[cao-evolution:compiler-security] AW compiler + security scan findings for githubnext/gh-aw-cao (34 Critical CVEs, 1246 license violations, compiler errors)

Compiling all 53 gh-aw workflows in `githubnext/gh-aw-cao` succeeded structurally, but the compiler's full validation/lint/scanner suite exited with code 1: 2 expression-type errors, 72 shellcheck errors (in generated `.lock.yml` scripts), 1442 zizmor findings (34 Critical, 224 High, 391 Low, 793 Medium — mostly `undocumented-permissions`/`github-app` and one `RGS-005` excessive-permissions-on-untrusted-trigger from runner-guard), 34 grype Critical/High CVEs across 9 container images (curl/libcrypto/libssl in `gh-aw-firewall/*`, `gh-aw-mcpg`, `alpine`, `node`, `github-mcp-server`), and 1246 grant license-policy violations (GPL/LGPL packages) across the same images. Highest severity: **Critical** — grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931) in base/proxy images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| gh-aw compiler (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step output referenced but not defined in step-outputs object type | Fix step-id reference / output name in the source `.md` and recompile |
| shellcheck (SC1003) | 18 lock files (dashboard-authoring-corpus, eu-cra-compliance*, self-care-*, software-development-practices*, uk-ai-advisory*) | error (info-level shellcheck rule elevated) | Unescaped single quote in shared example script `echo 'This is how it'\''s done'` | Escape the quote in the shared script template that generates these lock files, then recompile all affected sources |
| shellcheck (SC2034) | generated inline script | warning | Several env vars (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `OPERATIONAL_VALUE`, etc.) appear unused | Remove or use the declared vars in the shared script template |
| zizmor (`github-app`) | ~52 lock files | High | Dangerous use of GitHub App tokens | Review App-token usage pattern in shared safe-outputs workflow template per zizmor guidance |
| zizmor (`undocumented-permissions`) | ~309 findings across lock files | Low | `permissions:` blocks without explanatory comments | Add comments to job-level `permissions:` blocks in shared workflow templates |
| runner-guard (RGS-005) | `agentic_commands.yml` | Medium | Job grants write-level permissions while triggered by an event that can be initiated by external users | Restrict permissions or trigger scope for this job |
| grype | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/github-mcp-server`, `node` | Critical/High | 34 Critical + many High CVEs, notably CVE-2026-63073/-75803 (libcrypto3/libssl3), CVE-2026-18924/-19931 (curl/libcurl), CVE-2026-5450 (github-mcp-server) | Bump base images/packages to patched versions (e.g. openssl 3.5.8-r0, curl 8.22.0-r0) and rebuild published container images |
| grant (license) | Same 9 images | error (strict mode) | 1246 license-policy violations (GPL-2.0/3.0, LGPL, etc. packages bundled in Alpine-based images) | Review and update the license allow-list policy, or replace/rebuild images to exclude disallowed-license packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Category counts from `report.txt` (767 KB, 10885 lines):
- Compiler `error:` lines: 1578 total (72 shellcheck, 2 expression-type)
- zizmor: 34 Critical, 224 High, 391 Medium/Low mix (Low undocumented-permissions: 309 occurrences)
- runner-guard: 1 medium finding (RGS-005)
- grype: 34 unique Critical CVE/image pairs, hundreds of High findings across `alpine`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/github-mcp-server`, `node`
- grant: 1246 license-policy violations across the same 9 images; grant exited with `grant found 1246 license policy finding(s) in container images`

`git-status.txt` shows only an untracked `.poutine.yml` (scanner config artifact, not a source change) and no diff.

Control plane context

- Correlation ID: `34789827800-23`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34789827800`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34789827800) · copilot · auto · 41.6 AIC · ⌖ 7.95 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 27, 2026, 11:49 PM UTC

Start with the `.github/workflows/*.md` sources and the compiler report described in `report.txt`; do not edit generated `.lock.yml` files. Run `gh aw mcp-server` from `githubnext/gh-aw-cao`, then compile the 53 workflows with the listed validation and security scanners. Done means the compiler, workflow checks, image scans, and license checks pass, or an unsafe finding is clearly explained.

Written by the indexing model from the issue text.