[cao-evolution:compiler-security] gh-aw compiler/security scan findings: shellcheck, zizmor, container CVEs, license violations

gh-aw compiled all 53 workflow sources in `githubnext/gh-aw-cao` but the security/lint suite exited non-zero: actionlint found 74 issues (72 shellcheck, 2 expression-type errors), zizmor reported 1,188 findings (34 Critical/224 High when combined with container CVEs, dominated by 444 medium `secrets-outside-env` and 313 informational `anonymous-definition`), runner-guard/poutine flagged 1 medium excessive-permissions warning, grype found 1,013 container CVEs (34 Critical, several dozen High) across 9 scanned images — mainly `libssl3`/`libcrypto3`/`curl` in Alpine-based images and `libc6`/`libssl3` in `github-mcp-server`, and grant reported 1,246 license-policy violations (mostly GPL-2.0/MIT/Apache-2.0 packages baked into `alpine:latest` and related images) causing `grant failed` in strict mode. Highest-severity supported finding: Critical CVE-2026-63073/CVE-2026-75803 (OpenSSL) and CVE-2026-18924/CVE-2026-19931 (curl) unpatched in multiple firewall/proxy/mcpg/node/mcp-server container images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 18 `.lock.yml` files (Pi CLI install step) | error | SC1003: unescaped single quote in `echo 'This is how it'\''s done'` sample script | Fix the quoting in the underlying compiler-generated Pi CLI install template |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token.outputs.token` referenced but step id not defined in that job's step map | Fix the generated `GIT_TOKEN` expression / step id wiring in the compiler template for these two workflows |
| zizmor | 53 workflows (444 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Add `environment:` blocks where secrets are consumed, or document/accept per zizmor guidance |
| zizmor | 53 workflows (313 occurrences) | Informational | `anonymous-definition`: workflow/job definitions without a `name:` | Add descriptive `name:` fields to generated jobs |
| zizmor | 53 workflows (309 occurrences) | Low | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | multiple workflows (52 occurrences) | High | `github-app`: use of `actions/create-github-app-token` flagged as dangerous App-token usage | Review App token minting/scoping in generated activation jobs; confirm scoping is intentional |
| zizmor | multiple workflows (33 occurrences) | Medium | `artipacked`: potential credential persistence via `actions/checkout`/artifacts | Ensure `persist-credentials: false` and no secrets uploaded as artifacts |
| zizmor | multiple workflows (25 occurrences) | Low | `adhoc-packages`: ad-hoc `npm install -g` package installs (e.g., Pi CLI) without pinning/verification | Pin package versions/integrity or vendor via a locked action |
| zizmor | `pr-reviewer`, `self-care-primer-brand-checker`, `self-care.lock.yml` (9 occurrences) | Informational | `template-injection`: code injection via template expansion | Review flagged expressions for untrusted input reaching `run:` blocks |
| zizmor | 3 workflows | Low | `obfuscation`: obfuscated GH Actions feature usage | Review flagged lines for clarity/intent |
| runner-guard/poutine | `.github/workflows/agentic_commands.yml` | Medium | RGS-005: write permissions combined with an externally-triggerable event context | Confirm this reusable commands workflow does not actually run with write perms on untrusted triggers, or narrow permissions |
| grype | `alpine:latest`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803 (OpenSSL `libcrypto3`/`libssl3`) unpatched (fix 3.5.8-r0) | Bump base images / rebuild once upstream Alpine packages are patched |
| grype | `gh-aw-firewall/api-proxy`, `cli-proxy`, `squid`, `gh-aw-node` | Critical | CVE-2026-18924, CVE-2026-19931 (`curl`/`libcurl`) unpatched (fix 8.22.0-r0) | Bump base images / rebuild once upstream Alpine packages are patched |
| grype | `github-mcp-server:v1.12.1` | Critical | CVE-2026-5450 (`libc6`), CVE-2026-75803 (`libssl3` Debian) | Update to a newer `github-mcp-server` image tag once available |
| grype | all 9 images | High/Medium | ~1,000 additional High/Medium CVEs across OS and Go/Node dependencies (see raw evidence) | Track via routine base-image refresh; not all have upstream fixes yet |
| grant | `alpine:latest` and dependents | error | 1,246 license-policy violations (GPL-2.0-only/MIT/Apache-2.0/MPL-2.0/Zlib packages in base image, e.g. `busybox`, `apk-tools`, `musl`) causing `grant failed` in strict mode | Confirm `.poutine.yml`/grant policy intentionally allows these OS-base licenses, or adjust the license allow-list; this is likely a policy-tuning issue rather than a real compliance violation |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Priority order:
1. Fix the SC1003 shellcheck quoting issue in the compiler's Pi CLI install script template (affects 18 lock files).
2. Fix the `safe-outputs-app-token` expression-type error in `self-care-dashboard-performance.md` and `self-care-pages-health.md` (missing/mis-referenced step id for `GIT_TOKEN`).
3. Review the `grant` license-policy configuration (`.poutine.yml` or grant policy) — 1,246 violations are all standard OS-base-image licenses (GPL-2.0-only, MIT, Apache-2.0, MPL-2.0, Zlib) and likely need an allow-list update rather than code changes.
4. Where feasible, bump pinned container image tags/digests (`ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server`, `node:lts-alpine`, `alpine:latest`) to pick up the Critical CVE fixes (OpenSSL CVE-2026-63073/75803, curl CVE-2026-18924/19931, libc6 CVE-2026-5450), but only if newer tags/digests are actually published upstream.
5. Address `secrets-outside-env`, `anonymous-definition`, `undocumented-permissions`, `github-app`, `artipacked`, `adhoc-packages`, `template-injection`, and `obfuscation` zizmor findings at the compiler-template level where they originate from generated code shared across many workflows.
6. Review the `RGS-005` runner-guard warning on `.github/workflows/agentic_commands.yml`.

Raw evidence

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53

Actionlint Summary:
Checked 53 workflow(s)
Found 74 issue(s) (74 error(s))
Issues by type: shellcheck: 72, expression: 2

Zizmor findings by rule (count, severity):
secrets-outside-env: 444 (Medium)
anonymous-definition: 313 (Informational)
undocumented-permissions: 309 (Low)
github-app: 52 (High)
artipacked: 33 (Medium)
adhoc-packages: 25 (Low)
template-injection: 9 (Informational)
obfuscation: 3 (Low)

runner-guard / poutine:
.github/workflows/agentic_commands.yml:1:1 warning [medium] RGS-005 Excessive Permissions on Untrusted Trigger

grype: 1,013 total CVE findings across 9 images (alpine:latest, gh-aw-firewall/agent, gh-aw-firewall/api-proxy,
gh-aw-firewall/squid, gh-aw-firewall/cli-proxy, gh-aw-mcpg, gh-aw-node, github-mcp-server, node:lts-alpine).
Critical: CVE-2026-63073, CVE-2026-75803 (OpenSSL), CVE-2026-18924, CVE-2026-19931 (curl), CVE-2026-5450 (libc6).

grant: 1,246 license-policy violations, strict mode failure (`grant failed`), all against alpine:latest base
packages (busybox, apk-tools, musl, alpine-baselayout, ca-certificates-bundle, zlib, libssl3, libcrypto3, etc.)
with licenses GPL-2.0-only, MIT, Apache-2.0, MPL-2.0, Zlib.
```

Full tool output (766 KB) is available in the workflow run's uploaded artifacts; redacted here for length. No token-like or credential-like values were observed in the report.

Control plane context

- Correlation ID: `34874667303-86`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34874667303`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34875387412) · copilot · auto · 109.8 AIC · ⌖ 9.82 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 6:00 PM UTC

Start with the `.github/workflows/*.md` sources, especially `self-care-dashboard-performance.md`, `self-care-pages-health.md`, and `.github/workflows/agentic_commands.yml`; review the compiler-generated Pi CLI template and `.poutine.yml` for shared findings. Run the compiler and full security suite, then verify generated lock-file diffs and require all listed checks to pass without editing `.lock.yml` files directly.

Written by the indexing model from the issue text.