[cao-evolution:compiler-security] gh-aw compiler & security scan: 74 lint issues, 1188 zizmor findings, 206 grype CVEs (34 Critical), grant license-policy failure

Compiling all 53 GitHub Agentic Workflows in `githubnext/gh-aw-cao` (exit code 1) found 74 actionlint issues, ~1188 zizmor findings (52 High), 206 grype container vulnerabilities (34 Critical, 172 High), and 1246 grant license-policy violations across 9 container images. Highest severity: **Critical** container CVEs (e.g. `CVE-2026-18798` libcrypto3/libssl3 in `alpine:latest`) and grant's strict-mode license policy failure blocking compilation.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint (shellcheck) | `uk-ai-advisory.lock.yml` + 71 others | unknown | SC1003: unescaped single quote in embedded script (`echo 'This is how it's done'`) | Escape single quotes in source `.md` script blocks |
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `[expression]` property `safe-outputs-app-token` not defined in step-outputs object type | Fix expression reference in workflow source, recompile |
| zizmor | `cao-evolution-catalog-advisor.lock.yml` + many | Low | `undocumented-permissions`: permissions blocks without explanatory comments | Add comments explaining each permission scope |
| zizmor | multiple workflows | Low | `adhoc-packages`: ad-hoc package installation (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin/vendor installs or document risk acceptance |
| zizmor | 52 findings across workflows | High | `github-app`: risky GitHub App token minting patterns | Review App token scoping/conditions per zizmor doc |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level permissions on workflow triggered by untrusted event (`issue_comment`/`pull_request_target`-class trigger) | Reduce to read-only permissions or gate write jobs behind trusted-actor checks |
| grype | `alpine:latest` | Critical | `CVE-2026-18798`: libcrypto3@3.5.7-r0, libssl3@3.5.7-r0 (fix: 3.5.8-r0) | Bump base image / rebuild to pick up patched packages |
| grype | 9 container images | Critical/High | 206 total findings (34 Critical, 172 High) across `alpine`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | Update pinned image digests to latest patched releases |
| grant | 9 container images | error (policy) | 1246 license-policy violations (e.g. GPL-2.0-only packages in `alpine`, mixed OSS licenses in `gh-aw-firewall/agent`) | Review `.poutine.yml`/grant policy allowlist or replace flagged packages; compilation fails in strict mode |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Actionlint Summary**
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
• shellcheck: 72
• expression: 2
```

**Zizmor**: ~1188 findings across 53 lock files (337 Low, 477 Medium, 52 High — all 52 High are `github-app` category).

**Poutine/runner-guard**: 1 finding — `agentic_commands.yml:1:1` RGS-005 (medium): job specifies write-level permissions while triggered by an untrusted event.

**Grype** (9 images scanned via syft SBOMs): 206 findings, 34 Critical / 172 High, 198 unique CVEs. Sample:
```
alpine:latest:1:1: error: [High] CVE-2026-18798: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [High] CVE-2026-18798: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
```
Critical-severity findings present in: `alpine`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine`.

**Grant**: strict mode failed — 1246 license policy findings in container images (e.g. GPL-2.0-only packages in `alpine`, mixed licenses in `gh-aw-firewall/agent`).

**Compiler summary**: 53 workflows, 316 jobs, 6804 steps, 3205 scripts, total lock-file size 8.0 MB. Untracked file left by scan: `.poutine.yml`.

No token-like or credential-like values were present in the reviewed excerpts.

Control plane context

- Correlation ID: `34815501099-75`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34815501099`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34816023643) · copilot · auto · 41.9 AIC · ⌖ 9.82 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 7:20 AM UTC

Start with the named .github/workflows/*.md sources and the gh-aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Rerun the listed compiler and security scans, review generated lock-file diffs, and consider the work done only when strict validation and all required scans pass or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.