[cao-evolution:compiler-security] gh-aw compiler run findings: exit code 1 (34 Critical CVEs, 1246 license findings, 2 expression errors)

The compiler run against `githubnext/gh-aw-cao` (53 workflow sources, 53 generated locks) exited with code 1. Findings span actionlint/shellcheck (74 lint issues, incl. 2 unresolved expression errors), zizmor (52 High `github-app` findings, 444 Medium `secrets-outside-env`, plus lower-severity items), poutine/runner-guard (1 Medium excessive-permissions finding), grype (34 Critical / 172 High / 312 Medium container CVEs across 9 images), and grant (1246 license-policy violations, mostly GPL-2.0/GPL-3.0 base-image packages flagged under a strict allow-list). Highest severity supported by the tools: **Critical** — unpatched `libcrypto3`/`libssl3`/`curl`/`libcurl` CVEs (e.g. CVE-2026-63073, CVE-2026-19931, CVE-2026-18924) in the `alpine`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/squid`, and `gh-aw-mcpg` images. Recommended next action: rebuild/pin base images to picked-up patched package versions, resolve the two actionlint `safe-outputs-app-token` expression errors, and review whether the `github-app` zizmor findings and grant license policy need allow-listing or remediation.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` property not defined on `download-agent-output`/`setup` step-output object | Fix the referencing expression or the step output producing it in the source `.md` workflow |
| actionlint/shellcheck | 36 lock files (`Execute Pi CLI` step) | unknown (note) | SC1003: unescaped single quote in example string (`echo 'This is how it'\''s done'`) — recurs 4x per file | Adjust the quoting in the shared Pi CLI install/example script referenced by these workflows |
| shellcheck | multiple `.lock.yml` generated scripts | warning | SC2034: variables (e.g. `WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`) appear unused | Verify or export these variables in the shared script templates that generate them |
| zizmor | 41 lock files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/usage per zizmor guidance at docs.zizmor.sh/audits/#github-app |
| zizmor | most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (444 occurrences) | Move secret references into a job/step `environment:` block |
| zizmor | many lock files | Medium | `artipacked`: risky artifact/credential packaging pattern (33 occurrences) | Review flagged steps against zizmor's artipacked guidance |
| zizmor | many lock files | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments (309 occurrences) | Add comments explaining minimal permission grants |
| zizmor | 25 lock files | Low | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g ...`) | Pin package installs via a manifest/lockfile where feasible |
| zizmor | pr-reviewer.lock.yml, self-care-primer-brand-checker.lock.yml | Informational | `template-injection`: code injection via template expansion | Review templated expressions for safe interpolation |
| zizmor | 313 occurrences | Informational | `anonymous-definition`: workflow/action definitions without a `name` | Add explicit `name:` fields |
| poutine / runner-guard | agentic_commands.yml | Medium (RGS-005) | Write-level `permissions:` combined with an externally-triggerable event (`pull_request_target`/`issue_comment`-class trigger) | Scope down permissions or restrict the trigger for this workflow |
| grype | `alpine:latest` | Critical/High | Unpatched `libcrypto3`/`libssl3` (CVE-2026-63073, CVE-2026-75803, CVE-2026-18798) — fix in 3.5.8-r0 | Rebuild/pull the base image to pick up the patched Alpine packages |
| grype | `gh-aw-firewall/api-proxy:0.28.16`, `gh-aw-firewall/squid:0.28.16` | Critical | `curl`/`libcurl` CVE-2026-19931, CVE-2026-18924 — fix in 8.22.0-r0 | Rebuild these firewall images against a patched curl package |
| grype | `gh-aw-firewall/squid:0.28.16` | Critical | `libcrypto3`/`libssl3`/`openssl` CVE-2026-63073, CVE-2026-75803 | Rebuild against patched OpenSSL packages |
| grype | `gh-aw-mcpg:v0.4.21` | Critical | `libcrypto3`/`libssl3` CVE-2026-63073 | Rebuild/update base image |
| grype | remaining 5 images (313/33/54/18/27/32 findings) | High/Medium | Additional unpatched CVEs across `gh-aw-firewall/agent`, `gh-aw-firewall/cli-proxy`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | See raw evidence for per-CVE detail; rebuild/pin all 9 images |
| grant | all 9 images | error (strict) | 1246 license-policy findings (mostly GPL-2.0/GPL-3.0-only base OS packages, e.g. `busybox`, `alpine-baselayout`, `apk-tools`) | Confirm/update the license allow-list policy (`.poutine.yml`/grant config) or replace flagged base packages if the license is genuinely disallowed |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Summary**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

**Actionlint summary**
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))

Issues by type:
• shellcheck: 72
• expression: 2
```

**grype severity counts (per-scan)**
```
Critical: 34
High: 172
Medium: 312
```

**grant summary**
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

**zizmor rule counts**
```
444 [Medium] secrets-outside-env
313 [Informational] anonymous-definition
309 [Low] undocumented-permissions
52 [High] github-app
33 [Medium] artipacked
25 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

Full raw compiler/scanner output (~766 KB) is retained in the workflow run artifacts for this job; no token-like values were observed in the excerpts reviewed above.

Control plane context

- Correlation ID: `34844780469-81`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34844780469

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34845373873) · copilot · auto · 46.9 AIC · ⌖ 8.33 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 1:07 PM UTC

Start with the affected .github/workflows/*.md sources and the gh aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Review .poutine.yml or the grant configuration for license policy findings, then rerun the full compiler and security scan. Done means the reported compiler, actionlint, shellcheck, zizmor, poutine, runner-guard, grant, grype, and syft findings are resolved or explicitly escalated.

Written by the indexing model from the issue text.