[cao-evolution:compiler-security] gh-aw compiler & security scan findings: 74 lint issues, 52 High zizmor, 1246 license violations, 153 unique CVEs

Target `githubnext/gh-aw-cao` fails the full gh-aw compiler validation, lint, container, and security-scanner suite (exit code 1). Across 53 workflow sources / 53 compiled locks: actionlint found 74 issues (72 shellcheck SC1003 quoting notes + 2 undefined-property expression errors), zizmor flagged 52 High findings (`github-app` dangerous App-token usage) plus 477 Medium warnings (444 `secrets-outside-env`, 33 `artipacked`) and lower-severity noise, runner-guard flagged 1 Medium excessive-permissions finding on an untrusted-trigger workflow, grype found 258 Critical/High and 789 Medium CVEs (153 unique CVE IDs, 5 Critical) across the 9 scanned container images, and grant reported 1246 license-policy violations in those images. The committed `.lock.yml` files are also out of sync with source (42 files show uncompiled diffs). Highest-severity, most actionable item: the 52 `github-app` findings (dangerous GitHub App token creation/use) recurring identically across nearly every workflow's `pre_activation` job.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor | all `*.lock.yml` (52 occurrences) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` in `pre_activation` jobs | Scope the App token's permissions/lifetime tightly, or gate/justify per zizmor's `github-app` audit guidance; add an explicit `zizmor` ignore with rationale only if the risk is accepted |
| zizmor | all `*.lock.yml` (444 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming jobs behind a dedicated GitHub Environment or restructure secret access per audit doc |
| zizmor | dashboard-authoring-corpus, dependabot-release-train-updater, others (33 occurrences) | Medium | `artipacked`: checkout step persists credentials that can leak via uploaded artifacts | Set `persist-credentials: false` on `actions/checkout` steps that run before artifact upload, or scrub credentials before upload |
| zizmor | multiple (25 occurrences) | Low | `adhoc-packages`: ad-hoc `npm install -g` / package installs without pinned integrity | Pin package versions/hashes or use lockfile-based installs |
| zizmor | multiple (313 + 322 occurrences) | Informational | `anonymous-definition`: jobs/workflows without a `name:`; `undocumented-permissions`: permissions blocks without explanatory comments | Add `name:` fields and comment each permission scope's rationale |
| zizmor | pr-reviewer, self-care, self-care-primer-brand-checker, others (9 occurrences) | Informational | `template-injection`: potential code injection via template expansion near "Start MCP Gateway" step | Review templated values feeding that step; quote/escape or move to `env:` indirection |
| actionlint (shellcheck) | dashboard-authoring-corpus, eu-cra-compliance-*, others (72 occurrences) | unknown (shellcheck note) | `SC1003`: literal `it'\''s`-style quoting flagged as "want to escape a single quote" in an embedded `echo` example string | Adjust the embedded shell example/heredoc quoting so shellcheck doesn't flag it, or confirm it's intentional sample text and suppress via `# shellcheck disable=SC1003` |
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2358, self-care-pages-health.lock.yml:2264 | error | `property "safe-outputs-app-token" is not defined` in job-outputs expression type | Fix the source `.md` workflow's step/job output wiring so the referenced output exists, then recompile |
| runner-guard | agentic_commands.yml:1 | Medium | `RGS-005`: write-level `permissions:` combined with an untrusted trigger (`issue_comment`/`pull_request_target`-class event) | Narrow permissions to read-only for the untrusted-trigger job, or split write-needing steps into a separate, trigger-gated job |
| grype | alpine:latest | Critical/High | 5 Critical + multiple High CVEs (e.g. CVE-2026-63073, CVE-2026-75803) in `libcrypto3`/`libssl3` ``@3``.5.7-r0 (fix: 3.5.8-r0) | Bump base image / rebuild to pick up patched `openssl` packages |
| grype | ghcr.io/github/gh-aw-firewall/agent:0.28.16 and 7 other images | Medium/High | 153 unique CVE IDs total across 9 images (bind9-libs, and others) | Update/rebuild each pinned image to its latest patched digest |
| grant | alpine:latest, ghcr.io/github/gh-aw-firewall/agent:0.28.16, and other images | error | 1246 license-policy violations (GPL-2.0-only, MPL-2.0, etc. flagged by strict policy) in base-image packages | Review `grant`'s license policy/allowlist for these transitive OS packages, or accept/document exceptions per package |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary from compiler run:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• expression: 2
• shellcheck: 72
```

Zizmor severity counts (53 files scanned): 52 error/High, 477 warning/Medium, 337 info/Low, 322 info/Informational (anonymous-definition), plus 9 info/Informational (template-injection).

Grype: 258 Critical/High + 789 Medium findings across 9 container images (153 unique CVE IDs, 5 Critical: CVE-2026-18924, CVE-2026-19931, CVE-2026-5450, CVE-2026-63073, CVE-2026-75803).

Grant: `✗ grant failed — strict mode: grant found 1246 license policy finding(s) in container images`.

Working tree after compile shows 42 `.lock.yml` files with uncommitted diffs (drift between committed locks and current source-compiled output) plus an untracked `.poutine.yml`. Full raw tool output (766 KB) is retained in the workflow run's evidence artifact for deeper investigation; excerpts above are representative, not exhaustive, and no token-like values were present to redact.

Control plane context

- Correlation ID: `34915707162-93`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34915707162`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34916075283) · copilot · auto · 50.3 AIC · ⌖ 7.74 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 1:29 AM UTC

Start with the 53 workflow sources under .github/workflows/*.md and the compiler evidence, especially the two undefined-output errors and recurring github-app findings; use gh aw mcp-server with its fix and compile tools. Do not edit generated .lock.yml files. Done means the sources compile cleanly, generated lock-file diffs are reviewed, and the full actionlint, shellcheck, zizmor, runner-guard, grant, grype, and syft suite passes.

Written by the indexing model from the issue text.