (license policy) findings originate from third-party base images and the configured license policy, not from workflow-source edits — flag these separately rather than attempting workflow-source fixes for them.

Raw evidence

- Full compiler/scanner output: `report.txt` (10,383 lines) captured in the workflow's evidence directory `/tmp/gh-aw/agent/cao-evolution-compiler-security/`.
- Summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 50`, `Compiled locks: 50`.
- `git-status.txt` shows one untracked file: `.poutine.yml` (poutine scanner config, not a finding).
- Severity tallies (zizmor): 34 Critical, 221 High, 758 Medium, 374 Low, 306 Informational, 18 Unknown across rules: secrets-outside-env (414), anonymous-definition (297), undocumented-permissions (292), shellcheck (72), github-app (49), artipacked (31), adhoc-packages (25), template-injection (9), obfuscation (3), property (2).
- Severity tallies (grype): 34 Critical, 172 High, 313 Medium, 54 Low, 27 Negligible, 18 Unknown CVEs across 9 scanned images.
- No token-like or credential-like values were observed in the captured output.

Control plane context

- Correlation ID: `34731126509-46`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34731126509

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34731356598) · copilot · auto · 49.1 AIC · ⌖ 8.53 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 2:06 AM UTC

Start with report.txt in /tmp/gh-aw/agent/cao-evolution-compiler-security/ and the referenced .github/workflows/*.md sources. Use the gh-aw MCP server's fix and compile tools, then rerun the full validation and security scanner suite. Done means source changes produce clean scans, with third-party grype CVEs and grant policy findings separately explained rather than edited in generated .lock.yml files.

Written by the indexing model from the issue text.