[cao-evolution:compiler-security] gh-aw compiler security scan: grant license-policy failure + zizmor/grype/actionlint findings

Compiled all 53 gh-aw workflow sources in `githubnext/gh-aw-cao` (`354338336ac847ef4600e9b577161268ea877838`) with the full validation, lint, container, and security-scanner suite. The compiler exited non-zero (exit code 1) because **grant's strict license-policy check failed with 1250 findings** across the 9 scanned container images (mostly copyleft/GPL packages in base OS layers, e.g. `alpine`, `node:lts-alpine`). Beyond that hard failure, scanners also found: 74 actionlint issues (72 shellcheck, 2 expression), 867 zizmor findings (highest: 52 High `github-app` token-handling warnings), 1 runner-guard Medium finding, and 600 grype CVEs across the 9 images (5 unique Critical, plus many High). Highest-severity supported finding: **High** (zizmor `github-app`, grype Critical/High CVEs); the build-breaking issue is the grant license-policy failure.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | 53 lock files (72 occurrences, shared Pi CLI install script) | unknown (reported as actionlint error) | shellcheck SC1003: unescaped single quote in `echo 'This is how it'\''s done'` sample text embedded in the Pi CLI install step | Fix quoting in the shared script source that generates this step |
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | unknown (reported as actionlint error) | expression: property `safe-outputs-app-token` not defined on referenced step-outputs object | Fix the workflow-source expression/output reference and recompile |
| zizmor | multiple workflows (52 findings, e.g. `uk-ai-advisory*.md`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Scope/restrict the App token's permissions and audience per zizmor guidance |
| zizmor | multiple workflows (444 findings) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into an `environment:` block |
| zizmor | multiple workflows (33 findings) | Medium | `artipacked`: checkout steps risk persisting credentials in the workspace | Set `persist-credentials: false` on `actions/checkout` steps |
| zizmor | multiple workflows (310 findings) | Low | `undocumented-permissions`: `permissions:` blocks lack justification comments | Add explanatory comments for granted permissions |
| zizmor | multiple workflows (25 findings) | Low | `adhoc-packages`: ad-hoc package installs in run steps (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/manage dependency installation through a controlled step |
| zizmor | 3 findings | Low | `obfuscation` | Review flagged expressions for obfuscated content |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: job grants write-level `permissions:` while triggered by an event reachable by untrusted/external actors | Reduce granted permissions or restrict the trigger for this job |
| poutine | — | none | No findings reported | none |
| grype | 9 container images (600 CVEs; 5 unique Critical, ~172 High occurrences) | Critical/High | Vulnerable packages in base/tool images — e.g. `alpine` `libssl3`/`libcrypto3` (CVE-2026-63073, CVE-2026-75803), plus CVEs in `gh-aw-firewall`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | Bump pinned base image digests/tags to versions with available fixes |
| grant | 9 container images (1250 findings — **this is the compiler's hard failure**) | unknown (policy violation, no tool severity) | Strict license policy flags copyleft/other licenses in OS packages (e.g. `busybox`, `apk-tools`, `alpine-baselayout` under GPL-2.0-only; `readline-common` under GPL-3.0-or-later) bundled in scanned images | Either replace/rebuild images to exclude flagged packages, or adjust the grant license allowlist/policy if these licenses are acceptable for these images |

Working tree also showed uncommitted local changes at scan time (from the deterministic compile step, not evaluated as findings):
```
M .github/workflows/agentic-auto-upgrade.yml
M .github/workflows/agentic_commands.yml
?? .poutine.yml
```
with a 4-line net deletion diff across the two `.yml` files.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Priority order: (1) resolve the grant license-policy failure that is blocking compilation (either replace flagged base-image packages or confirm/adjust the license policy with a human), (2) fix the two actionlint expression errors referencing `safe-outputs-app-token`, (3) address the High-severity zizmor `github-app` findings, (4) update pinned container image digests to remediate Critical/High grype CVEs, (5) address remaining Medium/Low zizmor and runner-guard findings, (6) fix the shellcheck SC1003 quoting issue in the shared Pi CLI install script.

Raw evidence

Summary counts extracted from the scanner report (`report.txt`, 10,876 lines; no token-like values found in the excerpted output):

- Actionlint: 74 issues (72 shellcheck, 2 expression) across 53 checked workflows.
- Zizmor: 867 total findings — 52 High (`github-app`), 444 Medium (`secrets-outside-env`), 33 Medium (`artipacked`), 310 Low (`undocumented-permissions`), 25 Low (`adhoc-packages`), 3 Low (`obfuscation`).
- Runner-guard: 1 Medium finding (RGS-005) in `agentic_commands.yml`.
- Poutine: no findings.
- Syft: 9 container images scanned, SBOMs generated (alpine, gh-aw-firewall/agent, gh-aw-firewall/api-proxy, gh-aw-firewall/squid, gh-aw-mcpg, gh-aw-node, gh-aw-firewall/cli-proxy, github-mcp-server, node:lts-alpine).
- Grype: 600 CVE occurrences across the 9 images — 34 Critical occurrences (5 unique CVEs), 172 High, 313 Medium, 54 Low, 27 Negligible.
- Grant: 1250 license policy violations across the 9 images (strict mode) — this is what set the compiler's exit code to 1 (`✗ grant failed`).

Control plane context

- Correlation ID: `34777593236-64`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34777593236`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34777912429) · copilot · auto · 41.9 AIC · ⌖ 10.8 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 7:50 PM UTC

Start with the .github/workflows/*.md sources and the gh-aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Recompile the 53 workflows with the listed validation and security scanners, then review the generated lock-file diffs. Done means the full compiler and scanner suite passes, or a human-actionable blocker such as the grant policy is clearly documented.

Written by the indexing model from the issue text.