[cao-evolution:compiler-security] gh-aw compiler: 74 actionlint issues, 1,188 zizmor findings, 609 container CVEs, 1,246 license violations in githubnext/gh-aw-ca

Compiled all 53 gh-aw workflow sources in `githubnext/gh-aw-cao` (compiler exit code 1, not clean). Findings across tools: **actionlint** 74 issues (72 shellcheck, 2 expression), **zizmor** 1,188 findings (52 High `github-app` token misuse, 477 Medium, 337 Low, 322 Informational) across 53 lock files, **runner-guard** 1 Medium taint finding, **grype** 609 container CVEs (34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible) across 9 scanned images, and **grant** 1,246 license policy violations (mostly GPL-family licenses in Alpine/Ubuntu base images) causing a hard `grant failed` exit. **poutine** reported no findings. Highest-severity supported finding: zizmor `github-app` (High) — dangerous use of GitHub App tokens, repeated in 52 locations across nearly every workflow lock file, plus 34 Critical CVEs (curl/libcurl/openssl family) in container base images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor | all 53 lock files (52 occurrences) | High | `github-app`: dangerous use of GitHub App tokens | Scope the App token generation step per zizmor docs; avoid exposing it broadly to job steps |
| zizmor | 44 lock files (444 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `env:` block | Move secret references into a dedicated `env:` mapping |
| zizmor | multiple lock files (33 occurrences) | Medium | `artipacked`: artifact/credential persistence risk | Review artifact upload/checkout steps for leaked credentials |
| zizmor | multiple lock files (309 occurrences) | Low | `undocumented-permissions`: permissions blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | multiple lock files (25 occurrences) | Low | `adhoc-packages`: ad hoc package installs | Pin package versions / use lockfiles |
| zizmor | multiple lock files (313 occurrences) | Informational | `anonymous-definition`: workflow/job lacks a `name:` | Add explicit `name:` fields |
| zizmor | 9 lock files | Informational | `template-injection`: potential expression injection | Quote/sanitize interpolated expressions |
| actionlint (shellcheck) | `dashboard-authoring-corpus.lock.yml` + others (72 occurrences) | error (SC1003) | Unescaped single quote in embedded shell script ("Execute Pi CLI" step) | Escape single quotes as `'\''` in the generated script template |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` property not defined in step-outputs object type | Fix expression/output wiring in compiler template for these workflows |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` combined with untrusted trigger (`issue_comment`/`pull_request_target`-class event) | Narrow permissions to read-only or restrict trigger scope |
| grype | alpine:latest, gh-aw-firewall/{squid,api-proxy,cli-proxy}, gh-aw-mcpg, gh-aw-node, github-mcp-server, node:lts-alpine (9 images, 609 CVEs total) | Critical (34), High (173), Medium (321), Low (54), Negligible (27) | OS/library CVEs, notably `CVE-2026-63073`/`CVE-2026-75803` (libcrypto3/libssl3/openssl) and `CVE-2026-19931`/`CVE-2026-18924` (curl/libcurl) | Rebuild/update base images to pull patched package versions (e.g. `libssl3 3.5.8-r0`, `curl 8.22.0-r0`) |
| grant | all 9 scanned images (1,246 findings) | policy violation (strict mode) | GPL-family and other license-policy violations in base-image packages (busybox, alpine-baselayout, bash, libperl5, etc.) | Review `grant` license policy allowlist/denylist for base-image packages, or replace non-compliant base images |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Actionlint summary: checked 53 workflow(s), found 74 issue(s) (72 shellcheck, 2 expression).
- Zizmor summary: 1,188 findings across 53 files (52 High, 477 Medium, 337 Low, 322 Informational).
- Runner-guard: 1 Medium finding (`agentic_commands.yml`, RGS-005).
- Syft: scanned 9 container images, generating SBOMs for all.
- Grype: 609 total vulnerability findings across 9 images (34 Critical / 173 High / 321 Medium / 54 Low / 27 Negligible).
- Grant: `grant failed` — strict mode found 1,246 license policy finding(s) in container images.
- Poutine: no findings reported.
- Full raw report available in the workflow run's `/tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt` evidence artifact (767 KB, 10,865 lines); not reproduced in full here to keep this issue bounded. No token-like or credential-like values were observed in the tool output.

Control plane context

- Correlation ID: `34963402845-104`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34963402845

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34963954203) · copilot · auto · 69.2 AIC · ⌖ 8.73 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 11:57 AM UTC

Start with the report at /tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt and the workflow sources under .github/workflows/*.md, especially agentic_commands.yml and the two self-care dashboard files named in the findings. Use the gh-aw MCP server's fix and compile tools, then rerun the listed compiler and security scans. Done means generated lock files reflect the source changes and the full validation passes without findings.

Written by the indexing model from the issue text.