[cao-evolution:compiler-security] gh-aw compiler & security suite findings across 50 workflows

Compilation of all 50 gh-aw workflows in `githubnext/gh-aw-cao` succeeded but the full validation/lint/scanner suite exited non-zero (exit code 1). Findings span every check: actionlint (74, incl. 2 typed-expression errors), zizmor (1,120 findings, 49 High "github-app" dangerous-token-use), poutine/runner-guard (1 medium excessive-permissions-on-untrusted-trigger), grype (537 container CVEs, 5 unique Critical CVEs across 8 images), and grant (1,250 license-policy violations, incl. 233 GPL-2.0). Highest severity supported by tooling: **High** (zizmor `github-app` + grype Critical CVEs). Recommended next action: assign to Copilot to remediate workflow-source-level findings (actionlint/zizmor/runner-guard); base-image CVEs and license violations require upstream image/dependency updates and may need human decision on acceptable risk.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint (shellcheck) | `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml` (+ others, 72 total) | error | SC1003: unescaped single quote in embedded shell heredoc (`echo 'This is how it'\''s done'`) | Fix quoting in the corresponding `.md` source's shell script |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step-outputs object type | Fix expression/output reference in workflow source |
| zizmor | 49 lock files (e.g. `cao-evolution.lock.yml`, `dependabot.lock.yml`, `self-care*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` | Review token scoping/usage per zizmor guidance; confirm minimal permissions and no unsafe propagation |
| zizmor | 50 lock files | Medium | `secrets-outside-env` (414 occurrences): secrets referenced without a dedicated `env:` block | Move secret references into `env:` per zizmor guidance |
| zizmor | 50 lock files | Informational | `anonymous-definition` (297) and `undocumented-permissions` (292): jobs without `name:` / permissions without comments | Add job names and permission comments |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` | Informational | `template-injection` (9 occurrences): code injection via template expansion | Review templated expression construction |
| zizmor | ~14 lock files | Low | `adhoc-packages` (25): ad-hoc package installs (e.g. `npm install -g`) | Pin/vendor packages via lockfile-managed installs where feasible |
| poutine / runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a workflow triggered by an untrusted event | Scope down permissions or restrict trigger |
| grype | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server`, `node:lts-alpine` | Critical (5 unique CVEs), High (many) | 537 total CVE findings; Critical: CVE-2026-18924/CVE-2026-19931 (curl/libcurl), CVE-2026-5450 (libc6), CVE-2026-63073 & CVE-2026-75803 (openssl/libcrypto3/libssl3) | Update base images / pin newer digests once upstream fixes are published |
| grant | all 9 scanned container images | policy violation | 1,250 license-policy violations, incl. 233 GPL-2.0-only packages (e.g. `busybox`, `alpine-baselayout`, `ssl_client`) | Review license allow-list policy or update `.poutine.yml`/grant config; confirm GPL-2.0 base-image components are acceptable for this deployment |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Full raw scanner report is 10,383 lines and not reproduced here in full to keep this issue scannable; the table above is a bounded, deduplicated summary of all tool sections (actionlint, zizmor, poutine/runner-guard, syft, grype, grant) from `report.txt`. No token-like or credential-like values were present in the sampled evidence.

Untracked file at scan time: `.poutine.yml` (present in `git-status.txt`; not evaluated as a source-of-truth change, likely scanner-generated).

Control plane context

- Correlation ID: `34740326389-50`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34740326389`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34740501683) · copilot · auto · 40.7 AIC · ⌖ 8.98 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 5:49 AM UTC

Start with the findings in report.txt and the .github/workflows/*.md sources; use the gh aw MCP server's fix and compile tools rather than editing generated .lock.yml files. Review the generated diffs and rerun the full compiler and security scan suite; done means source-level findings are resolved and any upstream image or license decisions are explicitly explained.

Written by the indexing model from the issue text.