[cao-evolution:compiler-security] githubnext/gh-aw-cao: compiler + security scan findings (74 lint, 1730 zizmor, 206 CVE, 1246 license)

The gh-aw compiler run for `githubnext/gh-aw-cao` (53 workflow sources, 53 lock files, commit `ae0005a`) exited non-zero. Findings span actionlint/shellcheck (74 errors, mostly a single-quote escaping style note repeated across many lock files), 2 GitHub Actions expression errors (`safe-outputs-app-token` referenced but undefined in two lock files), 1,730 zizmor security findings (52 High: dangerous GitHub App token usage; 477 Medium, mostly secrets referenced outside a dedicated environment; plus Low/Informational), a runner-guard Medium finding (excessive write permissions on an untrusted-trigger workflow), 206 Critical/High CVEs across container images (grype), and 1,246 license-policy violations across 9 container images (grant, strict mode). No pull request or file changes were made in this review-mode run.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint/shellcheck | 20 lock files incl. `uk-ai-advisory.lock.yml`, `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance*.lock.yml` | unknown | 72 shellcheck notes/warnings, mostly SC1003 (unescaped single quote in echo) and SC2034 (unused grader env vars) | Fix quoting in shared "Pi CLI" step template and unused-var warnings in `graders/*.sh`; recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` referenced in an `if:` expression but not defined in the step-outputs object type | Fix the workflow source expression/output wiring; recompile |
| zizmor | `uk-ai-advisory.lock.yml` and others (52 occurrences) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review app-token usage scope/exposure per zizmor guidance |
| zizmor | many lock files (477 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-referencing jobs into a dedicated environment |
| zizmor | many lock files (33 occurrences) | Medium | `artipacked`: artifact/credential persistence risk | Review artifact upload/checkout steps for credential leakage |
| zizmor | many lock files (309 low, 313 info) | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages` (25), `template-injection` (9, Informational), `obfuscation` (3, Low) | Document permissions blocks, name definitions, avoid ad-hoc package installs where practical |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an untrusted-trigger event (`issue_comment`/`pull_request_target`-class) | Reduce to least-privilege permissions or scope the trigger |
| grype | 9 container images (34 Critical, 172 High) | Critical/High | CVEs incl. `CVE-2026-18798` (libcrypto3/libssl3 on `alpine:latest`), plus `CVE-2026-18924`, `CVE-2026-19931`, `CVE-2026-5450`, `CVE-2026-63073`, `CVE-2026-75803` (Critical) across `alpine`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node` | Update pinned base images/packages to patched versions; rerun grype |
| grant | 9 container images (1,246 findings) | unknown (policy violation) | Package licenses (e.g. GPL-2.0-only, GPL-3.0-or-later, custom) fail the configured strict license policy across `alpine`, `gh-aw-firewall/agent`, and other images | Review/adjust license allowlist policy or replace non-compliant packages per grant strict-mode policy |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

Zizmor findings by severity: High 52, Medium 477, Low 337, Informational 322 (rules: secrets-outside-env 444, anonymous-definition 313, undocumented-permissions 309, github-app 52, artipacked 33, adhoc-packages 25, template-injection 9, obfuscation 3).

Grype findings by severity: Critical 34, High 172, across 9 scanned container images.

Grant (strict mode): `grant found 1246 license policy finding(s) in container images` (exit failure).

Git status during scan: `?? .poutine.yml` (untracked file only; no source diffs).

Control plane context

- Correlation ID: `34881516120-87`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34881516120`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34882200536) · copilot · auto · 38.4 AIC · ⌖ 9.4 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 7:00 PM UTC

Start with the .github/workflows/*.md sources and the two workflows named in the actionlint findings; do not edit generated .lock.yml files. Use the gh aw MCP server's fix and compile tools, then inspect the generated lock-file diffs and rerun the listed compiler and security scans. Done means the full validation run passes, or the agent explains which findings require human action.

Written by the indexing model from the issue text.