[cao-evolution:compiler-security] Compiler + security scan findings: 53 workflows, 1246 license violations, 498 container CVEs, 52 zizmor High findings

Compiler exit code 1 on 53 gh-aw workflow sources (53 compiled locks). Findings across actionlint, zizmor, runner-guard, grype, and grant: 2 actionlint expression errors, 72 shellcheck SC1003 quoting notes, 52 zizmor High `github-app` findings (42 workflows), 444 zizmor Medium `secrets-outside-env` findings (53 workflows), 1 runner-guard Medium finding, 498 grype container CVEs (34 Critical / 130 High / 280 Medium / 54 Low, 198 unique CVEs across 9 images), and 1246 `grant` license-policy violations across 9 container images (strict mode failed). Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803) in `libssl3`/`libcrypto3` on `alpine:latest`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `steps.safe-outputs-app-token.outputs.token` referenced but `safe-outputs-app-token` step not defined in that job's step-outputs type | Fix the compiler template so the `safe-outputs-app-token` step id/outputs are declared wherever `GIT_TOKEN` falls back to it, or remove the dangling reference |
| actionlint (shellcheck SC1003) | 18 lock files (e.g. eu-cra-compliance*, self-care-accessibility-checker, software-development-practices*, uk-ai-advisory*) | info (72 instances) | Unescaped single quote in an example string (`echo 'This is how it's done'`) inside a shared generated script snippet | Escape the quote in the shared template source (`echo 'This is how it'\''s done'`) and recompile |
| zizmor `github-app` | 42 lock files (52 instances, e.g. cao-evolution*, self-care*, eu-cra-compliance*, optimization*, uk-ai-advisory*) | High | `actions/create-github-app-token@bcd2ba4...` used without scoping/expiry safeguards zizmor flags as dangerous GitHub App token usage | Review token permission scoping and short-lived usage per zizmor's `github-app` guidance; document justification or narrow scopes in the workflow source |
| zizmor `secrets-outside-env` | all 53 lock files (444 instances) | Medium | Secrets referenced directly in `run`/`env` without a dedicated `environment:` | Move secret-consuming steps into a scoped `environment:` per zizmor's `secrets-outside-env` guidance, or accept as a known pattern for generated workflows |
| zizmor `undocumented-permissions` / `anonymous-definition` / `adhoc-packages` | many lock files | Low / Informational | Missing permission comments, unnamed job/workflow definitions, ad-hoc package installs | Low priority; add comments/names where practical |
| runner-guard RGS-005 | `.github/workflows/agentic_commands.yml` | Medium | Flags a `permissions:` write grant on an untrusted-trigger job; trigger match appears to fire on a header comment line (`# gh-aw-commands: ...`), not an actual job body — verify before acting | Confirm whether this is a scanner false positive on the metadata comment; if real, scope down permissions for that trigger |
| grype (container CVEs) | `alpine:latest` (libssl3/libcrypto3), `ghcr.io/github/gh-aw-firewall/agent:0.28.16` (bind9-libs and others), plus 7 other images | Critical (34), High (130), Medium (280), Low (54) | 198 unique CVEs; most severe are OpenSSL CVEs in `libssl3`/`libcrypto3@3.5.7-r0` on `alpine:latest` (fix available: `3.5.8-r0`) | Bump base images / pinned digests to versions with patched packages; rerun grype to confirm clean |
| grant (license policy, strict mode) | 9 container images (alpine, gh-aw-firewall/agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, node:lts-alpine) | error (1246 findings) | GPL-2.0-only packages (e.g. `busybox`, `alpine-baselayout`, `libapt-pkg6.0`) and other flagged licenses present in base/tool images, causing `grant` strict-mode failure | Review `grant` policy allowlist for these transitively-included OS packages, or update `.poutine.yml`/grant config exceptions with justification; confirm no distributable license conflict |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary from compiler run:

```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

zizmor: ran on 53 files; findings include 52 High `github-app`, 444 Medium `secrets-outside-env`, plus Low/Informational `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`.

runner-guard: 1 Medium finding (`RGS-005`) on `.github/workflows/agentic_commands.yml`.

grype: ran on 9 container images; 498 total CVE findings (34 Critical, 130 High, 280 Medium, 54 Low; 198 unique CVEs). Example critical findings on `alpine:latest`:
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
```

grant (license scanner, strict mode): failed with 1246 license policy findings across 9 images, e.g.:
```
alpine:latest:1:1: error: license policy violation: alpine-baselayout-data@3.7.2-r1 (GPL-2.0-only)
alpine:latest:1:1: error: license policy violation: busybox@1.37.0-r31 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/agent:0.28.16:1:1: error: license policy violation: libapt-pkg6.0@2.4.14 (GPL-2.0-or-later)
```
Final line: `✗ grant failed / strict mode: grant found 1246 license policy finding(s) in container images`

No token-like or credential-like values observed in the report requiring redaction.

Control plane context

- Correlation ID: `34938400785-99`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34938400785`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34939027634) · copilot · auto · 46.5 AIC · ⌖ 13.9 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 7:16 AM UTC

Start with the .github/workflows/*.md sources and .github/workflows/agentic_commands.yml; do not edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, then run the listed compiler and security scans. Done means the full compiler, validation, and security scan passes cleanly, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.