[cao-evolution:compiler-security] AW Compiler Security: 34 Critical / 221 High findings across compile+container scan (githubnext/gh-aw-cao)

The gh-aw compiler flagged the target repository (`githubnext/gh-aw-cao`, SHA `af47fc7f0de1fa324358895f5707197e965c0b17`) as **not clean**: exit code `1` across 50 workflow sources / 50 lock files. Findings span 4 tool categories: shellcheck (72 hits, 1 root cause across 18 lock files), actionlint expression errors (2 lock files), zizmor static analysis (1461 findings, 34 Critical/221 High severity concentrated in `github-app` and CVE rules on pinned actions), and grype container-image CVE scanning (9 images, dozens of Critical/High CVEs, mostly OpenSSL/curl in Alpine-based images). runner-guard/poutine flagged one medium-severity excessive-permissions warning. Highest-severity, most tractable fix: bump the 9 scanned container image base versions (Alpine `libssl3`/`libcrypto3`/`curl`, Debian `libc6` in `github-mcp-server`) to pull in patched CVE-2026-63073/CVE-2026-75803/CVE-2026-19931/CVE-2026-18924 fixes.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | 18 `.lock.yml` files (e.g. `dashboard-authoring-corpus.lock.yml:866`) | error (SC1003) | Ambiguous single-quote escaping in an embedded shell heredoc (`echo 'This is how it'\''s done'`), duplicated 4x per file | Fix escaping in the shared shell snippet source (likely in `.github/workflows/shared/`) and recompile |
| actionlint | `self-care-dashboard-performance.lock.yml:2359`, `self-care-pages-health.lock.yml:2265` | error [expression] | `steps.safe-outputs-app-token` referenced but not defined in that job's step outputs type | Add/reference the correct step ID for the app-token step, or remove the stale reference, in the `.md` source |
| zizmor | 49 lock files | High — `github-app` | Dangerous use of GitHub App tokens (`actions/create-github-app-token`) flagged by zizmor's `github-app` audit | Review token scoping per zizmor guidance; likely accepted risk for CAO's app-token pattern — confirm intentional |
| zizmor | many lock files | Medium/Low — `secrets-outside-env` (414), `anonymous-definition` (297), `undocumented-permissions` (292), `artipacked` (31), `adhoc-packages` (25), `template-injection` (9), `obfuscation` (3) | Pattern findings across generated workflows, largely structural/informational | Address root causes in shared workflow-generation templates; many may be accepted/known patterns |
| runner-guard (poutine) | `agentic_commands.yml:1` | Medium — RGS-005 | Job has write-level permissions while triggered by an untrusted event (issue comment/PR) | Confirm trigger/permission pairing is intentional and constrained; narrow permissions if not required |
| grype | `alpine:latest` | Critical/High | `CVE-2026-63073`, `CVE-2026-75803` (libssl3/libcrypto3 3.5.7-r0 → fix 3.5.8-r0); multiple High CVEs (CVE-2026-18798, CVE-2026-63076, CVE-2026-14457, CVE-2026-14456, CVE-2026-63072, CVE-2026-54874, CVE-2026-63075) | Bump base image / rebuild to pick up patched `libssl3`/`libcrypto3` |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.15`, `cli-proxy:0.28.15` | Critical | `CVE-2026-19931`, `CVE-2026-18924` (curl/libcurl 8.21.0-r0 → fix 8.22.0-r0) | Update firewall image build to a curl release ≥ 8.22.0-r0 |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.15` | Critical | `CVE-2026-63073`, `CVE-2026-19931`, `CVE-2026-18924`, `CVE-2026-75803` (openssl/libssl3/libcrypto3/curl) | Same base-image update as above |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `node:lts-alpine` | Critical | `CVE-2026-63073`, `CVE-2026-75803` (libssl3/libcrypto3) | Update image tag/base to pull patched Alpine packages |
| grype | `ghcr.io/github/gh-aw-node` | Critical | `CVE-2026-19931`, `CVE-2026-18924` (libcurl) | Update base image |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical | `CVE-2026-5450` (libc6 Debian), `CVE-2026-75803` (libssl3) | Update to a newer `github-mcp-server` release with patched Debian base |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 50
Compiled locks: 50
```

Result JSON:
```json
{
"targetRepo": "githubnext/gh-aw-cao",
"targetSha": "af47fc7f0de1fa324358895f5707197e965c0b17",
"exitCode": 1,
"scanComplete": true,
"clean": false,
"reportDigest": "5ce60abdd362620ecc05eae0ee6d79eedbf57c05eaf741a9541ce53e13ebed6f"
}
```

Finding counts by category (from the full compiler+scanner report, 10383 lines):
- shellcheck errors: 72 (1 root cause, 18 files)
- actionlint expression errors: 2
- zizmor: 34 Critical, 221 High, 758 Medium, 374 Low, 306 Informational, 18 Unknown severity findings (1461 total)
- grype container CVEs: dozens of Critical/High across 9 scanned images (`alpine:latest`, `gh-aw-firewall/agent`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `gh-aw-firewall/cli-proxy`, `github-mcp-server`, `node:lts-alpine`)
- runner-guard/poutine: 1 medium warning (RGS-005 excessive permissions on untrusted trigger, `agentic_commands.yml`)

Git status after the deterministic run showed only an untracked `.poutine.yml` (scanner config artifact, no source diff).

Control plane context

- Correlation ID: `34743653024-8`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34743653024`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34743653024) · copilot · auto · 46.5 AIC · ⌖ 9.11 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 7:09 AM UTC

Start with the referenced .github/workflows/*.md sources and the shared shell snippet source, not generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, then inspect the listed actionlint, shellcheck, runner-guard, and image findings. Done means the full compiler and security scan passes, or remaining findings are explicitly explained as accepted risks.

Written by the indexing model from the issue text.