[cao-evolution:compiler-security] gh-aw compiler & security scan findings: githubnext/gh-aw-cao (50 workflows, exit code 1)

Compiled all 50 gh-aw workflow sources in `githubnext/gh-aw-cao` (50 generated lock files) with the full validation, lint, container, and security-scanner suite. Compiler exit code: **1** (findings, not clean). Highest-severity supported finding: **Critical** CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in OpenSSL `libcrypto3`/`libssl3`) in multiple base container images, plus 49 **High** zizmor `github-app` findings (dangerous use of GitHub App tokens) across 39 workflow lock files. `grant` license scanning failed outright (1250 policy violations, largely GPL/LGPL packages baked into stock base images). Recommended next action: assign the fix to Copilot using the compiler's `fix`/`compile` tools so it addresses the actionlint/zizmor/runner-guard findings in workflow sources, and separately confirm whether the `grant`/`grype` container-image policy needs threshold tuning vs. real remediation (these largely stem from third-party base images, not repository code).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `50`
- **Generated lock files checked**: `50`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 20 `.lock.yml` files, "Execute Pi CLI" step | unknown | SC1003: unescaped single quote in example string (`echo 'This is how it'\''s done'`) inside embedded Pi CLI heredoc script — 72 occurrences | Escape or rephrase the example string in the shared Pi CLI prompt/script source so shellcheck doesn't flag it |
| actionlint (expression) | `self-care-dashboard-performance.md`, `self-care-pages-health.md` | error | Property `safe-outputs-app-token` not defined in `needs.*.outputs` type used in an `if:` expression | Fix the expression/step-output reference so it matches the actual job output schema |
| zizmor | 39 `.lock.yml` files (e.g. `cao-evolution*.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care*.lock.yml`) | High | `github-app`: dangerous use of `actions/create-github-app-token@bcd2ba4...` (v3.2.0) GitHub App token generation step | Review token scoping/exposure per zizmor's github-app audit guidance; ensure the generated token isn't leaked to untrusted steps |
| zizmor | many `.lock.yml` files, `activation`/other jobs | Medium | `secrets-outside-env` (414 occurrences): secrets referenced without a dedicated `environment:` | Add a dedicated `environment:` to jobs referencing secrets, or restructure to route secrets through env context |
| zizmor | e.g. `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml` | Medium | `artipacked` (31 occurrences): checkout persists credentials that could leak into uploaded artifacts | Set `persist-credentials: false` on checkout steps that precede artifact upload, or scope the token narrowly |
| zizmor | many `.lock.yml` files | Low | `undocumented-permissions` (292), `adhoc-packages` (25), `obfuscation` (3) | Add explanatory comments to `permissions:` blocks; pin ad-hoc `npm install -g` versions via lockfile/manifest; avoid empty-string obfuscated expressions like `${{ '' }}` |
| zizmor | many `.lock.yml` files | Informational | `anonymous-definition` (297), `template-injection` (9, e.g. `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`) | Name workflow/job definitions; review template-injection audit guidance for MCP Gateway step env expansion |
| runner-guard (poutine) | `.github/workflows/agentic_commands.yml` | medium (RGS-005) | Job has write-level permissions while triggered by an event that can be initiated by external users (excessive permissions on untrusted trigger) | Restrict permissions to read-only or gate write access behind trusted-actor checks for this trigger type |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-firewall/{agent,squid,api-proxy,cli-proxy}:0.28.15`, `ghcr.io/github/github-mcp-server:v1.12.1`, `ghcr.io/github/gh-aw-node` | Critical/High | Numerous CVEs, notably OpenSSL `libcrypto3`/`libssl3` (CVE-2026-63073, CVE-2026-75803 = Critical; CVE-2026-18798, CVE-2026-63076, CVE-2026-14457/14456, CVE-2026-63072, CVE-2026-54874, CVE-2026-63075 = High) in Alpine-based images, plus `brace-expansion@5.0.7` (GHSA-rgw5-rvv9-x895, High) and `ip-address@10.2.0` (GHSA-mwp4-54f8-5fhr, High) in Node-based images | Rebuild/refresh base images (Alpine `libcrypto3`/`libssl3` fix: 3.5.8-r0) and bump vulnerable npm deps (`brace-expansion` ≥5.0.9, `ip-address` ≥10.3.1) in the gh-aw firewall/mcpg/node container images |
| grant | 9 container images | error (policy) | 1250 license policy violations, predominantly GPL-2.0-only/LGPL packages present in stock base images (e.g. `alpine-baselayout`, `busybox`, `apk-tools`, `bind9-libs`) | Confirm whether the grant license allow-list should include common base-image system packages (GPL/LGPL for OS components is typically expected); if intentional, tune policy config rather than remove packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 50
Compiled locks: 50

Actionlint Summary
✓ Checked 50 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2

Zizmor: 1121 findings — 49 High, 445 Medium, 320 Low, 306 Informational
github-app: 49 | secrets-outside-env: 414 | artipacked: 31
undocumented-permissions: 292 | adhoc-packages: 25 | obfuscation: 3
anonymous-definition: 297 | template-injection: 9

Poutine/runner-guard: 1 finding
agentic_commands.yml — RGS-005 Excessive Permissions on Untrusted Trigger (medium)

Syft: SBOM generated for 9 container images (no errors)

Grype: vulnerabilities found across all 9 scanned images, including
Critical: CVE-2026-63073, CVE-2026-75803 (libcrypto3/libssl3, alpine & node:lts-alpine bases)
High: CVE-2026-18798, CVE-2026-63076, CVE-2026-14456/14457, CVE-2026-63072/63075,
CVE-2026-54874, GHSA-rgw5-rvv9-x895 (brace-expansion), GHSA-mwp4-54f8-5fhr (ip-address)

Grant license scanner:
✗ grant failed — strict mode: 1250 license policy finding(s) in container images
```

Full raw report (10,383 lines / ~741 KB) is retained in the run's job artifacts/logs for this workflow (run ID 34745521008) and was not reproduced in full here; the counts above were computed directly from that report.

Control plane context

- Correlation ID: `34745521008-9`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34745521008`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34745521008) · copilot · auto · 65.7 AIC · ⌖ 9.05 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 7:54 AM UTC

Start with the `.github/workflows/*.md` sources, especially the shared Pi CLI prompt, `self-care-dashboard-performance.md`, `self-care-pages-health.md`, and `.github/workflows/agentic_commands.yml`; do not edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, then rerun the full validation and security suite. Done means the reported findings are resolved and the compiler passes, or unresolved policy and third-party image findings are clearly explained.

Written by the indexing model from the issue text.