[cao-evolution:compiler-security] gh-aw compiler & security scan findings — 53 workflows, 4 categories (74 lint, 1188 zizmor, 617 grype, 1246 license)

Compiling all 53 GitHub Agentic Workflows in `githubnext/gh-aw-cao` completed with **exit code 1**. The full validation, lint, and scanner suite reported findings across five categories: 74 actionlint/shellcheck issues, 1188 zizmor security findings (52 High), 1 poutine/runner-guard taint finding, 617 grype container CVEs (34 Critical, 172 High), and 1246 grant license-policy violations across 9 base images. No compiler-fatal validation errors were found; all 53 sources compiled to lock files. Highest-severity supported finding: zizmor `github-app` (High) — dangerous GitHub App token usage pattern present in 42 of 53 lock files, plus grype Critical CVEs in the `alpine`, `node`, and `gh-aw` firewall/mcpg base images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|--------------|
| actionlint (shellcheck) | 53 lock files | error (SC1003) | Unescaped single quote in embedded shell heredoc (`echo 'This is how it'\''s done'`) repeated across generated scripts | Fix the quoting in the shared source snippet emitting this example string, then recompile |
| actionlint (expression) | `self-care-dashboard-performance.md`, `self-care-pages-health.md` | error | `safe-outputs-app-token` property not defined in the referenced step-outputs object type | Correct the step-output reference/typo in these workflow sources |
| zizmor | 42/53 lock files | High | `github-app`: dangerous use of GitHub App token creation (`actions/create-github-app-token`) pattern | Review token scoping/lifetime per zizmor guidance; restrict to minimum required permission and job scope |
| zizmor | most lock files | Medium (444) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into jobs with a declared `environment:` |
| zizmor | several lock files | Medium (33) | `artipacked`: credential persistence risk in checkout/artifact steps | Set `persist-credentials: false` on checkout or scope artifact retention |
| zizmor | many lock files | Low/Info (309+313) | `undocumented-permissions`, `anonymous-definition` — informational hygiene findings | Add comments explaining `permissions:` blocks; name anonymous workflow/job definitions where flagged |
| poutine / runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level permissions on a workflow reachable from untrusted trigger context | Confirm the trigger context is trusted, or drop to read-only permissions and re-elevate via a separate authorized job |
| grype | `alpine:latest` | Critical/High | Multiple CVEs in `libcrypto3`/`libssl3` (e.g. CVE-2026-63073, CVE-2026-75803) fixed in `3.5.8-r0`; also `busybox` CVE-2025-60876 | Bump/rebuild base image to pick up patched `alpine` packages |
| grype | `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | Critical/High (multiple) | Additional CVEs across firewall, MCP gateway, and Node images (617 total findings, 34 Critical, 172 High) | Update pinned image tags/digests to latest patched releases; re-scan |
| grant | 9 container images | error (1246 findings) | License-policy violations — many are common permissive/copyleft licenses (MIT, Apache-2.0, GPL-2.0, BSD, ISC) likely denied by the current strict policy | Review `grant`/license-allowlist policy for false-positive-prone common OSS licenses vs. genuinely restrictive ones; adjust policy or accept documented exceptions |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary (`summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

Zizmor severity counts (across 53 files):
```
477 Medium
337 Low
322 Informational
52 High
```

Grype severity counts (9 container images):
```
172 High
312 Medium
34 Critical
54 Low
27 Negligible
18 Unknown
```

Grant: `grant found 1246 license policy finding(s) in container images` (strict mode failure, exit code non-zero).

`git-status.txt` after the run showed only an untracked `.poutine.yml` scanner-config artifact — no source changes were made by the deterministic scan step.

Full raw `report.txt` is 766 KB / 10,857 lines and is retained as workflow evidence in `/tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt`; excerpts above are representative, not exhaustive. No token-like or credential-like values were observed in the captured output.

Control plane context

- Correlation ID: `34833470920-79`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34833470920

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34833938991) · copilot · auto · 40.1 AIC · ⌖ 16.7 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 10:56 AM UTC

Start with the .github/workflows/*.md sources, especially self-care-dashboard-performance.md, self-care-pages-health.md, and agentic_commands.yml; use the gh-aw MCP server's compile and fix entry points rather than editing generated .lock.yml files. Review the reported actionlint, zizmor, poutine, grant, and grype findings, then rerun the full strict validation and security scan; done means all supported checks pass or any unsafe-to-fix findings are documented.

Written by the indexing model from the issue text.