[cao-evolution:compiler-security] gh-aw compiler security scan findings: 74 actionlint issues, 34 Critical CVEs, 1,246 license findings

The gh-aw compiler for `githubnext/gh-aw-cao` exited with code 1 across all 53 workflow sources / 53 generated lock files. Findings span four categories: **actionlint** (74 errors: 72 shellcheck notes + 2 expression-type errors), **zizmor** (52 High, 477 Medium, 337 Low security-pattern findings, dominated by 52 `github-app` dangerous-token-use warnings), **poutine/runner-guard** (1 Medium finding, excessive permissions on an untrusted-trigger job), and container supply chain scanning (**grype**: 34 Critical / 173 High / 321 Medium CVEs across 9 images, 204 unique CVE IDs; **grant**: 1,246 license-policy violations causing a hard scanner failure in strict mode). Highest severity: Critical CVEs (e.g. CVE-2026-18924, CVE-2026-19931, CVE-2026-63073, CVE-2026-75803, CVE-2026-5450) in base images `alpine:latest`, `ghcr.io/github/gh-aw-firewall/*`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, and `ghcr.io/github/github-mcp-server`, none of which are fixable from this repository's workflow sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | many `.lock.yml` steps, e.g. `uk-ai-advisory*.lock.yml` (Execute Pi CLI) | unknown | SC1003: literal `'` inside single-quoted `echo` needs escaping (`echo 'This is how it'\''s done'`) | Fix quoting in the source `.md` step scripts, then recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2358`, `self-care-pages-health.lock.yml:2264` | error | property `safe-outputs-app-token` not defined in step-outputs object type | Correct the referenced step-output/context expression in the `.md` source |
| zizmor | `*.lock.yml` (52 occurrences, e.g. `cao-evolution-catalog-advisor.lock.yml:1928`, `uk-ai-advisory.lock.yml:1418`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Review token scoping/lifetime per zizmor's `github-app` audit guidance |
| zizmor | many `.lock.yml` jobs | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into a job with a declared `environment:` |
| zizmor | many `.lock.yml` jobs | Low/Info | `undocumented-permissions`, `adhoc-packages`, `anonymous-definition` | Lower priority; add comments/pin as convenient |
| poutine / runner-guard | `.github/workflows/agentic_commands.yml` | Medium (RGS-005) | Excessive permissions (write-level) on a job reachable from an untrusted trigger | Reduce permissions or restrict trigger scope for that job |
| grype | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/squid:0.28.16` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3`/`openssl` 3.5.7-r0 (fix: 3.5.8-r0) | Bump base image / apk packages to patched versions upstream |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16` | Critical | CVE-2026-18924, CVE-2026-19931: `curl`/`libcurl` 8.21.0-r0 (fix: 8.22.0-r0) | Bump base image / apk packages upstream |
| grype | `ghcr.io/github/gh-aw-node` | Critical | CVE-2026-18924, CVE-2026-19931: `libcurl` 8.21.0-r0 (fix: 8.22.0-r0) | Bump base image upstream |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical | CVE-2026-5450: `libc6` 2.36-9+deb12u14 (no fix yet published) | Track upstream Debian security advisory; no repo-side action available |
| grype | 9 images total | High/Medium | 173 High + 321 Medium additional CVEs (libexpat, docker-cli, nghttp2-libs, busybox, etc.) | See raw evidence; batch-update pinned image digests as upstream fixes land |
| grant | 9 images total | policy | 1,246 license-policy findings causing `grant failed` in strict mode (e.g. GPL-2.0-only in alpine base packages, mixed licenses in `gh-aw-firewall/agent`) | Review `.poutine.yml`/grant policy config; confirm GPL components are acceptable or adjust the policy allow-list |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

Zizmor severity distribution across 53 lock files: 52 High, 477 Medium, 337 Low/Info.

Poutine/runner-guard: 1 Medium finding (RGS-005, `.github/workflows/agentic_commands.yml`).

Grype severity distribution across 9 container images (204 unique CVE IDs): 34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible, 16 Unknown.

Grant: `grant failed` — strict mode found 1,246 license policy findings across the 9 scanned container images.

Full deterministic evidence (`summary.txt`, `exit-code.txt`, `report.txt`, `git-status.txt`, `diff-stat.txt`, `result.json`) was captured at `/tmp/gh-aw/agent/cao-evolution-compiler-security/` in the run that produced this report. No token-like or credential-like values were observed in the captured output.

Control plane context

- **Correlation ID**: 34942706700-52
- **Central repository**: githubnext/gh-aw-cao
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/34942706700

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34942706700) · copilot · auto · 57.6 AIC · ⌖ 8.13 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 8:02 AM UTC

Start with the `.github/workflows/*.md` sources and `.github/workflows/agentic_commands.yml`; do not edit generated `.lock.yml` files. Review `.poutine.yml` and the reported compiler output, then use the gh-aw MCP `fix` and `compile` tools to identify repository-fixable findings. Done means the full strict compiler and security scan passes, or external findings are clearly documented as requiring upstream action.

Written by the indexing model from the issue text.