[cao-evolution:compiler-security] Compiler and security scan findings: 74 lint issues, 50 High zizmor, 536 grype CVEs (34 Critical), 1246 license violations

Compiler run for `githubnext/gh-aw-cao` exited with code 1 across all 53 workflow sources (53 generated lock files). Findings span actionlint/shellcheck (74), zizmor (50 High `github-app` token issues plus hundreds of Medium/Low/Informational), runner-guard (1 Medium excessive-permissions-on-untrusted-trigger), grype (536 container vulnerabilities incl. 34 Critical / 172 High), and grant (1,246 license-policy violations across all 9 scanned container images). Highest-severity supported finding: **Critical** CVEs (e.g. CVE-2026-63073 in `libssl3`/`libcrypto3`) in the `alpine:latest`, `gh-aw-firewall/agent`, and other base images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml`, +others (72 total) | error (SC1003) | Unescaped single quote in embedded shell script (`echo 'This is how it'\''s done'`) | Fix quoting in the source `.md` step scripts, then recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in referenced job-outputs object type | Correct the expression/output name in the workflow source |
| zizmor | 39 workflow lock files (e.g. `cao-evolution*.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care*.lock.yml`, `optimization*.lock.yml`, `dependabot*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/exposure per zizmor guidance; restrict where the minted token is used |
| zizmor | widespread | Medium (414) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a job `environment:` block where feasible |
| zizmor | widespread | Medium (31) | `artipacked`: credential persistence via `actions/checkout` + artifact upload combo (e.g. `uk-ai-advisory-package-maintainer.lock.yml`) | Set `persist-credentials: false` unless required |
| zizmor | widespread | Low/Informational (624 combined) | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `template-injection`, `obfuscation` | Lower priority; add permission comments, job `name:`, pin package installs |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` on a job reachable from an untrusted trigger | Confirm command-trigger jobs do not carry unnecessary write scopes |
| grype | `alpine:latest`, `gh-aw-firewall/agent:0.28.16` (313 findings), `gh-aw-mcpg:v0.4.21` (84), `gh-aw-firewall/squid:0.28.16` (54), `cli-proxy`/`api-proxy:0.28.16` (33 each), `node:lts-alpine` (32), `github-mcp-server:v1.12.1` (27) | Critical (34), High (172), Medium (312), Low (54), Negligible (27), Unknown (18) | 536 total CVEs, incl. Critical `libssl3`/`libcrypto3` CVE-2026-63073 in `alpine:latest` | Bump base images / packages to patched versions (e.g. `libssl3`/`libcrypto3` → `3.5.8-r0`); rerun grype |
| grant | all 9 scanned images | error | 1,246 license-policy violations (GPL-2.0/3.0, LGPL, MPL-2.0, etc. flagged by current policy) | Review `.poutine.yml`/grant policy allowlist against actual license posture; adjust policy or replace flagged packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary counts extracted from the deterministic compiler/scanner run:

- Actionlint: 74 issues (72 shellcheck, 2 expression) across 53 checked workflows
- Zizmor: 481 findings total — 50 High (`github-app`), 414 Medium (`secrets-outside-env`) + 31 Medium (`artipacked`), 299 Low (`undocumented-permissions`) + 22 Low (`adhoc-packages`) + 3 Low (`obfuscation`), 303 Informational (`anonymous-definition`) + 9 Informational (`template-injection`)
- Runner-guard: 1 Medium (RGS-005) in `agentic_commands.yml`
- Grype: 536 total across 9 images — 34 Critical, 172 High, 312 Medium, 54 Low, 27 Negligible, 18 Unknown
- Grant: 1,246 license-policy violations across all 9 scanned images (`alpine:latest`, `gh-aw-firewall/agent:0.28.16`, `gh-aw-firewall/api-proxy:0.28.16`, `gh-aw-firewall/cli-proxy:0.28.16`, `gh-aw-firewall/squid:0.28.16`, `gh-aw-mcpg:v0.4.21`, `gh-aw-node`, `github-mcp-server:v1.12.1`, `node:lts-alpine`)
- Git status during scan: `?? .poutine.yml` (untracked policy file present in the scan workspace)

No token-like or credential-like values were present in the raw tool output requiring redaction.

Control plane context

- Correlation ID: `34783753713-66`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34783753713`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34783962302) · copilot · auto · 53.8 AIC · ⌖ 9.44 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 9:47 PM UTC

Start with the `.github/workflows/*.md` sources, especially `agentic_commands.yml`, and review the compiler output before using the gh-aw MCP server’s `fix` and `compile` tools. Do not edit generated `.lock.yml` files. Done means the source and related policy files such as `.poutine.yml` produce clean results from the full compiler, actionlint, shellcheck, zizmor, runner-guard, grant, grype, and syft scans.

Written by the indexing model from the issue text.