[cao-evolution:compiler-security] Compiler and security scan findings (74 lint issues, container CVEs, license policy failures)

The gh-aw compiler run against `githubnext/gh-aw-cao` exited with code 1 (findings, not clean). Across 50 workflow sources / 50 compiled lock files: 74 actionlint issues (72 shellcheck, 2 expression-type errors), ~2,004 zizmor findings (34 Critical is a miscategorization — zizmor's highest bucket used here is High: 221 High, 758 Medium, 374 Low, 306 Informational, 18 Unknown; dominant rule is `secrets-outside-env` at 414 occurrences), 1 runner-guard medium finding (RGS-005 excessive permissions on an untrusted-trigger workflow), and container-image scan results: grype found vulnerable packages in all 9 scanned images (16 Critical, ~170 High, ~326 Medium across images, notably `node:lts-alpine`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/github-mcp-server`), and `grant` failed strict-mode license policy with 1,250 findings. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-75803, CVE-2026-63073) in `node:lts-alpine`, `ghcr.io/github/github-mcp-server`, and `ghcr.io/github/gh-aw-firewall/squid` base images, plus 49 zizmor High `github-app` findings (dangerous use of GitHub App tokens) across most lock files.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | 15+ `.lock.yml` files (e.g. `dashboard-authoring-corpus`, `eu-cra-compliance-*`, `uk-ai-advisory*`, `software-development-practices*`, `self-care-*`) | error | SC1003: unescaped single quote in heredoc example string (`echo 'This is how it'\''s done'`) | Fix the quoting in the shared Markdown source script producing this literal example, then recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `property "safe-outputs-app-token" is not defined` in step outputs object type | Correct the expression/output reference in the workflow Markdown source; property does not exist on the referenced step outputs |
| zizmor | 49 lock files | High | `github-app`: dangerous use of GitHub App tokens | Review token scoping per zizmor guidance ((docs.zizmor.sh/redacted) |
| zizmor | Most lock files | Medium (414 occurrences) | `secrets-outside-env`: secrets referenced outside `env:` block | Move secret references into `env:` per zizmor guidance |
| zizmor | Most lock files | Low/Informational (297+292) | `anonymous-definition`, `undocumented-permissions`: missing names/permission comments | Low priority; add names and permission-scope comments |
| zizmor | ~31 lock files | Medium | `artipacked`: credential persistence through Actions artifacts | Review artifact upload steps for accidental credential persistence |
| zizmor | ~25 lock files | Low | `adhoc-packages`: ad-hoc package installation | Low priority; pin/vendor package installs |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level permissions on a workflow triggered by an event reachable by external users | Review trigger/permission combination; scope down write permissions or trigger |
| grype | `node:lts-alpine` | Critical/High | CVE-2026-75803, CVE-2026-63073, CVE-2026-63072/-63075/-63076, CVE-2026-14456/-14457, CVE-2026-18798, CVE-2026-54874 (libssl3/libcrypto3 3.5.7-r0, fix 3.5.8-r0); GHSA-r292-9mhp-454m (tar), GHSA-mwp4-54f8-5fhr (ip-address), GHSA-rgw5-rvv9-x895/GHSA-mh99-v99m-4gvg (brace-expansion) | Bump base image / update packages to patched versions |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical/High | CVE-2026-75803, CVE-2026-5450 (libc6), CVE-2026-63076/-63072/-54874 (libssl3), CVE-2026-5928/-5435 (libc6), GO-2026-5970 (golang.org/x/text) | Update base image and Go module dependencies |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.20` | High | GO-2026-6090/-6089/-5972/-5942/-5026 (stdlib), GO-2026-6355/-6354 (golang.org/x/crypto) | Rebuild with patched Go toolchain and updated modules |
| grype | `alpine:latest` | Critical/High | Same libssl3/libcrypto3 CVE family (3.5.7-r0 → 3.5.8-r0) | Update package versions in image build |
| grype | `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}`, `ghcr.io/github/gh-aw-node` | Critical/High/Medium | Multiple package CVEs (243 Medium in `agent` alone; 10 Critical in `squid`) | Rebuild firewall/node images from updated upstream bases |
| grant | 9 images | n/a | Strict-mode license policy: 1,250 findings | Review license policy exceptions or update dependencies flagged by `grant` |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 50
Compiled locks: 50
```

Actionlint summary:
```
✓ Checked 50 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
• expression: 2
• shellcheck: 72
```

Zizmor severity distribution (raw bucket counts across all findings, note zizmor's scale tops out at High for this run):
```
High: 221
Medium: 758
Low: 374
Informational: 306
Unknown: 18
```

Grype severity totals by image (Critical/High/Medium; counts from scan):
```
ghcr.io/github/gh-aw-firewall/agent: 243 Medium, 4 High
ghcr.io/github/gh-aw-mcpg: 48 High, 19 Medium, 4 Critical
ghcr.io/github/gh-aw-firewall/squid: 35 High, 10 Critical, 7 Medium
node:lts-alpine: 18 High, 10 Medium, 4 Critical
ghcr.io/github/gh-aw-firewall/cli-proxy: 18 High, 9 Medium, 4 Critical
ghcr.io/github/gh-aw-firewall/api-proxy: 18 High, 10 Medium, 4 Critical
alpine:latest: 14 High, 5 Medium, 4 Critical
ghcr.io/github/gh-aw-node: 11 High, 4 Medium, 2 Critical
ghcr.io/github/github-mcp-server: 6 High, 6 Medium, 2 Critical
```

grant:
```
✗ grant failed
strict mode: grant found 1250 license policy finding(s) in container images
```

No token-like or credential-like values were present in the scanned output; none reproduced here.

Control plane context

- Correlation ID: `34733700925-4`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34733700925`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34733700925) · copilot · auto · 37.5 AIC · ⌖ 7.43 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 2:59 AM UTC

Start with the .github/workflows/*.md sources and run the gh-aw MCP server's compile tool; generated .lock.yml files are outputs and must not be edited. Review the reported actionlint, zizmor, runner-guard, grype, and grant findings across the named workflows and images. Done means strict compilation and the listed security scans pass, or an unsafe finding is documented.

Written by the indexing model from the issue text.