[cao-evolution:compiler-security] Compiler and security scan findings across 59 workflows: shellcheck, zizmor, CVEs, license violations

Compiling all 59 gh-aw workflows in `githubnext/gh-aw-cao` at `61537de1` succeeded (0 compiler errors), but the full validation, lint, container, and security-scanner suite failed with exit code 1: 74 actionlint issues (72 shellcheck, 2 expression-schema errors), 2,090 zizmor findings (34 Critical-CVE-adjacent, 231 High, 822 Medium, plus Low/Informational), 1 runner-guard medium finding, 204 unique CVEs across 9 container images (34 Critical, 173 High), and 1,246 grant license-policy violations that made the strict-mode scan fail outright. Highest-severity supported finding: zizmor `github-app` (High) — 58 workflows use `actions/create-github-app-token` in a pattern zizmor flags as dangerous GitHub App token usage; also 34 Critical CVEs in container images (curl/libcurl CVE-2026-19931, CVE-2026-18924 in firewall proxy images; libssl3/libcrypto3 CVE-2026-63073, CVE-2026-75803 in alpine-based images).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `59`
- **Generated lock files checked**: `59`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `property "safe-outputs-app-token" is not defined` in `steps.safe-outputs-app-token.outputs.token` reference | Fix step-id/output reference or generator template producing the GIT_TOKEN expression |
| actionlint (shellcheck) | 18 lock files, "Execute Pi CLI" step | error (SC1003) | Unescaped single quote in generated shell heredoc (`echo 'This is how it'\''s done'`) | Fix quoting in shared template/snippet that emits this example script |
| zizmor | 58 lock files | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` | Review token scope/lifetime handling per zizmor guidance; confirm least-privilege usage |
| zizmor | many lock files | Medium | `secrets-outside-env` (468 occurrences): secrets referenced without dedicated `environment:` | Move secret references into a scoped `environment:` block where feasible |
| zizmor | many lock files | Medium | `artipacked` (33 occurrences): credential persistence through Actions artifacts | Avoid uploading credential-bearing paths as artifacts, or scrub before upload |
| zizmor | many lock files | Low | `undocumented-permissions` (351), `adhoc-packages` (25), `obfuscation` (9) | Add explanatory comments on `permissions:`; pin/avoid ad-hoc package installs; simplify obfuscated expressions |
| zizmor | many lock files | Informational | `anonymous-definition` (355), `template-injection` (9) | Name workflow/job definitions; review template-expansion safety in `pr-reviewer.lock.yml` |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job declares write-level `permissions:` while triggerable by untrusted events | Restrict permissions or gate write access behind explicit approval/environment |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-75803 in `libcrypto3`/`libssl3` (fix: 3.5.8-r0) | Bump base image / rebuild to pick up patched libssl3/libcrypto3 |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16`, `squid:0.28.16` | Critical | CVE-2026-19931, CVE-2026-18924 in `curl`/`libcurl` (fix: 8.22.0-r0) | Upgrade curl/libcurl in firewall image base layer |
| grype | 9 images total | Critical/High/Medium/Low/Negligible | 204 unique CVEs (34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible) across all scanned images | Rebuild/upgrade base images (alpine, node:lts-alpine, gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server) to pull in available fixes |
| grant | 9 images | error (strict mode) | 1,246 license-policy violations (e.g. GPL-2.0-only packages in alpine base layer, mixed-license bundles in firewall/agent image) | Review grant license policy exceptions or replace/rebuild images with policy-compliant package sets |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary:
```
✓ Checked 59 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• expression: 2
• shellcheck: 72
```

Zizmor severity totals (2,090 findings across 59 files): 34 Critical-tagged occurrences of CVE rows appear only in grype output, not zizmor — zizmor's own severities are: 231 High (`github-app`), 822 Medium (`secrets-outside-env` 468, `artipacked` 33, plus other medium rules), 439 Low (`undocumented-permissions` 351, `adhoc-packages` 25, `obfuscation` 9, other), 364 Informational (`anonymous-definition` 355, `template-injection` 9).

Grype: 9 container images scanned via syft SBOMs; 204 unique CVEs found (34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible), concentrated in `alpine:latest`, `node:lts-alpine`, and the `ghcr.io/github/gh-aw-firewall/*` image family.

Grant: `grant found 1246 license policy finding(s) in container images` — strict mode causes the tool to fail (`✗ grant failed`); no license text or copyrighted content reproduced here, only SPDX identifiers already present in scanner output.

Poutine: ran with no output beyond runner-guard delegation shown above (no additional poutine-specific findings recorded in the report).

Full evidence available in the workflow run's `report.txt` artifact (815 KB); this issue includes only bounded, deduplicated excerpts. No token-like or credential-like values were present in the excerpted output.

Control plane context

- Correlation ID: `34988625819-108`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34988625819

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34989560021) · copilot · auto · 54.1 AIC · ⌖ 8.7 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 3:57 PM UTC

Start with the .github/workflows/*.md sources and the workflow run's report.txt artifact; use the gh aw mcp-server fix and compile tools rather than editing generated .lock.yml files. Review the generated diffs and rerun the full compiler, validation, security, license, and image scans. Done means the strict scan passes, or the agent stops with a clear explanation of findings requiring human action.

Written by the indexing model from the issue text.