[cao-evolution:compiler-security] gh-aw compiler and security scan findings: 74 lint issues, 204 CVEs, 1246 license findings

The gh-aw compiler failed (exit code 1) validating all 53 workflows in `githubnext/gh-aw-cao`: 74 actionlint issues (72 shellcheck, 2 expression-type errors), 1 runner-guard finding (RGS-005 excessive permissions on untrusted trigger), 204 unique CVEs across 9 scanned container images (34 Critical, 173 High via grype), and 1,246 license-policy findings (`grant` strict mode). No poutine findings beyond the explicitly acknowledged/skipped rule. Highest-severity supported finding: multiple Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803) in `alpine:latest` base packages `libcrypto3`/`libssl3`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 20 `.lock.yml` files (e.g. `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-*.lock.yml`, `self-care*.lock.yml`) | error (SC1003) | Unescaped single quote in embedded shell heredoc (`echo 'This is how it'\''s done'`) | Fix quoting in the shared shell snippet source (`.md`) that generates this heredoc; recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2358`, `self-care-pages-health.lock.yml:2264` | error | `safe-outputs-app-token` property not defined in step-outputs object type | Correct the expression/property reference in the workflow source; likely a stale/incorrect step-output key |
| runner-guard | `.github/workflows/agentic_commands.yml:1` | medium (RGS-005) | Job declares write-level `permissions:` while triggered by an event reachable by external users (`pull_request_target`/`issue_comment`-class trigger) | Scope down permissions for that job or gate write access behind an authorization check |
| grype | 9 container images (`alpine:latest`, `ghcr.io/github/gh-aw-firewall/*:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`) | 34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible (204 unique CVEs) | Vulnerable packages with available fixes (e.g. `libcrypto3@3.5.7-r0`→`3.5.8-r0` for CVE-2026-63073/CVE-2026-75803/CVE-2026-18798/CVE-2026-63076) | Bump pinned base/tool image digests to versions carrying the patched packages |
| grant | Same 9 images | error (strict mode) | 1,246 license-policy findings (e.g. GPL-2.0-only packages `busybox`, `apk-tools`, `alpine-baselayout` in `alpine:latest`; mixed BSD/GPL/custom licenses in firewall images) | Review `.grant.yaml` policy against actual base-image licenses; either adjust allowed-license policy deliberately or swap flagged base images |
| poutine | none beyond acknowledged `untrusted_checkout_exec`/`activation` skip in `.poutine.yml` | — | — | No action |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary (`summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))

i Issues by type:
• shellcheck: 72
• expression: 2
```

grant summary:
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

Sample grype Critical finding (alpine:latest):
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
```

Sample runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Diff produced by recompiling (42 lock files touched, no functional workflow-source changes; report as `git-status.txt`/`diff-stat.txt` in run evidence — not applied by this worker):
```
42 files changed, 57 insertions(+), 43 deletions(-)
```

Full raw scanner output (767 KB) is retained in the workflow run's evidence artifacts, not reproduced here in full to keep this issue bounded.

Control plane context

- **Correlation ID**: `34958308630-103`
- **Central repository**: `githubnext/gh-aw-cao`
- **Control plane run URL**: `https://github.com/githubnext/gh-aw-cao/actions/runs/34958308630`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34958835787) · copilot · auto · 38.4 AIC · ⌖ 9.28 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 10:56 AM UTC

Start with the 53 `.github/workflows/*.md` sources and the reported locations in `.github/workflows/agentic_commands.yml`; use `gh aw` with its `fix` and `compile` tools rather than editing generated `.lock.yml` files. Review related `.grant.yaml` and `.poutine.yml` policy files, then rerun the full compiler and security scan. Done means the generated locks and all required scans are clean, or any unsafe finding is documented for human action.

Written by the indexing model from the issue text.