[cao-evolution:compiler-security] AW Compiler & Security: 53 workflows compiled with lint, zizmor, grype, and grant findings

Compiling all 53 Agentic Workflow sources in `githubnext/gh-aw-cao` (53 sources → 53 lock files) succeeded, but the full validation/lint/security suite exited non-zero (exit code 1). Findings span 5 categories: actionlint/shellcheck lint errors (74), zizmor static-analysis findings (1,806, none Critical), a single runner-guard taint-analysis warning, grype container CVEs (34 Critical, 172 High, 312 Medium across 9 images), and grant license-policy violations (1,246, mostly copyleft/GPL packages in base images). Highest-severity supported finding: **Critical grype CVEs** in 6 of 9 scanned container images (`alpine:latest`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `github-mcp-server`, `node:lts-alpine`) — all fixable by upstream base-image/package upgrades, none fixable by editing workflow `.md` sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint+shellcheck | `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml` (+ others, 72 total) | error | SC1003: unescaped single quote in embedded shell heredoc (`echo 'This is how it'\''s done'`) | Escape the quote in the source `.md` run-step script so generated shellcheck passes |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2359`, `self-care-pages-health.lock.yml:2265` | error | `safe-outputs-app-token` property not defined on step-outputs object type | Fix the expression reference in the workflow source (likely a stale/renamed step-output key) |
| zizmor | 53/53 lock files | Medium | `secrets-outside-env` (444 findings): secrets referenced without a dedicated `environment:` | Add explanatory comment or scope secret usage to a job `environment:` where appropriate |
| zizmor | 53/53 lock files | Informational | `anonymous-definition` (313): job/workflow definitions without a `name:` | Add `name:` fields (cosmetic, low priority) |
| zizmor | 53/53 lock files | Low | `undocumented-permissions` (309): `permissions:` blocks lack explanatory comments | Add comments justifying each permission scope |
| zizmor | e.g. `cao-evolution-catalog-advisor.lock.yml:1926`, `cao-evolution-compiler-security.lock.yml:1882` (52 total) | High | `github-app`: dangerous use of GitHub App tokens (token generated then potentially exposed) | Review app-token step scoping per zizmor doc; ensure token is not persisted/exported beyond its job |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml` (33 total) | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Ensure checkout/artifact steps don't persist credentials (`persist-credentials: false`) |
| zizmor | `uk-ai-advisory.lock.yml` (+ others, 25 total) | Low | `adhoc-packages`: ad-hoc `npm install -g` / package installs outside pinned lockfiles | Pin package versions via lockfile or vendor the install script |
| zizmor | `pr-reviewer.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` (9 total) | Informational | `template-injection`: code injection via template expansion | Review flagged expressions for untrusted input interpolation |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` (3 total) | Low | `obfuscation`: obfuscated usage of Actions features | Simplify flagged expression/step for clarity |
| runner-guard | `agentic_commands.yml:1` | Medium (RGS-005) | Excessive permissions on untrusted trigger context (informational marker in commands manifest comment; not a live job) | Confirm no actual job under `pull_request_target`/`issue_comment` grants write perms without constraints |
| grype | `alpine:latest`, `gh-aw-firewall/api-proxy:0.28.16`, `gh-aw-firewall/cli-proxy:0.28.16`, `gh-aw-firewall/squid:0.28.16` | Critical | `CVE-2026-63073`, `CVE-2026-75803` (libcrypto3/libssl3/openssl), `CVE-2026-18924`, `CVE-2026-19931` (curl/libcurl) — fixes available (e.g. `3.5.8-r0`, `8.22.0-r0`) | Bump base images / rebuild with patched Alpine packages |
| grype | `gh-aw-mcpg:v0.4.21`, `node:lts-alpine` | Critical | `CVE-2026-63073`, `CVE-2026-75803` (libcrypto3/libssl3) — fix `3.5.8-r0` | Rebuild image on updated Alpine base |
| grype | `github-mcp-server:v1.12.1` | Critical | `CVE-2026-5450` (libc6, Debian), `CVE-2026-75803` (libssl3) | Rebuild on patched Debian base image |
| grype | 9/9 images | High (172 total) | Additional High-severity CVEs (curl/libssl, Go stdlib in `gh-aw-mcpg`, npm deps `tar`/`brace-expansion`/`ip-address` in `node:lts-alpine`) | Update base images and vendored dependencies per grype fix suggestions |
| grype | 9/9 images | Medium (312 total) | Remaining Medium CVEs (Go stdlib, npm `undici`, alpine `busybox`) | Track via routine base-image refresh |
| grant | `alpine:latest` (16 pkgs), `gh-aw-firewall/agent:0.28.16` (+ 7 other images, 1,246 total) | error | License policy violations: GPL-2.0-only/GPL-3.0-only/LGPL packages (`busybox`, `apk-tools`, `libicu70`, `adduser`, etc.) in base images flagged by strict license policy | Confirm intended license policy scope for base-OS packages; adjust `.poutine.yml`/grant policy or accept via documented exception if these are transitively required system packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: several Critical/High findings are grype container-image CVEs and grant license-policy findings in third-party base images (`alpine`, `node:lts-alpine`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `github-mcp-server`) that cannot be fixed by editing workflow `.md` sources — flag these explicitly rather than attempting workaround edits.

Raw evidence

- Summary: 53 workflow sources compiled to 53 lock files; total size 8.0 MB; 316 jobs; 6,804 steps; 3,205 embedded scripts.
- Actionlint: 74 issues (72 shellcheck, 2 expression errors).
- Zizmor: 1,806 findings across severities (0 Critical, 224 High, 789 Medium, 391 Low, 322 Informational, 27 Negligible) across 8 rule categories (`secrets-outside-env`, `anonymous-definition`, `undocumented-permissions`, `github-app`, `artipacked`, `adhoc-packages`, `template-injection`, `obfuscation`).
- runner-guard: 1 finding (RGS-005, medium) on `agentic_commands.yml` commands manifest comment.
- grype: 9 container images scanned (syft SBOMs generated for each); 332 error-level and 808 warning-level CVE findings total; 34 Critical.
- grant: 1,246 license-policy violations across 9 images (strict mode); scan added an untracked `.poutine.yml` (0 bytes diff, no repository content change).
- No repository files were modified by this scan (`diff-stat.txt` empty); only an untracked `.poutine.yml` artifact appeared in `git-status.txt`.

Control plane context

- **Correlation ID**: `34819052727-76`
- **Central repository**: `githubnext/gh-aw-cao`
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/34819052727

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34819482794) · copilot · auto · 53.2 AIC · ⌖ 11.8 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 8:10 AM UTC

Start with the `.github/workflows/*.md` sources and configure the `gh aw mcp-server` as described; use its `fix` and `compile` tools rather than editing generated `.lock.yml` files. Re-run the listed compiler, lint, security, image, and license checks across all 53 workflows, and consider the work complete only when supported findings pass or unavoidable image and policy findings are explicitly documented.

Written by the indexing model from the issue text.