[cao-evolution:compiler-security] Compiler and security scan findings: 53 workflows, actionlint expression/shellcheck errors, zizmor High/Medium findings, 34 Crit

Compiling all 53 GitHub Agentic Workflows in `githubnext/gh-aw-cao` at `c2719f5` failed (exit code 1) with actionlint expression errors, a security-scanner sweep flagging 837 zizmor findings (52 High, 477 Medium, 337 Low — mostly missing dedicated environments for secrets and undocumented permissions), 1246 grant license-policy violations across 9 container images, and 594 grype container CVEs (34 Critical, 172 High) including unpatched OpenSSL CVEs in `alpine:latest`. Highest-severity supported finding: **Critical** — CVE-2026-63073/CVE-2026-63074/CVE-2026-75803 in `libcrypto3`/`libssl3` (alpine:latest, fix available at 3.5.8-r0).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding (count) | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | unknown | `error: [expression]` — `safe-outputs-app-token` not defined on job outputs object (2) | Fix the compiler template/source generating these two lock files so the referenced output key exists on the upstream job before it is read. |
| actionlint + shellcheck | 18 lock files (e.g. `eu-cra-compliance*.lock.yml`, `uk-ai-advisory*.lock.yml`, `software-development-practices*.lock.yml`, `dashboard-authoring-corpus.lock.yml`) | unknown | SC1003 — unescaped single quote in generated "Execute Pi CLI" step example string (72 occurrences, same root cause) | Fix the single quoting in the shared Pi CLI step template so the example string uses `'\''` correctly; recompile all affected workflows. |
| zizmor | 53 lock files | High | `github-app`: dangerous use of GitHub App tokens (52) | Review each `actions/create-github-app-token` usage for scope/lifetime; confirm token is not persisted or logged. |
| zizmor | 53 lock files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment (444) | Route secret references through a job `environment:` block per zizmor guidance. |
| zizmor | 53 lock files | Medium | `artipacked`: credential persistence through GitHub Actions artifacts (33) | Ensure `actions/checkout` steps do not persist credentials in uploaded artifacts (set `persist-credentials: false` or scrub before upload). |
| zizmor | 53 lock files | Low | `undocumented-permissions`: permissions blocks without explanatory comments (309) | Add comments explaining each `permissions:` grant in the workflow source templates. |
| zizmor | multiple lock files | Low | `adhoc-packages`: ad-hoc package installation (25) | Pin package installs to reproducible sources/versions where practical. |
| zizmor | `optimization-ai-credit-auditor.lock.yml`, `optimization-ai-credit-optimizer.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` | Low | `obfuscation`: obfuscated usage of GitHub Actions features (3) | Simplify the flagged expression/step to avoid obfuscated feature use. |
| runner-guard | `.github/workflows/agentic_commands.yml` | Medium (RGS-005) | Write-level permissions declared alongside an untrusted-trigger-capable event context (1) | Confirm the trigger cannot be user-initiated with write scope; otherwise narrow permissions or split jobs. |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-63074, CVE-2026-75803 in `libcrypto3`/`libssl3` 3.5.7-r0 (fix 3.5.8-r0) | Bump the base image or force an `apk upgrade` for `libssl3`/`libcrypto3` before build. |
| grype | `alpine:latest` | High | CVE-2026-18798, CVE-2026-63076, CVE-2026-14456/14457, CVE-2026-63072/63075, CVE-2026-54874 in `libcrypto3`/`libssl3` (fix 3.5.8-r0) | Same OpenSSL package upgrade as above. |
| grype | 8 remaining images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine`) | Critical/High/Medium | 594 total CVEs across images (34 Critical, 172 High, 312 Medium, 54 Low, 27 Negligible, 18 Unknown) | Rebuild/rebase each pinned image tag to its latest patched digest; re-run grype to confirm zero Critical/High before merge. |
| grant | 9 container images | unknown | 1246 license-policy violations (dominant: ISC 364, MIT 285, Apache-2.0 66, GPL-2.0-only 62, BlueOak-1.0.0 55, plus copyleft GPL/LGPL variants) | Review `.poutine.yml`/grant license allow-list against actual image contents; either update policy to accept vetted licenses or replace non-conforming base images/packages. |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Compiler run summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 53`, `Compiled locks: 53`.
- Actionlint summary: `Checked 53 workflow(s)`, `Found 74 issue(s) (74 error(s))` — `expression: 2`, `shellcheck: 72`.
- Zizmor totals across the 53 lock files: 52 High, 477 Medium, 337 Low (866 total findings; no Critical).
- Grype totals across 9 scanned container images (`alpine:latest`, `ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`): 34 Critical, 172 High, 312 Medium, 54 Low, 27 Negligible, 18 Unknown.
- Grant (license scanner) failed strict mode with 1246 findings across the same 9 images; a new `.poutine.yml` file appeared untracked in the working tree (`git status` showed `?? .poutine.yml`), alongside pre-existing local modifications to 41 `.lock.yml` files from a prior partial compile — these local diffs are compiler-run artifacts, not reviewed source changes, and are not part of this report's findings.
- No secret-like or credential-like strings were present in the tool output reviewed for this report.

Control plane context

- Correlation ID: `34929284495-97`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34929284495

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34929645242) · copilot · auto · 48.3 AIC · ⌖ 13.8 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 4:58 AM UTC

Start with the workflow sources under .github/workflows/*.md and .github/workflows/agentic_commands.yml, using gh aw mcp-server's fix and compile tools; do not edit generated .lock.yml files. Recompile all 53 workflows and run the listed validation and security scans. Done means the compiler and scans pass, or any unsafe finding is explicitly explained.

Written by the indexing model from the issue text.