[cao-evolution:compiler-security] AW Compiler Security Findings: githubnext/gh-aw-cao (compile exit 1)

Compiling all 64 GitHub Agentic Workflow sources in `githubnext/gh-aw-cao` with the full gh-aw compiler/lint/scanner suite failed (exit code 1). Findings span actionlint/shellcheck (94), zizmor (~4,101, incl. 34 critical/236 high entries mostly duplicated across CVE-style rules but real for github-app and secrets-outside-env/artipacked categories), runner-guard (1 medium), grype container CVEs (34 critical, 173 high across 9 images), and grant license-policy violations (1,246, mostly GPL-2.0/MIT findings on base OS packages already permitted upstream). Highest-severity, actionable items: (1) 34 **Critical** CVEs in container base images (alpine, node, gh-aw-firewall images) with available fixed versions, (2) 63 **High** `github-app` zizmor findings for dangerous GitHub App token usage pattern repeated across ~20 workflow lock files, (3) 2 `[expression]` actionlint errors referencing an undefined `safe-outputs-app-token` property. Recommended next action: assign this issue to Copilot to remediate the workflow-source issues (shellcheck quoting, expression type error, github-app token pattern) and bump/pin container image tags to patched digests; grant license findings need policy owner review since most are pre-existing OS-level licenses not introduced by this repo.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `64`
- **Generated lock files checked**: `64`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|-------------|
| actionlint (expression) | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` not defined in `needs.*.outputs` type | Fix the `.md` source expression referencing this undefined output property; recompile |
| actionlint (shellcheck SC1003) | 20+ lock files, "Execute Pi CLI" step | error | Unescaped single quote in example string `echo 'This is how it's done'` | Fix the shared prompt/script source that renders this example string; escape the quote |
| shellcheck (SC2034) | `graders/*-operational-value.sh` (14 files) | warning | Unused variables (WORKFLOW_NAME, SOURCE_PATH, TITLE_PREFIX, DOMAIN, FRAMEWORK, OPERATIONAL_VALUE, OPPORTUNITY, ACCEPTED, METRIC_ID) | Add `export`/use or `# shellcheck disable=SC2034` with rationale in the grader script template |
| zizmor | ~20 lock files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review token scoping/lifetime per zizmor guidance; document or narrow usage |
| zizmor | most lock files | Medium | `secrets-outside-env`: secrets referenced without dedicated `environment:` (2,585 occurrences) | Move secret references into job `environment:` blocks or accept as known pattern with documented rationale |
| zizmor | dashboard-authoring-corpus, design-decision-gate, docs-explanatory-diagrams, others | Medium | `artipacked`: credential persistence risk via `actions/download-artifact` + checkout ordering | Reorder steps or scrub credentials before artifact upload per zizmor doc |
| zizmor | most lock files | Low | `undocumented-permissions` (380), `adhoc-packages` (30), `obfuscation` (9), `template-injection` (11, mostly Informational/Low) | Add comments to `permissions:` blocks; review ad-hoc installs and `${{ '' }}`-style constructs |
| runner-guard | agentic_commands.yml | medium (RGS-005) | Excessive permissions on workflow reachable via untrusted trigger comment parsing | Verify write-permission jobs triggered by `issue_comment`/`pull_request_target` restrict scope appropriately |
| grype | alpine:latest, node:lts-alpine, ghcr.io/github/gh-aw-node, gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, gh-aw-mcpg, github-mcp-server | Critical (34), High (173) | OS/library CVEs with fixed versions available (e.g., CVE-2026-63073 libcrypto3/libssl3, CVE-2026-19931 curl) | Bump base image digests/tags to versions with patched packages; rerun grype |
| grant | 9 container images | policy violation (1,246) | GPL-2.0-only / MIT / other licenses on OS-level packages (busybox, musl, alpine-baselayout, npm deps like tuf-js, yallist) | Confirm license policy scope for base-image OS packages vs application deps; adjust `grant` allowlist or replace flagged packages if in-scope |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 64
Compiled locks: 64
```

Actionlint summary:
```
✓ Checked 64 workflow(s)
⚠ Found 94 issue(s) (94 error(s))
Issues by type:
• shellcheck: 92
• expression: 2
```

Zizmor severity totals (raw finding lines, includes duplicates across repeated jobs/steps):
```
Critical: 34
High: 236
Medium: 2945 (secrets-outside-env: 2585, artipacked: 39, other)
Low: 475 (undocumented-permissions: 380, adhoc-packages: 30, obfuscation: 9, template-injection: 2)
Informational: 395 (anonymous-definition: 386, template-injection: 9)
Unknown: 16
```

Grype severity totals across 9 scanned images (alpine:latest, node:lts-alpine, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server):
```
Critical: 34
High: 173
Medium: 321
Low: 54
Negligible: 27
Unknown: 16
```

Grant: `strict mode: grant found 1246 license policy finding(s) in container images` (exit non-zero).

Poutine/runner-guard: 1 medium finding (RGS-005 in `agentic_commands.yml`).

Full report available in run artifact; digest `b9fc4c9bc75f55026da03eaf7dfcbe5c5ecc87afa0785f4f97475df1d13dcd4f`.

Control plane context

- Correlation ID: `35024939249-114`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35024939249`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35025588597) · copilot · auto · 46.4 AIC · ⌖ 7.32 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 9:44 PM UTC

Start by running the gh-aw MCP server's compile workflow against the 64 `.github/workflows/*.md` sources and review the generated findings. Inspect the shared source behind the `Execute Pi CLI` shellcheck errors, the two expressions using `safe-outputs-app-token`, `graders/*-operational-value.sh`, and `agentic_commands.yml`; review the listed container images and lock-file diffs without editing generated locks. Done means the full compiler and security scan passes or any unresolved policy finding is documented for human review.

Written by the indexing model from the issue text.