[cao-evolution:compiler-security] compiler/security findings: 2 expr errors, 144 SC1003, 468 zizmor, 1 RGS-005, 625 grype, 1246 grant violations

Compiling all 59 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the gh-aw compiler's full validation, lint, container, and security-scanner suite exited with a **non-zero exit code (1)** and found findings across multiple tools: 2 actionlint expression errors, 144 shellcheck `SC1003` quoting notes across 20 lock files, 468 zizmor `secrets-outside-env` (Medium) findings, 33 zizmor `artipacked` (Medium) credential-persistence findings, 1 poutine/runner-guard `RGS-005` excessive-permissions-on-untrusted-trigger warning, 625 grype container vulnerability findings (34 Critical, 173 High, 321 Medium, 54 Low) across 9 images, and 1,246 grant license-policy violations concentrated in the `node:lts-alpine` image. Highest-severity supported finding: grype **Critical** CVEs (e.g. `CVE-2026-75803`, `CVE-2026-63073`) in `libssl3`/`libcrypto3` on `node:lts-alpine` and `alpine:latest`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `59`
- **Generated lock files checked**: `59`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `steps.safe-outputs-app-token` referenced but not defined in step outputs object type | Fix or remove the stale `safe-outputs-app-token` step reference in the workflow source that generates these locks; recompile |
| actionlint + shellcheck (SC1003) | 20 lock files incl. `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance-*.lock.yml`, `self-care-*.lock.yml` | info/error (144 instances) | Unescaped single quote in embedded `echo 'This is how it'\''s done'` example string inside the "Execute Pi CLI" step script | Escape or rephrase the example string in the shared script template that emits this step; recompile all affected locks |
| zizmor | 21+ lock files (e.g. `pr-sous-chef.lock.yml`, `eu-cra-compliance-package-maintainer.lock.yml`, `mattpocock-skills-reviewer.lock.yml`, `design-decision-gate.lock.yml`) | Medium (468 findings) | `secrets-outside-env`: secrets referenced directly in `run`/`env` without a dedicated `environment:` | Move secret references behind a GitHub Environment per zizmor guidance ((docs.zizmor.sh/redacted) |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `dependabot-release-train-updater.lock.yml`, others | Medium (33 findings) | `artipacked`: checkout step persists credentials that can leak via uploaded artifacts | Set `persist-credentials: false` (or scope/clear it) on checkout steps preceding artifact uploads ((docs.zizmor.sh/redacted) |
| poutine / runner-guard | `agentic_commands.yml` | Medium | `RGS-005`: job grants write-level `permissions:` while triggered by an externally-initiable event (`pull_request_target`/`issue_comment`) | Narrow permissions to read-only for untrusted-trigger jobs, or gate write steps behind an approval/environment check |
| grype | `node:lts-alpine`, `alpine:latest` | Critical (34) | OpenSSL `libssl3`/`libcrypto3` CVEs (e.g. `CVE-2026-75803`, `CVE-2026-63073`, `CVE-2026-63072`, `CVE-2026-54874`, `CVE-2026-18798`, `CVE-2026-14457`, `CVE-2026-14456`) fixed in `3.5.8-r0` | Bump base image tag/digest to a patched Alpine release |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `node:lts-alpine` | High (173) | Go stdlib CVEs (`GO-2026-6090`, `GO-2026-6089`, `GO-2026-5972`, `GO-2026-5942`, `GO-2026-5026`), npm advisories (`brace-expansion`, `tar`, `ip-address`) | Upgrade Go stdlib / rebuild `gh-aw-mcpg` on a patched Go toolchain; bump vulnerable npm packages in `node:lts-alpine` |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `node:lts-alpine`, others | Medium (321) | `GO-2026-6218`, `GO-2026-6091`, `GO-2026-5856`, npm `undici`/`ip-address` GHSAs, Alpine `busybox`/`ssl_client` CVE-2025-60876 | Same as above — track upstream fixed versions per advisory link |
| grype | multiple images | Low (54) | Lower-severity package CVEs across firewall/proxy/mcp images | Track for next scheduled image refresh |
| grant | `node:lts-alpine` | policy violation (1,246) | License-policy violations spanning `ISC` (364), `MIT` (285), `Apache-2.0` (66), `GPL-2.0-only` (62), `BlueOak-1.0.0` (55), `BSD-2-Clause` (32), `GPL-3.0-or-later` (18), `LGPL-2.1-or-later` (14), and others including `ssl_client@1.37.0-r31 (GPL-2.0-only)` | Review and update the grant license allow-list/policy (`.grant.yaml` or equivalent) to reflect intentionally accepted licenses, or replace flagged packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Full compiler/scanner output (815KB) was captured at `/tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt` during the run (not reproduced in full here). Section markers within that log:

- Line 62: actionlint (with shellcheck/pyflakes) on 59 files
- Line 435: zizmor security scanner on 59 files
- Line 9592: poutine security scanner / runner-guard taint analysis
- Line 9598: syft SBOM scanner on 9 container images (alpine:latest, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}:0.28.16, ghcr.io/github/gh-aw-mcpg:v0.4.21, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server:v1.12.1, node:lts-alpine)
- Line 9608: grype vulnerability scanner on the same 9 images
- Line 10234: grant license scanner on the same 9 images
- Line 11481: yamllint on 59 files; shellcheck on 3584 run-step resources

No token-like or credential-like values were present in the excerpted output.

Control plane context

- Correlation ID: `34982950702-58`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34982950702`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34982950702) · copilot · auto · 45.9 AIC · ⌖ 9.1 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 2:58 PM UTC

Start with the named .github/workflows/*.md sources and the compiler report at /tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt, then use the gh-aw MCP server's fix and compile tools. Do not edit generated .lock.yml files. Done means the full compiler and security-scanner suite passes without findings, or an unresolved human-action item is clearly explained.

Written by the indexing model from the issue text.