[cao-evolution:compiler-security] githubnext/gh-aw-cao compiler & security scan: 34 Critical / 236 High findings across image CVEs, licenses, and zizmor github-ap

Compiling `githubnext/gh-aw-cao` (64 workflow sources, 64 lock files) with the full gh-aw compiler and security-scanner suite exited non-zero. Findings span actionlint/shellcheck (92 SC1003 warnings from an escaped-quote pattern in installer scripts), zizmor (34 Critical / 236 High severity items — the High items are all the same `github-app` rule flagging `actions/create-github-app-token` usage across ~52 lock files), runner-guard (1 medium RGS-005 write-permission-on-untrusted-trigger finding), and container scanning (grype: dozens of Critical/High CVEs in `alpine:latest`, the `gh-aw-firewall` images, `gh-aw-mcpg`, `gh-aw-node`, and `github-mcp-server`, all fixable by version bumps; grant: 1,246 license-policy violations, mostly GPL/permissive licenses in base OS packages inside those same images). Highest-severity, highest-return fix: bump the pinned container image tags/digests to pull in patched OpenSSL/libcurl (CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931, CVE-2026-5450) and clean up the SC1003 shell-quoting pattern in the installer script shared by all workflows.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `64`
- **Generated lock files checked**: `64`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint/shellcheck | `dashboard-authoring-corpus.lock.yml` + 25 other lock files | unknown (SC1003) | Unescaped single quote in `echo 'This is how it'\''s done'` example snippet inside a shared installer script (92 occurrences across 26 files) | Fix the quoting in the shared source script that generates this snippet, then recompile |
| zizmor | 52 lock files (e.g. `cao-evolution*.lock.yml`, `self-care*.lock.yml`, `eu-cra-compliance*.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba49...` (v3.2.0) guarded by `if: env.CAO_GITHUB_APP_ID != '' && ...` | Review zizmor's `github-app` guidance; scope/step-permission the token step or add a documented suppression if the conditional guard is an accepted mitigation |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Job specifies write-level `permissions:` while triggered by an event that can be initiated by external users | Restrict permissions or trigger scope per RGS-005 guidance |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3` ``@3``.5.7-r0 (fix 3.5.8-r0) | Bump base image to a digest that includes the patched OpenSSL package |
| grype | `ghcr.io/github/gh-aw-firewall/{squid,api-proxy,cli-proxy}:0.28.16` | Critical | CVE-2026-18924, CVE-2026-19931: `curl`/`libcurl` ``@8``.21.0-r0 (fix 8.22.0-r0); squid also carries the OpenSSL CVEs above | Update `gh-aw-firewall` image tag/digest to a release built on patched Alpine packages |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.21` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3` ``@3``.5.7-r0 | Bump `gh-aw-mcpg` pin to a release with patched OpenSSL |
| grype | `ghcr.io/github/gh-aw-node` | Critical | CVE-2026-18924, CVE-2026-19931: `libcurl` ``@8``.21.0-r0 | Bump `gh-aw-node` base image |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical | CVE-2026-5450: `libc6` ``@2``.36-9+deb12u14; CVE-2026-75803: `libssl3` ``@3``.0.20-1~deb12u2 | Bump `github-mcp-server` pin to a patched release |
| grype | `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803: `libcrypto3`/`libssl3` ``@3``.5.7-r0 | Repin `node:lts-alpine` to a digest with patched OpenSSL |
| grype (High, not shown above) | all 9 scanned images | High | 236 additional High-severity CVEs across `curl`, `openssl`, `bind9-libs`, and related base-image packages | Same remediation path: repin images after upstream patches land |
| grant | 9 container images | unknown | 1,246 license-policy violations, predominantly GPL-2.0/GPL-3.0 and permissive licenses (MIT, ISC, BSD, Apache-2.0, MPL-2.0) in base-OS and toolchain packages bundled in the scanned images | Review `.poutine.yml`/grant policy against actually-required licenses; adjust the policy or images if these are false positives for infra tooling |
| poutine | — | none | No findings emitted | — |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Compiler summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 64`, `Compiled locks: 64`.
- Severity totals from zizmor across all 64 files: 34 Critical, 236 High, 2,945 Medium, 475 Low, 395 Informational, 16 Unknown.
- License policy violations (grant): 1,246 total across 9 scanned container images.
- Full raw compiler/scanner output (~1.6 MB) and generated diff/status are retained in the workflow run's `cao-evolution-compiler-security` evidence artifact; no token-like or credential-like values were present in the excerpts above.

Control plane context

- Correlation ID: `35030491116-115`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35030491116`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35031058370) · copilot · auto · 45.9 AIC · ⌖ 11.3 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 10:43 PM UTC

Start with the .github/workflows/*.md source files and the gh aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Run the full compiler and security-scanner suite, then review the generated lock-file diffs and scanner output. Done means the requested findings are addressed safely, existing behavior is preserved, and strict compilation and validation pass.

Written by the indexing model from the issue text.