[cao-evolution:compiler-security] AW Compiler & Security Findings: githubnext/gh-aw-cao (grant blocking, 1250 license findings; 34 Critical CVEs)

The gh-aw compiler failed strict validation for `githubnext/gh-aw-cao` (50 workflow sources, 50 lock files, exit code 1). Findings span actionlint (74 issues: 2 expression errors, 72 shellcheck escaping warnings), zizmor (49 High `github-app` token-handling findings, 758 Medium/Low/Informational style findings), runner-guard (1 Medium excessive-permissions-on-untrusted-trigger finding), and grype (34 Critical / 172 High CVEs across 8 of 9 scanned container images). The compiler-blocking failure is `grant`: strict license-policy mode found 1250 license findings in container images. Highest-severity supported finding: **Critical CVEs (grype)** in `alpine:latest`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, and `node:lts-alpine` base images (e.g. CVE-2026-63073, CVE-2026-75803 in `libcrypto3`/`libssl3`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|--------------|
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in job outputs type | Fix the referenced step ID/output in the workflow source template so the expression resolves to a declared step output |
| actionlint (shellcheck, SC1003) | ~18 lock files (e.g. `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml`, `self-care-docs-build-time-investigator.lock.yml`, `self-care-open-source-failures.lock.yml`, `software-development-practices-github-well-architected.lock.yml`) | error | Unescaped single quote in embedded shell script (`echo 'This is how it's done'`) | Escape the embedded single quote (`it'\''s`) in the shared script source that generates these steps |
| actionlint (shellcheck, SC2034) | grader scripts under `graders/*-operational-value.sh` | warning | Unused variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`, `FRAMEWORK`) | Export or remove the unused grader template variables |
| zizmor | 39 lock files including `cao-evolution*.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care*.lock.yml`, `dependabot*.lock.yml` | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) flagged as sensitive token handling | Review token scoping/lifetime for the flagged app-token steps; confirm least-privilege permissions and short-lived token use per zizmor's `github-app` guidance |
| zizmor | most lock files | Medium | `secrets-outside-env` (414), `artipacked` (31): secrets referenced without a dedicated environment / artifact packing risk | Move secret references into a dedicated `environment:` block; review artifact retention on steps handling checked-out state |
| zizmor | most lock files | Low | `undocumented-permissions` (292), `adhoc-packages` (25) | Add explanatory comments to `permissions:` blocks; pin ad-hoc package installs to a lockfile/version |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify the flagged expression/env usage to a direct, non-obfuscated form |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` | Informational | `template-injection`: potential expression template injection pattern | Review flagged `${{ }}` interpolations for untrusted input sanitization |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` combined with an untrusted-trigger-capable event context | Reduce job permissions to read-only or restrict the trigger context per RGS-005 guidance |
| grype | `alpine:latest`, `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | Critical (34), High (172), Medium (313), Low (54), Negligible (27) | 198 unique CVEs across 8 of 9 scanned images (e.g. CVE-2026-63073/CVE-2026-75803 Critical in `libcrypto3`/`libssl3` on `alpine:latest`) | Bump base images / packages to the fixed versions reported by grype (e.g. `libssl3`/`libcrypto3` to `3.5.8-r0`) |
| grant | 9 scanned container images | error (blocking) | Strict license-policy mode found 1250 license findings, causing compiler exit code 1 | Review `grant` license policy findings per image and either update the policy allow-list or replace/rebuild flagged images with compliant packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Full compiler/scan report: 10,383 lines captured from the deterministic compilation step (`report.txt`, digest `c18d638e7cdcc36fbf72291b7830feef233ab494e6c87053a5fee2d3d96ba783`).
- Summary counts: actionlint 74 issues (2 expression, 72 shellcheck) across 50 workflows; zizmor 49 High / 758 Medium+Low+Informational across 50 files; runner-guard 1 Medium (RGS-005); grype 198 unique CVEs (34 Critical, 172 High, 313 Medium, 54 Low, 27 Negligible) across 9 container images; grant 1250 license findings (blocking, exit code 1).
- No token-like or credential-like values were present in the reviewed excerpts.

Control plane context

- Correlation ID: `34735791116-48`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34735791116`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34736041255) · copilot · auto · 46.3 AIC · ⌖ 8.87 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 4:00 AM UTC

Start with the .github/workflows/*.md sources, agentic_commands.yml, and the grader scripts under graders/, without editing generated .lock.yml files. Run the gh aw MCP server's fix and compile tools with strict validation, then review the compiler and security scan report. Done means the listed actionlint, shellcheck, zizmor, runner-guard, grant, grype, and related checks pass while preserving existing behavior.

Written by the indexing model from the issue text.