[cao-evolution:compiler-security] AW Compiler Security findings in githubnext/gh-aw-cao: shellcheck/expression errors, 52 zizmor High github-app findings, Critica

Compiling all 53 gh-aw workflows in `githubnext/gh-aw-cao` (SHA `84779feb`) with the full validation, lint, container, and security-scanner suite exited with code `1`. Findings: 2 compiler validation errors, 74 actionlint issues (72 shellcheck, 2 expression), 1 poutine RGS-005 warning, 52 zizmor High findings (`github-app` token misuse pattern, repeated across workflows) plus lower-severity zizmor noise (448 secrets-outside-env, 313 anonymous-definition, 309 undocumented-permissions, 33 artipacked, 25 adhoc-packages), 34 Critical/172 High grype CVEs across 9 base container images, and 1246 grant license-policy violations (strict mode failure). Highest-severity supported finding: **Critical** CVE-2026-63073/CVE-2026-75803 (`libcrypto3`/`libssl3` in `alpine:latest`, fix available in 3.5.8-r0) and 52 **High** zizmor `github-app` dangerous-token-use findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | 20 `.lock.yml` files (e.g. `dashboard-authoring-corpus`, `eu-cra-compliance*`, `self-care-*`, `uk-ai-advisory*`) | error | SC1003: unescaped single quote in generated inline script (`echo 'This is how it'\''s done'`) | Fix quoting in the shared `.md` source that generates this script; regenerate locks |
| actionlint (typescript expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | property `safe-outputs-app-token` not defined on job outputs object | Fix the `.md` source's `if:`/output reference to the actual step outputs; regenerate locks |
| poutine (runner-guard RGS-005) | `agentic_commands.yml` | medium | Job with write-level permissions triggered by `pull_request_target`/`issue_comment`-class event | Reduce permissions or gate write scope behind explicit checks |
| zizmor | 42 `.lock.yml` files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review conditional app-token minting step; scope token permissions, follow zizmor guidance |
| zizmor | many `.lock.yml` files | Medium | `secrets-outside-env` (448), `artipacked` (33) | Reference secrets via `env:`, avoid persisting credentials to artifacts |
| zizmor | many `.lock.yml` files | Low/Info | `undocumented-permissions` (309), `anonymous-definition` (313), `adhoc-packages` (25), `template-injection` (9, info), `obfuscation` (3) | Document permissions blocks; pin ad-hoc installs; lower priority |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3` ``@3``.5.7-r0 (fix: 3.5.8-r0) | Bump base image / package version |
| grype | `alpine:latest`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node` | High/Medium/Low | 172 High, 312 Medium, 54 Low, 27 Negligible CVEs across 9 scanned images (e.g. `GHSA-rgw5-rvv9-x895` brace-expansion in `gh-aw-firewall/agent`) | Rebuild/update pinned image digests to latest patched releases |
| grant | 9 container images (alpine, gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server, node) | error (strict) | 1246 license-policy findings (e.g. `libapk`/`apk-tools`/`ssl_client` GPL-2.0-only, `musl-utils` multi-license) | Review license policy config vs. actual base-image licenses; adjust allowlist or images per package policy |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Summary:
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53

Actionlint Summary:
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
• expression: 2
• shellcheck: 72

grant failed:
strict mode: grant found 1246 license policy finding(s) in container images
```

Sample shellcheck error (repeated per file):
```
.github/workflows/dashboard-authoring-corpus.lock.yml:866:9: error: [shellcheck] SC1003:info:37:839: Want to escape a single quote? echo 'This is how it'\''s done'
```

Sample expression error:
```
.github/workflows/self-care-dashboard-performance.lock.yml:2359:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: ...}
```

Sample zizmor High finding:
```
./.github/workflows/cao-evolution-compiler-security.lock.yml:1882:15: error: [High] github-app: dangerous use of GitHub App tokens ((docs.zizmor.sh/redacted)
1880 | id: cao_pre_activation_app_token
1881 | if: ${{ env.CAO_GITHUB_APP_ID != '' && env.CAO_GITHUB_APP_PRIVATE_KEY != '' }}
1882 | uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
```

Sample grype Critical finding:
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
```

Sample grant license violation:
```
alpine:latest:1:1: error: license policy violation: libapk@3.0.6-r0 (GPL-2.0-only)
alpine:latest:1:1: error: license policy violation: apk-tools@3.0.6-r0 (GPL-2.0-only)
```

No token-like or credential-like values were present in the tool output.

Control plane context

- Correlation ID: `34794879564-69`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34794879564

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34795205537) · copilot · auto · 44.2 AIC · ⌖ 12.1 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 1:33 AM UTC

Start with the affected .github/workflows/*.md sources and the listed workflow references, especially the shell quoting and safe-outputs expressions; do not edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, then rerun the full validation and security suite. Done means the compiler and required scanners pass, or any unsafe finding is documented for human review.

Written by the indexing model from the issue text.