[cao-evolution:compiler-security] compiler-security: 53 workflows compiled with findings (actionlint, zizmor, grype, grant)

Compiled all 53 workflow sources in `githubnext/gh-aw-cao` with `gh aw compile --validate --strict` (exit code 1, non-zero). Findings span actionlint (74 shellcheck/expression errors), zizmor (52 High `github-app` findings plus 448 Medium `secrets-outside-env`, 313 Informational, 309 Low, 33 Medium `artipacked`, 25 Low, 9 Informational, 3 Low), grype (10 unique Critical CVEs, 172 High across 9 container images), and grant (1246 license policy violations across 9 container images). No poutine findings; runner-guard reported one Medium finding. Highest-severity supported finding: zizmor High `github-app` — dangerous use of GitHub App tokens, present in all 53 generated lock files at the shared `create-github-app-token` step.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 15 lock files (Execute Pi CLI step) | error | SC1003: single-quote escaping in embedded shell heredoc (`echo 'This is how it's done'`) | Fix quoting in shared Pi CLI install/test script template |
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2359, self-care-pages-health.lock.yml:2265 | error | `safe-outputs-app-token` property not defined in referenced step-outputs object type | Fix expression reference in shared safe-outputs template |
| zizmor | all 53 lock files (~52 unique locations) | High | `github-app`: dangerous use of GitHub App tokens at `create-github-app-token` step | Review token scoping/least-privilege for shared App-token step in `shared/control.md` |
| zizmor | ~448 findings across lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Add `environment:` blocks or restructure secret access in shared job templates |
| zizmor | 33 findings | Medium | `artipacked`: risky artifact/cache packing pattern | Review artifact upload/cache steps for credential leakage risk |
| zizmor | 309 findings | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | 25 findings | Low | `adhoc-packages`: ad-hoc package installs (e.g., `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor install steps or document risk acceptance |
| zizmor | 313 findings | Informational | `anonymous-definition`: job/workflow definitions without a `name:` | Add `name:` fields to jobs lacking one |
| zizmor | 9 findings | Informational | `template-injection` | Review flagged expressions for injectable user-controlled input |
| zizmor | 3 findings | Low | `obfuscation` | Review flagged obfuscated expressions |
| grype | alpine:latest, node:lts-alpine, ghcr.io/github/gh-aw-firewall/{squid,api-proxy,cli-proxy}:0.28.16, ghcr.io/github/gh-aw-mcpg:v0.4.21, ghcr.io/github/gh-aw-node | Critical | CVE-2026-63073, CVE-2026-75803 (libcrypto3/libssl3/openssl, fix 3.5.8-r0); CVE-2026-18924, CVE-2026-19931 (curl/libcurl, fix 8.22.0-r0) | Rebuild/bump base images to patched Alpine package versions |
| grype | ghcr.io/github/github-mcp-server:v1.12.1 | Critical | CVE-2026-5450 (libc6, no fix yet), CVE-2026-75803 (libssl3, Debian) | Track upstream image update; no fix currently published for libc6 CVE |
| grype | 9 images | High/Medium/Low (172/312/54) | Additional unfixed and fixable OS-package CVEs | Bump pinned image tags/digests to latest patched releases |
| grant | 9 container images | error (strict mode) | 1246 license policy violations (GPL-2.0-only, LGPL variants, and many permissive/OSS licenses not on the allow-list) | Review `.grant.yaml` allow-list; most flagged licenses (MIT, ISC, Apache-2.0, BSD variants) are standard OSS — confirm the policy config, not the images, is the actual gap |
| runner-guard | agentic_commands.yml | Medium (RGS-005) | Excessive permissions on workflow reachable via untrusted trigger context | Review permissions scoping for command-triggered workflows |
| poutine | — | — | No findings | n/a |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

Zizmor rule counts (severity: count):
```
448 [Medium] secrets-outside-env
313 [Informational] anonymous-definition
309 [Low] undocumented-permissions
52 [High] github-app
33 [Medium] artipacked
25 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

Grype severity counts (across 9 images):
```
312 Medium
172 High
54 Low
34 Critical (10 unique CVEs)
27 Negligible
18 Unknown
```

Grant: `strict mode: grant found 1246 license policy finding(s) in container images` — dominated by common OSS licenses (MIT, ISC, Apache-2.0, BSD-*, GPL-2.0-only in base OS packages) not present on the `.grant.yaml` allow-list.

Runner-guard:
```
agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Poutine: no findings reported.

No secret- or token-like values were present in the tool output reviewed for this report.

Control plane context

- Correlation ID: `34803488678-27`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34803488678`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34803488678) · copilot · auto · 47.5 AIC · ⌖ 8.03 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 4:00 AM UTC

Start with the `.github/workflows/*.md` sources, especially the shared `control.md` templates, and run `gh aw compile --validate --strict` against the 53 workflows. Review generated lock-file diffs and the related `.grant.yaml` and `agentic_commands.yml` findings; done means the compiler and listed security scans pass without direct edits to generated `.lock.yml` files.

Written by the indexing model from the issue text.