[cao-evolution:compiler-security] Compiler and security scan findings across 53 gh-aw workflows: shellcheck, zizmor, grype CVEs, grant license failure

Compiling all 53 GitHub Agentic Workflows in `githubnext/gh-aw-cao` completed with the compiler exiting non-zero (exit code 1). No source code was changed. Findings span actionlint/shellcheck (74 issues), zizmor security audits (1,188 findings across all severities, none critical, 52 High), runner-guard (1 medium taint warning), and container scanning: grype found 599 CVEs (34 Critical, 172 High) across 9 images, and grant's strict license policy flagged 1,246 findings, which is the reason the compiler failed. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-19931, CVE-2026-18924) in `alpine:latest` and `gh-aw-firewall/api-proxy` base images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-article-14-reporting-readiness.lock.yml`, and others (72 total) | error | SC1003: unescaped single quote in embedded shell heredoc (`echo 'This is how it's done'`) | Escape the quote in the source `.md` script block and recompile |
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step-outputs object type (2 findings) | Fix the referenced step output/expression in the workflow source |
| zizmor | 40+ lock files | High | `github-app`: dangerous use of GitHub App tokens (52 findings) | Review conditional App-token minting steps for scope/expiry hardening per zizmor guidance |
| zizmor | most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (444 findings) | Move secret references into a job/step `environment:` block where feasible |
| zizmor | several lock files | Medium | `artipacked`: credential persistence through Actions artifacts (33 findings) | Avoid persisting credentials in uploaded artifacts |
| zizmor | most lock files | Low | `undocumented-permissions` (309), `adhoc-packages` (25), `obfuscation` (3) | Add permission comments; avoid ad-hoc package installs; simplify obfuscated expressions |
| zizmor | most lock files | Informational | `anonymous-definition` (313), `template-injection` (9) | Add workflow/job names; review template expansion of untrusted input |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: write permissions on a workflow triggered by untrusted events | Reduce permissions or restrict trigger context |
| grype | `alpine:latest` | Critical/High | libcrypto3/libssl3 ``@3``.5.7-r0 CVEs (e.g. CVE-2026-63073, CVE-2026-18798) — fix in 3.5.8-r0 | Bump base image to a patched Alpine release |
| grype | `gh-aw-firewall/api-proxy:0.28.16` | Critical/High | curl/libcurl ``@8``.21.0-r0 CVEs (e.g. CVE-2026-19931, CVE-2026-18924) — fix in 8.22.0-r0 | Update firewall image dependency pin to a patched release |
| grype | `gh-aw-firewall/agent:0.28.16` | High | brace-expansion, tar, ip-address npm package CVEs | Update firewall agent image npm dependencies |
| grype | 9 images total | Critical/High/Medium/Low/Negligible | 599 CVEs (34/172/312/54/27) | Upgrade or pin base/dependency images to patched versions |
| grant | 9 container images | error (strict mode) | 1,246 license policy violations (GPL-2.0-only, GPL-3.0-or-later, and other copyleft/custom licenses in transitive packages of stock base images) causing compiler failure | Review `grant` policy config; either adjust the license allow-list for third-party container images or pin images that satisfy the current policy |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Compiler summary**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

**Actionlint summary**
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
• shellcheck: 72
• expression: 2
```

**Zizmor severity totals (53 files)**
```
Critical: 0
High: 52
Medium: 477
Low: 337
Informational: 322
```

**Grype severity totals (9 images)**
```
Critical: 34
High: 172
Medium: 312
Low: 54
Negligible: 27
```

**Grant (license scanner)**
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

**Poutine / runner-guard**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

git-status.txt showed only an untracked `.poutine.yml` scanner-config artifact produced by the evidence-collection step; no source files were modified.

Control plane context

- Correlation ID: `34868985350-85`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34868985350`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34869685977) · copilot · auto · 46.3 AIC · ⌖ 8.45 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 4:56 PM UTC

Start with the `.github/workflows/*.md` sources, especially the files named in the actionlint findings and `.github/workflows/agentic_commands.yml`; use the gh-aw MCP server's `compile` and `fix` tools rather than editing generated `.lock.yml` files. Re-run the listed compiler, workflow, security, license, and container scans, and consider the work done only when strict validation passes or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.