[cao-evolution:compiler-security] gh-aw compiler: 2 expression errors, RGS-005 permissions warning, 34 critical container CVEs

Compiling all 52 gh-aw workflows in `githubnext/gh-aw-cao` (target SHA `0d820ba`) exited with code 1: actionlint reported 72 shellcheck findings plus 2 GitHub-Actions expression errors, zizmor flagged 649 Low/Informational items, runner-guard flagged one Medium excessive-permissions warning, and the container scan found 34 Critical and 152 High CVEs plus widespread `grant` license-policy violations across 9 base images (alpine, gh-aw-firewall agent/api-proxy/cli-proxy/squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, node:lts-alpine). No workflow-source vulnerability (e.g. injection) was found; the highest-return, safely-fixable items are the 2 actionlint expression errors (invalid `safe-outputs-app-token` property reference) and the RGS-005 excessive-permissions warning in `agentic_commands.yml`. The container CVE/license findings stem from upstream base images and are tracked for awareness, not source-level remediation here.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `52`
- **Generated lock files checked**: `52`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2359 | error | `safe-outputs-app-token` not defined in `needs.*.outputs` type | Fix source `.md` to reference a valid `needs` output/step output instead of the undefined property |
| actionlint (expression) | self-care-pages-health.lock.yml:2265 | error | same undefined `safe-outputs-app-token` property | Same fix as above |
| actionlint (shellcheck) | 18 lock files (dashboard-authoring-corpus, eu-cra-compliance*, self-care-accessibility-checker, self-care-docs-build-time-investigator, self-care-open-source-failures, software-development-practices*, uk-ai-advisory*) | error (info-level shellcheck SC1003) | `echo 'This is how it'\''s done'` example string triggers "want to escape a single quote" | Cosmetic; escape or reword the embedded example string in the shared source snippet used by these workflows |
| runner-guard | agentic_commands.yml (RGS-005) | Medium | Job has write-level `permissions:` while triggered by an untrusted event type; amplifies impact of any injection | Scope permissions to least privilege for the untrusted-trigger job, or restrict trigger conditions |
| zizmor | 52 lock files | Informational/Low | 649 total findings: `secrets-outside-env` (440), `anonymous-definition` (308), `undocumented-permissions` (304), `github-app` (50), `artipacked` (31), `adhoc-packages` (25), `template-injection` (9, Informational), `obfuscation` (3, Low) | All Low/Informational; no action required for this pass |
| grype | alpine:latest, gh-aw-mcpg, node:lts-alpine, gh-aw-firewall/squid | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3/openssl 3.5.7-r0) | Bump base image tag once upstream Alpine publishes 3.5.8-r0 packages |
| grype | gh-aw-firewall/api-proxy, cli-proxy, squid | Critical | CVE-2026-18924, CVE-2026-19931 (curl/libcurl 8.21.0-r0) | Bump base image tag once upstream fix (8.22.0-r0) is published |
| grype | github-mcp-server:v1.12.1 | Critical | CVE-2026-5450 (libc6), CVE-2026-75803 (libssl3, Debian base) | Update to a newer `github-mcp-server` release built on a patched base image |
| grype | gh-aw-firewall/agent, all images | High | GHSA-rgw5-rvv9-x895 (`brace-expansion` npm dep), plus 152 High CVEs across bind9-libs, curl, various packages | Track upstream image updates; not fixable via this repo's workflow sources |
| grant | 9 container images | error (license policy) | Hundreds of GPL-2.0/LGPL/MPL/Apache-licensed base-image and npm packages flagged against configured license policy | Review/adjust `grant` license policy allowlist if these transitive dependencies are acceptable; not a workflow-source defect |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Priority fixes: (1) the two `actionlint` expression errors referencing the undefined `safe-outputs-app-token` property in `self-care-dashboard-performance.md` and `self-care-pages-health.md`; (2) the RGS-005 runner-guard excessive-permissions warning on the untrusted-trigger job in `agentic_commands.md`; (3) the SC1003 shellcheck quoting warning in the shared example snippet used by 18 workflow lock files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Container-image CVE and license findings are upstream base-image issues outside source control; do not attempt to patch them, just note them if still present. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 52
Compiled locks: 52
```

Git status after compile (uncommitted lock/source drift observed during scan, not part of findings above):
```
M .github/workflows/agentic-auto-upgrade.yml
M .github/workflows/agentic_commands.yml
?? .poutine.yml
```

Full report is 10,733 lines; representative excerpts are included in the findings table above. Severity counts:
- actionlint: 2 expression errors, 72 shellcheck errors (18 files)
- zizmor: 317 Informational, 332 Low (649 total)
- runner-guard: 1 Medium
- grype: 34 Critical, 152 High, 304 Medium, 54 Low, 27 Negligible, 17 Unknown (across 9 images)
- grant: license policy violations flagged across all 9 images (GPL-2.0, LGPL, MPL-2.0, Apache-2.0, and others vs. configured policy)

No token-like or credential-like values were present in the tool output.

Control plane context

- Correlation ID: `34771760950-18`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34771760950`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34771760950) · copilot · auto · 47.5 AIC · ⌖ 9.36 AIC · ⊞ 12.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 5:49 PM UTC

Start with .github/workflows/self-care-dashboard-performance.md, self-care-pages-health.md, agentic_commands.md, and the shared example snippet used by the 18 affected workflows. Run the gh-aw MCP server's fix and compile tools, then review generated lock-file diffs and the full listed security scan. Done means the two actionlint errors, RGS-005 warning, and SC1003 findings are safely addressed while upstream container findings are only documented.

Written by the indexing model from the issue text.