[cao-evolution:compiler-security] gh-aw compiler security scan: 74 actionlint issues, 1,554 zizmor findings, 542 CVEs, 1,246 license findings in githubnext/gh-aw-

Compiling all 53 GitHub Agentic Workflows in `githubnext/gh-aw-cao` (compiler exit code 1) surfaced findings across five tool categories: 74 actionlint issues (72 shellcheck, 2 expression-type errors), 1,554 zizmor security findings (52 High "github-app" dangerous-token-use, 444 Medium "secrets-outside-env", 33 Medium "artipacked", plus lower-severity anonymous-definition/undocumented-permissions/adhoc-packages/template-injection/obfuscation), 542 grype container CVEs (30+ Critical, 100+ High) across 9 base images including OpenSSL/curl RCE-class CVEs, and 1,246 grant license-policy violations (mostly GPL-2.0-only/GPL-2.0-or-later packages in base images flagged by strict-mode policy). Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-75803, CVE-2026-63073 in libssl3/libcrypto3; CVE-2026-19931/18924 in curl/libcurl) affecting all 9 scanned images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | multiple `*.lock.yml` (e.g. `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml`, others, 72 occurrences) | error | SC1003: unescaped single quote in generated `echo 'This is how it'\''s done'` example script | Fix quoting in the source `.md` script block that generates this example text so shellcheck no longer flags it; recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2359`, `self-care-pages-health.lock.yml:2265` | error | `safe-outputs-app-token` step output referenced but not defined in the job's step-output type | Ensure the `safe-outputs-app-token` step is declared/conditional consistently so the referenced output type exists, or guard the expression |
| zizmor | 41 lock files (e.g. `uk-ai-advisory.lock.yml`, `cao-evolution*.lock.yml`, `dependabot*.lock.yml`, `eu-cra-compliance*.lock.yml`, `self-care*.lock.yml`, `optimization*.lock.yml`, `software-development-practices*.lock.yml`) | High (52 occurrences) | `github-app`: dangerous use of `actions/create-github-app-token` for CAO pre-activation app token | Review whether the app-token step needs narrower scoping/conditions per zizmor's github-app guidance; document accepted risk if intentional |
| zizmor | many lock files (444 occurrences) | Medium | `secrets-outside-env`: secrets referenced in job/step context without a dedicated `environment:` | Move secret-referencing jobs into a dedicated GitHub Environment or restructure secret access per zizmor `secrets-outside-env` guidance |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`, others (33 occurrences) | Medium | `artipacked`: credential persistence risk through checkout/artifact steps | Ensure `actions/checkout` steps that may persist credentials into artifacts set `persist-credentials: false` where not needed |
| zizmor | multiple (309 occurrences) | Low/Info | `undocumented-permissions`: jobs without explicit documented `permissions:` rationale | Add minimal explicit `permissions:` blocks with comments per zizmor guidance |
| zizmor | multiple (313 occurrences) | Info | `anonymous-definition`: workflow/job definitions without a `name:` | Add `name:` fields to flagged jobs/definitions |
| zizmor | multiple (25 occurrences) | Low | `adhoc-packages`: ad-hoc `npm install`/binary installs outside pinned dependency management | Pin package installs via lockfiles or vendored binaries where feasible |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` (9 occurrences) | Info | `template-injection`: potential code injection via template expansion in MCP gateway steps | Review expression interpolation in flagged `run:`/`env:` blocks for untrusted input handling |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` (3 occurrences) | Low | `obfuscation`: obfuscated usage of Actions features | Simplify flagged expressions/step configuration for auditability |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an event that can be initiated by external users (untrusted trigger) | Scope down permissions for the affected job or restrict the trigger/command surface per RGS-005 guidance |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/github-mcp-server:v1.12.1` (9 images) | Critical/High (542 total: 30 Critical, 100+ High, remainder Medium/Unknown) | CVEs in `libssl3`/`libcrypto3` (CVE-2026-63073, CVE-2026-75803), `curl`/`libcurl` (CVE-2026-19931, CVE-2026-18924), and `libc6` (CVE-2026-5450), each with an available fixed package version | Rebuild/update each flagged base image to the fixed package versions (e.g. `libssl3`/`libcrypto3` 3.5.8-r0, `curl`/`libcurl` 8.22.0-r0) or bump the pinned image tag/digest to a patched release |
| grant | all 9 scanned images (1,246 total findings) | error (license policy) | Strict-mode license policy violations, predominantly GPL-2.0-only/GPL-2.0-or-later base-image packages (e.g. `busybox`, `alpine-baselayout`, `apk-tools`, `musl-utils`) plus Apache-2.0/MIT/Zlib/MPL-2.0 flagged under strict policy | Review `grant`'s license policy configuration for these base images; either adjust the policy allowlist for standard base-OS licenses or document the accepted risk if these are expected distro-license findings |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Compiler summary: `Target: githubnext/gh-aw-cao | Exit code: 1 | Workflow sources: 53 | Compiled locks: 53`
- actionlint: 74 issues (72 shellcheck, 2 expression) across 53 checked workflows
- zizmor: highest rule severity was High (`github-app`, 52 occurrences); 789 Medium, 391 Low, 322 Informational rule matches total (zizmor reported no Critical-severity rule findings)
- poutine/runner-guard: 1 finding (`agentic_commands.yml`, RGS-005, Medium)
- syft: 9 container images scanned (alpine:latest, gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}:0.28.16, gh-aw-mcpg:v0.4.21, gh-aw-node, github-mcp-server:v1.12.1, node:lts-alpine)
- grype: 542 CVE findings across the 9 images (30 Critical, 100+ High, remainder Medium/Unknown)
- grant: 1,246 license-policy findings across the 9 images, causing the `grant failed` strict-mode exit
- No token-like or credential-like values were present in the reviewed evidence

Control plane context

- Correlation ID: `34809860896-74`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34809860896`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34810277457) · copilot · auto · 53.8 AIC · ⌖ 14.9 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 5:54 AM UTC

Start with the affected `.github/workflows/*.md` sources and use the gh-aw MCP server's `fix` and `compile` tools; never edit generated `.lock.yml` files. Done means the 53 workflows compile successfully and the required model, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft scans pass, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.