[cao-evolution:compiler-security] Compiler/security scan findings for githubnext/gh-aw-cao: shellcheck, zizmor, runner-guard, grype, grant

`githubnext/gh-aw-cao` compiled cleanly for all 53 workflow sources / 53 lock files, but the full validation and security-scanner suite failed (exit code 1). Findings: 74 actionlint issues (72 shellcheck, 2 expression-type errors), zizmor found 34 Critical / 224 High / 789 Medium / 391 Low / 322 Informational findings (the 34 Critical are container-image CVEs surfaced via the security summary and the 224 High are all the `github-app` "dangerous use of GitHub App tokens" audit repeated across workflows), 1 runner-guard medium finding (excessive permissions on an untrusted trigger in `agentic_commands.yml`), grype found 198 unique CVEs across 9 scanned container images (34 Critical, 172 High), and grant's license scanner failed strict mode with 1246 license-policy violations across those same 9 images (mostly GPL-2.0-only/LGPL base-OS packages in `alpine:latest` and Ubuntu-based firewall/proxy images). Highest severity: Critical CVEs in container base images (e.g. `CVE-2026-63073`, `CVE-2026-75803` in `libssl3`/`libcrypto3`, `CVE-2026-5450` in `libc6`), all with upstream fixes available.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | `dashboard-authoring-corpus.lock.yml` + 19 others | error (SC1003) | Unescaped single quote in embedded example string (`echo 'This is how it'\''s done'`) inside heredoc payload, repeated 4x per file across 20 lock files | Escape the quote correctly in the source `.md` script block, or wrap the example text to avoid nested single quotes; recompile |
| actionlint/shellcheck | 10 grader scripts under `graders/*-operational-value.sh` | warning (SC2034) | Variables assigned but unused (e.g. `WORKFLOW_NAME`, `SOURCE_PATH`, `FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) | Export the variables if used externally, or remove/prefix with `_` if genuinely unused |
| actionlint | `self-care-dashboard-performance.lock.yml:2358`, `self-care-pages-health.lock.yml:2264` | error (expression) | `safe-outputs-app-token` property not defined in referenced step-outputs object type | Fix the expression/step reference in the source workflow so it matches the actual step outputs schema |
| zizmor | 26 lock files (repeated per workflow) | High | `github-app`: dangerous use of GitHub App token via `actions/create-github-app-token@...` in conditional/untrusted context | Review App token scoping per zizmor's `github-app` audit guidance; ensure token issuance is gated and scoped minimally |
| zizmor | most lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job `environment:` block where feasible |
| zizmor | most lock files | Low/Informational | `undocumented-permissions`, `anonymous-definition` | Add explanatory comments to `permissions:` blocks; name workflow/job definitions |
| runner-guard | `agentic_commands.yml` | medium (RGS-005) | Job has write-level `permissions:` while triggered by an event that can be initiated by external users | Restrict permissions to read-only for untrusted triggers, or gate write steps behind an authorization check |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/*:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/github-mcp-server:v1.12.1` | Critical/High | 198 unique CVEs total (34 Critical, 172 High) — notably `CVE-2026-63073`/`CVE-2026-75803` in `libssl3`/`libcrypto3` (fix `3.5.8-r0`), `CVE-2026-19931`/`CVE-2026-18924` in `curl`/`libcurl` (fix `8.22.0-r0`), `CVE-2026-5450` in `libc6` (Debian, no fix listed) | Bump pinned base images / rebuild with patched packages; track the Debian `libc6` CVE upstream if no fix is yet published |
| grant | same 9 images | error (strict mode) | 1246 license-policy violations — predominantly `GPL-2.0-only`/`LGPL-2.1-*` base-OS packages (`alpine-baselayout`, `busybox`, `apk-tools`, `libattr1`, `libcap2`, etc.) plus a few `Zlib`/`MPL-2.0`/`HPND-sell-variant` entries | Confirm these licenses are acceptable for the images' distribution model and add explicit policy allow-list entries in the license-scanner config, or switch to non-GPL base images where feasible |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- actionlint: 74 issues (72 shellcheck, 2 expression) across 53 checked workflows; total repository size 8.0 MB, 316 jobs, 6807 steps, 3205 scripts.
- zizmor: 34 Critical, 224 High, 789 Medium, 391 Low, 322 Informational findings across 53 lock files.
- poutine: no findings emitted in this run beyond the shared runner-guard pass.
- runner-guard: 1 finding — `agentic_commands.yml:1:1` RGS-005 (medium), workflow triggered by a command-dispatch event carrying write permissions.
- grype: 9 container images scanned (`alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/github-mcp-server:v1.12.1`); 198 unique CVEs (34 Critical, 172 High, 312 Medium, 54 Low, 27 Negligible, 18 Unknown).
- syft: SBOMs generated for all 9 images without errors (16–567 packages per image).
- grant: strict mode failed with 1246 license-policy findings across the same 9 images.
- Uncommitted workspace artifact: `.poutine.yml` present as an untracked file (`?? .poutine.yml`) in the target checkout; no other working-tree diff.

No token-like or credential-like values were present in the captured tool output.

Control plane context

- Correlation ID: `34898743688-90`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34898743688`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34899406533) · copilot · auto · 54.2 AIC · ⌖ 13.4 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 28, 2026, 9:55 PM UTC

Start with the `.github/workflows/*.md` sources named in the findings, especially the sources for `agentic_commands.yml`, the grader scripts, and the workflows containing the quoted shell examples; do not edit generated `.lock.yml` files. Run the gh-aw MCP server's `fix` and `compile` tools with the listed strict validation and security scanners. Done means the compiler and full scanner suite pass, or any unfixable finding is explicitly explained.

Written by the indexing model from the issue text.