[cao-evolution:compiler-security] gh-aw compiler and security scan findings: 34 Critical CVEs, 50 High github-app findings, 1250 license violations

The compiler run against `githubnext/gh-aw-cao` exited with code 1 (findings, not clean). Across 51 compiled workflows: actionlint reported 74 issues (72 shellcheck, 2 expression-type errors); zizmor flagged 50 High `github-app` token findings plus 449 Medium warnings (`secrets-outside-env`, `artipacked`); poutine/runner-guard flagged 1 Medium excessive-permissions finding on `agentic_commands.yml`; grype found 198 unique CVEs across 9 container images (34 Critical, 172 High); grant reported 1250 license-policy violations across those same images. Highest severity: **Critical** (grype CVEs, e.g. alpine `libssl3`/`libcrypto3`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | 20 `.lock.yml` files (e.g. `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care-*.lock.yml`) | error (SC1003) | Unescaped single quote in embedded "Execute Pi CLI" example script (`echo 'This is how it's done'`) | Escape the quote in the shared script source that generates this step |
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `property "safe-outputs-app-token" is not defined` in `GIT_TOKEN` expression | Fix step-output reference for `safe-outputs-app-token` in the workflow source |
| zizmor | 41 `.lock.yml` files (e.g. `cao-evolution*.lock.yml`, `dependabot*.lock.yml`, `eu-cra-compliance*.lock.yml`, `optimization*.lock.yml`, `self-care*.lock.yml`, `software-development-practices*.lock.yml`, `uk-ai-advisory*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review app-token scoping/usage per zizmor's `github-app` guidance |
| zizmor | all 51 `.lock.yml` files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (418 occurrences) | Move secret references into job `environment:` blocks where applicable |
| zizmor | 17 `.lock.yml` files (e.g. `dashboard-authoring-corpus.lock.yml`, `self-care-*.lock.yml`, `uk-ai-advisory-package-maintainer.lock.yml`) | Medium | `artipacked`: credential persistence / artifact packing risk (31 occurrences) | Follow zizmor's `artipacked` remediation (avoid persisting credentials in uploaded artifacts) |
| poutine/runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level permissions combined with an externally-triggerable event | Reduce permissions or restrict trigger scope per RGS-005 guidance |
| grype | `alpine:latest` | Critical/High | 23 CVEs (`libssl3`, `libcrypto3`) incl. CVE-2026-63073, CVE-2026-75803 (Critical) | Bump base image / packages to fixed versions (e.g. `libssl3@3.5.8-r0`) |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.15` | High | 313 CVEs incl. `brace-expansion` GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg | Update pinned image tag/digest to a patched release |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.20` | Critical/High | 84 CVEs | Update pinned image tag/digest to a patched release |
| grype | `ghcr.io/github/gh-aw-firewall/squid`, `api-proxy`, `cli-proxy`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | Critical/High | Remaining 176 CVEs across these 6 images | Update pinned image tags/digests to patched releases |
| grant | 9 container images | error | 1250 license-policy violations (dominant: ISC 365, MIT 285, Apache-2.0 69, GPL-2.0-only 62, BlueOak-1.0.0 55) | Review `grant` policy allow-list vs. actual dependency licenses; adjust policy or dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 51
Compiled locks: 51
```

Actionlint summary:
```
✓ Checked 51 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

Zizmor summary: 50 High (`github-app`), 418 Medium (`secrets-outside-env`), 31 Medium (`artipacked`).

Grype summary: 198 unique CVEs, 34 Critical, 172 High, 313 Medium, 18 Unknown, across images: `alpine:latest`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.15`, `ghcr.io/github/gh-aw-mcpg:v0.4.20`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`.

Grant summary: `grant found 1250 license policy finding(s) in container images` (strict mode failure).

Untracked/uncommitted diffs in the compiler working tree at scan time (informational only, not part of scanned findings):
```
M .github/workflows/agentic-auto-upgrade.yml
M .github/workflows/agentic_commands.yml
?? .poutine.yml
```

Full raw report available in workflow run artifacts (748 KB, 10502 lines) — not reproduced here in full; redacted for length. No token-like or credential-like values were observed in the excerpted output.

Control plane context

- Correlation ID: `34768942797-17`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34768942797`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34768942797) · copilot · auto · 56.1 AIC · ⌖ 8.16 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 4:55 PM UTC

Start with the 51 workflow sources under .github/workflows/*.md, not generated .lock.yml files, and use gh aw mcp-server's fix and compile tools. Review the generated lock diffs and rerun the listed validation and security scans. Done means the compiler exits cleanly and all required checks pass.

Written by the indexing model from the issue text.