[cao-evolution:compiler-security] gh-aw compiler & security scan findings: 53 workflows, exit code 1 (license/CVE/zizmor/actionlint)

Compiling all 53 gh-aw workflows in `githubnext/gh-aw-cao` completed with **compiler exit code 1**. The failure is driven by the `grant` license-policy scanner (1246 findings across 9 container images, mostly common GPL-2.0/LGPL/MIT/ISC packages in base OS images). `grype` additionally found 198 unique CVEs (34 Critical, 130 High) in the same images. `zizmor` reported 1192 findings (52 High `github-app`, 448 Medium `secrets-outside-env`, 33 Medium `artipacked`, plus lower-severity informational/low items). `actionlint` found 74 issues (72 shellcheck SC1003 quote-escaping notes, 2 `expression` errors referencing an undefined `safe-outputs-app-token` job output). `runner-guard` flagged 1 Medium taint finding. `poutine` reported no findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2359, self-care-pages-health.lock.yml:2265 | error | `safe-outputs-app-token` property not defined on referenced job outputs | Fix the source `.md` job-output wiring for the safe-outputs app-token step so the generated expression references a defined output |
| actionlint (shellcheck SC1003) | 18 lock files (e.g. dashboard-authoring-corpus.lock.yml:866, eu-cra-compliance-article-14-reporting-readiness.lock.yml:921, uk-ai-advisory*.lock.yml) | error | Unescaped single quote in "Execute Pi CLI" step script | Escape the single quote in the shared script template that emits `echo 'This is how it'\''s done'` |
| zizmor | 52 workflows (e.g. cao-evolution-catalog-advisor.lock.yml:1926, cao-evolution-compiler-security.lock.yml:1882) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` | Confirm token scope/lifetime is minimal and expected; add zizmor suppression comment if this is an accepted, reviewed pattern |
| zizmor | 448 occurrences across most workflows | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a dedicated GitHub Environment where feasible |
| zizmor | 33 occurrences (e.g. dashboard-authoring-corpus.lock.yml:1770, dependabot-release-train-updater.lock.yml:2657/2663) | Medium | `artipacked`: credential persistence through Actions artifacts | Ensure checkout steps do not persist credentials before uploading artifacts |
| zizmor | 309 occurrences | Low | `undocumented-permissions`: `permissions:` block lacks explanatory comment | Add short comments justifying each granted permission |
| zizmor | 25 occurrences (e.g. dashboard-authoring-corpus.lock.yml:515) | Low | `adhoc-packages`: ad-hoc package installation | Pin package versions or use a lockfile-based install step |
| zizmor | 313 occurrences | Informational | `anonymous-definition`: workflow/job without a `name:` | Add descriptive `name:` fields |
| zizmor | 9 occurrences (pr-reviewer.lock.yml:724) | Informational | `template-injection`: code injection via template expansion | Review templated expression for untrusted input before merge |
| zizmor | 3 occurrences (optimization-ai-credit-auditor.lock.yml:311, optimization-ai-credit-optimizer.lock.yml:308, self-care-docs-build-time-investigator.lock.yml:292) | Low | `obfuscation`: obfuscated usage of Actions features | Simplify the flagged expression/step for clarity |
| runner-guard | agentic_commands.yml:1 | Medium | RGS-005: write permissions combined with an untrusted-trigger-capable event (`issue_comment`/command trigger) | Confirm least-privilege permissions for command-triggered jobs; scope write access narrowly |
| grant (license policy, **build-blocking**) | 9 container images, 1246 findings total (e.g. `alpine:latest` GPL-2.0-only/MIT/Apache-2.0 base packages; `gh-aw-firewall/agent:0.28.16` many ISC/MIT/GPL Ubuntu+npm packages) | error (strict mode) | License policy violations for common base-image and npm dependency licenses | Review `.poutine.yml`/grant license policy allow-list; confirm whether GPL-2.0/LGPL/ISC/MIT base-image licenses should be permitted, then update policy or base images |
| grype (vulnerability scan) | 9 container images, 198 unique CVEs (34 Critical, 130 High, 280 Medium, 54 Low, 27 Negligible) | Critical/High | Outdated OS/library packages in `alpine:latest`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `node:lts-alpine`, `github-mcp-server` (e.g. `alpine:latest` libcrypto3/libssl3 3.5.7-r0, fixed in 3.5.8-r0; `bind9-libs` CVEs in firewall agent image) | Rebuild/pull updated base images and rerun `grype`/`syft` to confirm fixes land |
| poutine | — | — | No findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

grant summary:
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

grype severity breakdown (unique CVE-severity entries across 9 images): Critical 34, High 130, Medium 280, Low 54, Negligible 27 (198 unique CVEs total).

zizmor finding counts by rule: secrets-outside-env (Medium) 448, anonymous-definition (Informational) 313, undocumented-permissions (Low) 309, github-app (High) 52, artipacked (Medium) 33, adhoc-packages (Low) 25, template-injection (Informational) 9, obfuscation (Low) 3.

No token-like or credential-like values were present in the retained excerpts above.

Control plane context

- Correlation ID: `34796825317-70`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34796825317

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34797060781) · copilot · auto · 44.5 AIC · ⌖ 12 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 2:08 AM UTC

Start with the affected .github/workflows/*.md sources, especially the safe-outputs job wiring and shared Execute Pi CLI script; do not edit generated .lock.yml files. Use the gh aw MCP server's fix and compile tools, then rerun the compiler and the listed actionlint, security, license, and image scans. Done means the full validation passes, or any unsafe finding is documented for human action.

Written by the indexing model from the issue text.