[cao-evolution:compiler-security] gh-aw compiler & security scan findings: 74 actionlint, 50 zizmor High, 5 unique Critical CVEs, license-policy violations

The gh-aw compiler ran clean (all 51 workflow sources compiled to 51 lock files), but its full validation and security-scanner suite exited non-zero with 74 actionlint findings (72 shellcheck, 2 expression), 6 zizmor rule categories (including 50 High "github-app" findings across 41 workflows), 619 grype container-image CVE findings (5 unique Critical, ~30 unique High/GHSA advisories across 9 images), and grant reporting 1,250 container-image license-policy violations (mostly GPL/LGPL/ISC/MIT packages flagged as policy violations, likely a scan-scope or policy-config issue rather than a real licensing defect in this repo's own code). Highest-severity supported finding: zizmor `github-app` (High) — dangerous GitHub App token usage pattern repeated in 41 workflow lock files. Recommended next action: assign to Copilot to fix the zizmor `github-app` pattern and the 2 actionlint expression errors first (highest local-risk, lowest-effort), then triage grype/grant findings (upstream base-image and third-party dependency issues, not fixable by editing workflow sources alone).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 18 workflows (e.g. `dashboard-authoring-corpus.lock.yml`) | error | SC1003: unescaped single quote in generated "Execute Pi CLI" step script (`echo 'This is how it'\''s done'`) | Fix quoting in the shared Pi CLI step source template so generated scripts pass shellcheck |
| actionlint (shellcheck) | multiple `graders/*.sh` scripts | warning | SC2034: variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) appear unused | Export or remove unused grader script variables |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step-outputs object type | Fix the workflow markdown source expression referencing this undefined output |
| zizmor | 41 workflows (e.g. `cao-evolution-catalog-advisor.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens | Review token-generation/consumption pattern against zizmor's `github-app` guidance |
| zizmor | 51 workflows | Medium | `secrets-outside-env` (418 occurrences): secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block |
| zizmor | subset of workflows | Medium | `artipacked` (31 occurrences): artifact/credential persistence risk | Review affected checkout/artifact steps per zizmor docs |
| zizmor | 51 workflows | Low | `undocumented-permissions` (298), `adhoc-packages` (25), `obfuscation` (3) | Document `permissions:` blocks; pin/verify ad-hoc package installs |
| zizmor | 51 workflows | Informational | `anonymous-definition` (303), `template-injection` (9) | Add workflow/job `name:` fields; review templated expressions |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job declares write permissions while triggered by an event that can be initiated by external users | Restrict permissions or trigger scope for this command-dispatch workflow |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-firewall/squid` | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3 3.5.7-r0, fix 3.5.8-r0) | Bump base image / OpenSSL package version |
| grype | `ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}`, `ghcr.io/github/gh-aw-node` | Critical | CVE-2026-18924, CVE-2026-19931 (curl/libcurl 8.21.0-r0) | Bump curl/libcurl package version in these images |
| grype | `ghcr.io/github/github-mcp-server` | Critical | CVE-2026-5450 (libc6 2.36-9+deb12u14) | Bump base image (Debian 12 glibc) |
| grype | `ghcr.io/github/gh-aw-firewall/agent`, `node:lts-alpine` | High | GHSA-r292-9mhp-454m (tar), GHSA-mh99-v99m-4gvg / GHSA-rgw5-rvv9-x895 (brace-expansion), GHSA-mwp4-54f8-5fhr (ip-address) | Update npm dependency versions bundled in these images |
| grype | `ghcr.io/github/gh-aw-mcpg` | High | GHSA-2v4p-qf9q-27wj, GHSA-hrxh-6v49-42gf, GHSA-vp52-pcj8-j9qc (google.golang.org/grpc), GHSA-f5mr-q85p-6hh6 (sigstore/fulcio), GHSA-hfg8-hc9c-6c3h (moby/go-archive) | Bump Go module dependencies and rebuild image |
| grant | 9 container images | error (strict) | 1,250 license-policy violations (mostly ISC/MIT/GPL/LGPL/BSD/Apache-2.0 packages in base OS/npm layers, e.g. `busybox`, `musl`, `libssl3`, `agent-base`) | Confirm `.grant.yaml` allow-list intentionally excludes these common OSS licenses, or expand the allowed-license list if the current policy is unintentionally strict for third-party base-image contents |

Unique CVE identifiers observed at Critical severity: `CVE-2026-63073`, `CVE-2026-75803`, `CVE-2026-18924`, `CVE-2026-19931`, `CVE-2026-5450`.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

Zizmor rule counts (unique findings across 51 lock files):
```
418 [Medium] secrets-outside-env
303 [Informational] anonymous-definition
298 [Low] undocumented-permissions
50 [High] github-app
31 [Medium] artipacked
25 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

Grype findings by severity (across 9 scanned images):
```
34 Critical
172 High
313 Medium
54 Low
27 Negligible
18 Unknown
```

Grant (license scanner): `strict mode: grant found 1250 license policy finding(s) in container images` — exit non-zero.

runner-guard: 1 finding — `agentic_commands.yml:1:1 [medium] RGS-005 Excessive Permissions on Untrusted Trigger`.

poutine: no findings reported in this run.

yamllint: no findings reported separately from actionlint/shellcheck section in this run.

No secret- or token-like values were present in the reviewed excerpts; none are reproduced here.

Control plane context

- Correlation ID: `34762857854-15`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34762857854`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34762857854) · copilot · auto · 68.7 AIC · ⌖ 7.99 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 2:48 PM UTC

Start with the `.github/workflows/*.md` sources, especially the sources generating `dashboard-authoring-corpus.lock.yml`, `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml`, and `agentic_commands.yml`; do not edit generated lock files. Run `gh aw mcp-server` and its compile workflow with the listed scanners, then address the reported source, token, permission, image, and license findings. Done means strict compilation and the full validation/security scan pass.

Written by the indexing model from the issue text.