[cao-evolution:compiler-security] AW compiler security scan: 53 workflows, 74 lint issues, 198 CVEs, 1246 license violations

Compiling all 53 gh-aw workflows in `githubnext/gh-aw-cao` succeeded structurally, but the full validation/lint/container/security suite exited non-zero (exit code 1). Findings span 5 categories: 74 actionlint issues (72 shellcheck notes, 2 GitHub-Actions expression-type errors), 445 zizmor findings (1 High per CAO-Evolution workflow for GitHub App token usage, plus Medium secrets-outside-env/artipacked and Low undocumented-permissions/adhoc-packages), 1 poutine/runner-guard Medium finding (excessive permissions on an untrusted trigger in `agentic_commands.yml`), 198 distinct grype CVEs across 9 container images (34 Critical, 172 High, 312 Medium, 54 Low, 27 Negligible, 18 Unknown — most severe: `CVE-2026-18798` High in `libcrypto3`/`libssl3` on `alpine:latest`), and 1,246 grant license-policy violations (mostly GPL-2.0/LGPL family packages baked into `alpine:latest`, `node:lts-alpine`, and the `gh-aw-firewall`/`gh-aw-mcpg`/`github-mcp-server` images) that caused `grant` to fail in strict mode. Highest-severity supported finding: Critical/High grype CVEs in base container images used across all 53 workflows.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | unknown | `safe-outputs-app-token` property not defined in the referenced step-outputs object type | Fix the expression to reference a valid step output; recompile from the `.md` source. |
| actionlint (shellcheck, SC1003) | dashboard-authoring-corpus.lock.yml + 17 other lock files (Execute Pi CLI step) | unknown | Unescaped single quote in an embedded `echo` example string (`echo 'This is how it'\''s done'`) | Escape the single quote correctly in the shared Pi CLI step template source. |
| actionlint (shellcheck, SC2034) | 16 `graders/*-operational-value.sh` scripts | unknown | Variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`/`FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) appear unused | Export or consume these grader-context variables, or mark them intentionally unused. |
| zizmor `github-app` | cao-evolution*.lock.yml (7 workflows) | High | Dangerous use of `actions/create-github-app-token` for GitHub App tokens | Review App-token scoping/lifetime per zizmor guidance; constrain token permissions. |
| zizmor `secrets-outside-env` | cao-evolution*.lock.yml, dashboard-authoring-corpus.lock.yml, others (444 occurrences) | Medium | Secrets referenced without a dedicated `environment:` | Move secret-consuming jobs behind a named `environment:` block. |
| zizmor `artipacked` | dashboard-authoring-corpus.lock.yml | Medium | Potential credential persistence through GitHub Actions artifacts | Avoid persisting credentials in uploaded artifacts; scrub before upload. |
| zizmor `undocumented-permissions` / `adhoc-packages` | 309 + several occurrences across most lock files | Low | Permissions blocks lack explanatory comments; ad-hoc `npm install -g` package installs | Add comments to `permissions:` blocks; pin/vendor ad-hoc installed tooling. |
| poutine / runner-guard RGS-005 | agentic_commands.yml | Medium | Job on the trigger surface for commands (`issue_comment`/similar) specifies write-level `permissions:` | Reduce to least-privilege permissions or gate write scope behind a maintainer-approval condition. |
| grype | alpine:latest | High | `CVE-2026-18798` in `libcrypto3@3.5.7-r0`, `libssl3@3.5.7-r0` (fix: 3.5.8-r0) | Bump base image / packages to the patched OpenSSL release. |
| grype | 9 container images (alpine:latest, node:lts-alpine, gh-aw-firewall/agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server) | Critical (34), High (172), Medium (312), Low (54), Negligible (27), Unknown (18) — 198 distinct CVEs | Vulnerable OS/library packages baked into pinned container image digests | Update pinned image tags/digests to latest patched releases and re-scan. |
| grant (license policy, strict mode) | alpine:latest, node:lts-alpine, gh-aw-firewall/agent:0.28.16, and other pinned images | unknown (policy violation) | 1,246 license-policy violations, predominantly GPL-2.0-only/GPL-2.0-or-later/LGPL family packages in Alpine/Ubuntu base layers | Either adjust `.poutine.yml`/grant policy to allow accepted OS-level GPL/LGPL licenses, or switch to distroless/minimal base images without the flagged packages. |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Compiler exit code: `1`; report digest `2990715ef132bdcc291f6e81b4678695a66ded8b8b90a585ddcd244d86029d2f`.
- Actionlint summary: "Found 74 issue(s) (74 error(s))" — `shellcheck: 72`, `expression: 2`.
- Grant summary: `✗ grant failed — strict mode: grant found 1246 license policy finding(s) in container images`.
- Grype severity distribution across 9 scanned images: Critical 34, High 172, Medium 312, Low 54, Negligible 27, Unknown 18 (198 distinct CVE IDs).
- Zizmor: 7 High `github-app` findings (one per `cao-evolution*` workflow), 444 Medium `secrets-outside-env`, 33 Medium `artipacked` (dashboard-authoring-corpus.lock.yml only), 309 Low `undocumented-permissions`, plus scattered Low `adhoc-packages`.
- Sample expression error: `.github/workflows/self-care-dashboard-performance.lock.yml:2358:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}`.
- No repository content or credentials were exfiltrated; only counts, severities, and locations are included above. Full raw scanner logs are retained in the workflow run artifacts under `/tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt` (766 KB, not reproduced verbatim here).

Control plane context

- Correlation ID: `34921911705-95`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34921911705

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34922180057) · copilot · auto · 52.3 AIC · ⌖ 9.26 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 3:03 AM UTC

Start with the `.github/workflows/*.md` sources and `.poutine.yml`, using the gh-aw MCP server's `fix` and `compile` tools; do not edit generated `.lock.yml` files. Re-run the compiler and its model, actionlint, shellcheck, zizmor, poutine, runner-guard, grant, grype, and syft checks. Done means preserving workflow behavior while the full security and validation suite passes, or documenting findings that require human action.

Written by the indexing model from the issue text.