[cao-evolution:compiler-security] Compiler and security scan findings for githubnext/gh-aw-cao (53 workflows, exit code 1)

`githubnext/gh-aw-cao` compiled all 53 workflow sources (53 lock files) but the full validation/lint/container/security suite failed (compiler exit code 1). Findings by category: 2 actionlint expression errors (undefined `safe-outputs-app-token` property), 72 shellcheck informational notes, 52 zizmor High findings (dangerous GitHub App token usage) across 42 workflows plus 448 Medium/309 Low/313 Informational lower-severity zizmor findings, 1 Medium poutine/runner-guard finding (excessive permissions on untrusted trigger), 34 Critical + 224 High + 793 Medium container vulnerabilities (grype) across 9 images, and 1,246 license policy violations (grant, strict mode failed) across all 9 scanned images. Highest-severity supported finding: **Critical** — multiple Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803) in base container images. Recommended next action: assign remediation to Copilot per the agent prompt below, prioritizing the 2 real compiler errors and the container/base-image updates.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Property `safe-outputs-app-token` not defined in the referenced step-outputs object type (2 occurrences) | Fix the `.md` source's expression to reference a valid step output; recompile |
| actionlint (shellcheck, SC1003) | 20 lock files, "Execute Pi CLI" step | info | Unescaped single quote inside example string in shared script (72 occurrences, cosmetic) | Escape the quote in the shared script template source, not the generated lock file |
| actionlint (shellcheck, SC2034) | multiple `graders/*-operational-value.sh` | warning | Unused variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`/`FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) | Export or use the variables, or add `# shellcheck disable=SC2034` with rationale in the shared grader template |
| zizmor | 42 workflows (e.g. `cao-evolution.lock.yml`, `dependabot.lock.yml`, `eu-cra-compliance*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` (52 occurrences) | Review token scope/lifetime handling per zizmor's `github-app` guidance; confirm least-privilege usage is intentional |
| zizmor | most workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` (448 occurrences) | Move secret-consuming steps into a job `environment:` block |
| zizmor | ~9 workflows (e.g. `dashboard-authoring-corpus.lock.yml`, `design-decision-gate.lock.yml`) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts (33 occurrences) | Avoid persisting credentials in uploaded artifacts; scrub or exclude sensitive paths |
| zizmor | most workflows | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments (309 occurrences) | Add comments explaining each granted permission |
| zizmor | most workflows | Informational | `anonymous-definition`: workflow/job definitions without a `name:` (313 occurrences) | Add descriptive `name:` fields |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, others | Informational | `template-injection`: code injection via template expansion (9 occurrences) | Review flagged expressions for untrusted input interpolation |
| zizmor | `dashboard-authoring-corpus.lock.yml` and 1 other | Low | `adhoc-packages`: ad-hoc package installation (25 occurrences) | Pin package installs via lockfile/manifest where feasible |
| zizmor | few workflows | Low | `obfuscation` (3 occurrences) | Review flagged obfuscated expressions |
| poutine / runner-guard | `agentic_commands.yml` | Medium | `RGS-005`: excessive write permissions combined with an untrusted-trigger event (`pull_request_target`/`issue_comment`-style) | Scope `permissions:` to read-only or move privileged steps to a trusted-trigger workflow |
| grype | `alpine`, `node:lts-alpine` | Critical/High | Multiple Critical (e.g. CVE-2026-63073, CVE-2026-75803) and High CVEs in `libssl3`/`libcrypto3` (fix: 3.5.8-r0) | Bump base image tag / rebuild to pick up patched packages |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.16` and other firewall images | High | `GHSA-rgw5-rvv9-x895`, `GHSA-mh99-v99m-4gvg` (brace-expansion), `GHSA-r292-9mhp-454m` (tar), `GHSA-mwp4-54f8-5fhr` (ip-address), plus many Medium bind9/curl/python CVEs | Update pinned firewall/MCP image digests to newer patched releases |
| grype | `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/github-mcp-server`, other images | High/Medium | Additional CVEs (34 Critical / 224 High / 793 Medium / 391 Low / 27 Negligible total across 9 images) | Same as above — track upstream image updates |
| grant | all 9 scanned container images | error (strict mode) | 1,246 license policy violations (e.g. GPL-2.0-only, LGPL, GPL-2.0-or-later packages in `alpine`, `node:lts-alpine`, firewall images) | Review `.poutine.yml`/grant policy for accepted licenses, or replace/rebuild images with policy-compliant packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler run summary (from `summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
• shellcheck: 72
• expression: 2
```

Grant (license scanner) summary:
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

Untracked file at scan time (`git-status.txt`): `?? .poutine.yml` (no other working-tree changes).

Full raw report (~10,900 lines) is retained in the workflow's evidence directory (`/tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt`) and is not reproduced in full here; the table above is a deduplicated summary of every distinct finding category observed. No token-like or credential-like values were present in the tool output.

Control plane context

- Correlation ID: `34780792693-65`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34780792693

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34781076532) · copilot · auto · 57.4 AIC · ⌖ 10.6 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 8:53 PM UTC

Start with the two .md workflow sources named by actionlint and review the related .github/workflows/*.md files, generated locks, and .poutine.yml. Run the gh-aw compile and full validation/security scan, then verify the 2 expression errors and container findings are addressed without editing generated .lock.yml files; done means the strict suite passes.

Written by the indexing model from the issue text.