[cao-evolution:compiler-security] compiler-security: 53 workflows compile clean but scan finds 52 High zizmor, 34 Critical grype CVEs, and grant license failure

Compiling all 53 gh-aw workflows in `githubnext/gh-aw-cao` (target SHA `ae0005ae`) succeeded, but the full validation/lint/scanner suite exited non-zero. Actionlint found 74 issues (72 shellcheck, 2 expression). Zizmor flagged 52 High-severity `github-app` findings (dangerous GitHub App token usage) plus 477 Medium and 337 Low findings. Runner-guard flagged 1 Medium excessive-permissions finding on a `pull_request_target`-adjacent trigger. Grype found 34 Critical and 172 High CVEs across 8 base/tool container images (unpatched `libcurl`, `libssl3`/`libcrypto3`, `libexpat`, `libc6`, `docker-cli`, `grpc`). Grant (license scanner) hard-failed with 1246 license policy findings, mostly copyleft (GPL-2.0) packages inside third-party base images. Highest-severity, most actionable item: the 52 recurring `github-app` findings are workflow-source issues fixable via `.md` edits; the container CVEs/license findings require upstream base-image bumps, which are outside `.md`-only workflow-source fixes.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 15+ `.lock.yml` files, e.g. `dashboard-authoring-corpus.lock.yml` | unknown | SC1003: unescaped single quote in embedded shell (e.g. `echo 'This is how it'\''s done'`) | Fix quoting in the source `.md` script blocks that generate these steps |
| actionlint (expression) | 2 workflows | unknown | invalid/unsupported GitHub Actions expression usage | Correct the expression syntax in `.md` source `if:`/`run:` blocks |
| zizmor | 52 `.lock.yml` files, e.g. `cao-evolution-catalog-advisor.lock.yml:1926` | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Scope the app-token step's permissions/lifetime per zizmor guidance; confirm token isn't broadened beyond the job's need |
| zizmor | 33 `.lock.yml` files | Medium | `artipacked`: credential persistence risk in checkout/artifact steps | Set `persist-credentials: false` or scrub artifacts per zizmor docs |
| zizmor | 444 findings across `.lock.yml` files | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs to a declared `environment:` |
| zizmor | 309 findings | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | 25 findings | Low | `adhoc-packages`: ad hoc package installs | Pin/vet package install steps |
| zizmor | 3 findings | Low | `obfuscation`: obfuscated script content | Simplify/clarify flagged scripts |
| runner-guard | `agentic_commands.yml:1` | Medium (RGS-005) | Excessive permissions (`contents: write`) potentially reachable from untrusted trigger context | Confirm this file's trigger isn't attacker-controlled; if so, narrow permissions or gate via `pull_request_target` safeguards |
| grype | `alpine:latest`, `ghcr.io/github/github-mcp-server:v1.12.1`, `ghcr.io/github/gh-aw-firewall/squid:0.28.16`, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16` | Critical | CVE-2026-63073/75803/18924/19931/5450 in `libssl3`/`libcrypto3`/`libcurl`/`libc6` (34 total Critical instances) | Bump base images to patched versions (e.g. `libssl3`/`libcrypto3` 3.5.8-r0, `libcurl` 8.22.0-r0) — requires upstream image publisher action, not a `.md`-only fix |
| grype | `ghcr.io/github/gh-aw-node`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, others | High | 172 High CVEs total (`libexpat`, `libcurl`, `libblkid`/`libmount`, `docker-cli`, `grpc`) | Same as above — coordinate base-image updates |
| grant | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/agent:0.28.16`, and 7 other images | error | 1246 license policy violations, predominantly GPL-2.0-only packages in base OS layers (`apk-tools`, `busybox`, `dpkg`, `findutils`, etc.) | Requires reviewing/adjusting the grant license policy allowlist or swapping affected base images; not fixable via workflow `.md` edits alone |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely. Note: the 34 Critical / 172 High grype CVEs and 1246 grant license findings originate from third-party base container images (alpine, gh-aw-firewall, gh-aw-mcpg, gh-aw-node, github-mcp-server), not from workflow source content — these cannot be resolved by editing `.md` files and must be reported back as out-of-scope for this remediation pass along with the two actionlint "expression" issues if their root cause is outside workflow source.

Raw evidence

**Summary** (from `summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

**Actionlint Summary:**
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

**Zizmor:** 52 High (`github-app`), 477 Medium (`artipacked` 33, `secrets-outside-env` 444), 337 Low (`undocumented-permissions` 309, `adhoc-packages` 25, `obfuscation` 3) across the 53 compiled `.lock.yml` files.

**Runner-guard:** 1 Medium (RGS-005) finding in `.github/workflows/agentic_commands.yml`.

**Grype (9 container images scanned via syft SBOMs):** 34 Critical, 172 High, 312 Medium, 54 Low. Affected images: `alpine:latest`, `ghcr.io/github/gh-aw-firewall/agent:0.28.16`, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16`, `ghcr.io/github/gh-aw-firewall/squid:0.28.16`, `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`.

**Grant:** hard failure — "strict mode: grant found 1246 license policy finding(s) in container images" (predominantly GPL-2.0-only in Debian/Ubuntu/Alpine base layers).

**Git status** during scan: `?? .poutine.yml` (untracked, no diff produced by the compiler run — `diff-stat.txt` empty).

Control plane context

- **Correlation ID**: 34893038239-89
- **Central repository**: githubnext/gh-aw-cao
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/34893038239

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34893523651) · copilot · auto · 47.9 AIC · ⌖ 11.3 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 8:54 PM UTC

Start with the `.github/workflows/*.md` sources and `.github/workflows/agentic_commands.yml`; use the gh aw MCP `fix` and `compile` tools, then run the listed validation and security scans without editing generated `.lock.yml` files. Done means source-related findings are resolved and compilation passes, with container CVEs, license findings, and any out-of-scope expression issues documented for separate action.

Written by the indexing model from the issue text.