[cao-evolution:compiler-security] AW Compiler & Security Scan Findings: githubnext/gh-aw-cao (74 lint, 1132 zizmor, 260 CVEs, 1250 license)

The compiler and security scan of `githubnext/gh-aw-cao` (50 workflow sources, 50 generated lock files) exited with code `1`. Findings span five categories: 74 actionlint issues (72 shellcheck, 2 expression-type errors), 1132 zizmor static-analysis findings (49 High `github-app` dangerous-token-use errors, 414 Medium `secrets-outside-env` warnings, 31 Medium `artipacked` warnings, plus lower-severity permission/documentation notes), 1 Medium `runner-guard` excessive-permissions finding on an untrusted-trigger workflow, 260 grype container CVEs (34 Critical, 172 High) across the 9 scanned images, and 1250 `grant` license-policy violations across those same images. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803) in `alpine:latest`'s `libssl3`/`libcrypto3` packages, fixed upstream in `3.5.8-r0`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 20 lock files incl. `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care-*.lock.yml`, `software-development-practices*.lock.yml`, `uk-ai-advisory*.lock.yml` | error | SC1003: unescaped single quote in embedded shell script (`echo 'This is how it'\''s done'`) | Fix the source `.md` script that emits this literal example string so the quote is properly escaped |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token.outputs.token` referenced but `safe-outputs-app-token` step is not defined in that job's step set | Correct the generated step ID reference or the source template producing `GIT_TOKEN` |
| zizmor | `cao-evolution*.lock.yml`, `dependabot*.lock.yml`, `eu-cra-compliance*.lock.yml`, `optimization*.lock.yml`, `self-care*.lock.yml`, `software-development-practices*.lock.yml`, `uk-ai-advisory*.lock.yml` (49 occurrences) | High | `github-app`: dangerous use of `actions/create-github-app-token` output tokens | Review token scoping/propagation per zizmor guidance at docs.zizmor.sh/audits/#github-app |
| zizmor | many lock files (414 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs to use a GitHub Environment, or scope secrets narrowly |
| zizmor | `dashboard-authoring-corpus.lock.yml` and others (31 occurrences) | Medium | `artipacked`: checkout after artifact download may persist credentials into uploaded artifacts | Ensure `actions/checkout` runs with `persist-credentials: false` or reorder steps |
| zizmor | most lock files (292 occurrences) | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | several lock files (25 occurrences) | Low | `adhoc-packages`: ad hoc package installs without pinning | Pin package versions/checksums |
| zizmor | several lock files (9 occurrences) | Informational | `template-injection` | Review flagged expressions for injection risk |
| runner-guard | `.github/workflows/agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a workflow reachable via untrusted trigger (`issue_comment`/`pull_request_target`-class event) | Reduce permissions or gate write access behind stricter trigger/authorization checks |
| grype | `alpine:latest` (`libssl3`/`libcrypto3` 3.5.7-r0) | Critical | CVE-2026-63073, CVE-2026-75803 (fix: 3.5.8-r0) | Bump base image / package to patched version |
| grype | `alpine:latest` and 8 other images (172 High total) | High | Various High-severity CVEs incl. CVE-2026-18798, CVE-2026-63076, CVE-2026-14457/14456/63072/54874/63075 (libssl3/libcrypto3), GHSA-rgw5-rvv9-x895 (brace-expansion, `gh-aw-firewall/agent`) | Update affected images/packages to vendor-provided fixed versions |
| grype | 9 images (313 Medium, 54 Low, 27 Negligible) | Medium/Low/Negligible | Remaining CVEs across bind9-libs, busybox, libexpat1, libperl5.34, libjpeg-turbo8, libcairo2, libdbus-1-3, libzstd1, etc. | Track via routine base-image updates |
| grant | 9 images (1250 findings) | error (policy) | License policy violations for numerous packages (MIT, GPL-2.0-only, Apache-2.0, ISC, MPL-2.0, BSD variants, etc.) across `alpine`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node` images | Review `grant` policy configuration for intended license allowlist; either adjust policy for accepted OSS licenses or replace disallowed packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 50`, `Compiled locks: 50`
- Actionlint summary: `Found 74 issue(s) (74 error(s))` — `shellcheck: 72`, `expression: 2`
- Zizmor: 1132 findings across 50 lock files — 49 High (`github-app`), 414 Medium (`secrets-outside-env`), 31 Medium (`artipacked`), 292 Low (`undocumented-permissions`), 25 Low (`adhoc-packages`), 9 Informational (`template-injection`), plus 297 Informational (`anonymous-definition`) and 3 Low (`obfuscation`)
- runner-guard: 1 Medium finding (RGS-005) on `.github/workflows/agentic_commands.yml`
- syft: SBOM generated for 9 container images (alpine:latest, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`)
- grype: 34 Critical, 172 High, 313 Medium, 54 Low, 27 Negligible across the 9 images
- grant: `grant failed — strict mode: grant found 1250 license policy finding(s) in container images`
- `git-status.txt` after the run showed only `?? .poutine.yml` (untracked scanner config, not a source change)
- No credential- or token-like values were observed in the captured report output

Control plane context

- Correlation ID: `34738111362-49`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34738111362`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34738377103) · copilot · auto · 51.6 AIC · ⌖ 8.5 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 4:57 AM UTC

Start with the named workflow sources under .github/workflows/*.md, especially the source for agentic_commands.yml and the templates producing self-care lock files; do not edit generated .lock.yml files. Run the gh-aw MCP server's fix and compile tools, then review generated diffs and rerun the listed compiler and security scans. Done means the full scan passes, or any unsafe finding is clearly explained.

Written by the indexing model from the issue text.