[cao-evolution:compiler-security] gh-aw compiler & security scan: 1246 license findings, 34 critical CVEs, 94 actionlint errors

`githubnext/gh-aw-cao` failed a full gh-aw compiler + security-scan pass (exit code 1) across all 64 workflow sources. The failure is driven by the **grant license scanner** (1246 license-policy violations across 9 container images, strict mode) plus a large volume of zizmor/actionlint/shellcheck/grype findings. Highest-severity supported finding: **34 Critical CVEs** (grype) in container images, alongside 63 High `github-app` findings (zizmor) and 173 High CVEs. Two lock files also have unresolved `safe-outputs-app-token` expression errors (actionlint). Poutine and yamllint reported no findings.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `64`
- **Generated lock files checked**: `64`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| grant | 9 container images (alpine, gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server, node) | error | 1246 license-policy violations (GPL-2.0-only, GPL-2.0-or-later, and other copyleft/ambiguous licenses in base-image and npm packages) | Review `grant` policy config; either accept known base-image licenses or pin to images with compliant dependency sets |
| grype | 9 container images | Critical (34), High (173), Medium (321), Low (54), Unknown (16) | CVEs incl. CVE-2026-63073/75803 (libcrypto3/libssl3 in alpine), GHSA-rgw5-rvv9-x895 / GHSA-mh99-v99m-4gvg (brace-expansion), GHSA-r292-9mhp-454m (tar), GHSA-mwp4-54f8-5fhr (ip-address) in gh-aw-firewall/agent | Bump base images / vendored deps to patched versions; re-run grype until clean |
| zizmor | 64 lock files | Medium (2585) | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret-consuming steps into a dedicated `environment:` block per zizmor guidance |
| zizmor | 64 lock files | High (63) | `github-app`: dangerous use of GitHub App tokens (e.g. `uk-ai-advisory.lock.yml:1415`) | Review `actions/create-github-app-token` usage for scope minimization per zizmor docs |
| zizmor | 64 lock files | Informational (386) | `anonymous-definition`: job/workflow definitions without a `name:` | Add descriptive `name:` fields to jobs |
| zizmor | 64 lock files | Low (380) | `undocumented-permissions`: permissions blocks without explanatory comments | Add comments justifying each granted permission |
| zizmor | multiple | Medium (39) | `artipacked`: potential credential/artifact leakage pattern | Review flagged checkout/artifact steps per zizmor docs |
| zizmor | multiple | Low (30) | `adhoc-packages`: ad-hoc package installs (e.g. `npm install -g @earendil-works/pi-coding-agent`) | Pin installs via lockfile/vendored action instead of ad-hoc `run:` install |
| zizmor | multiple | Low/Informational (11) | `obfuscation` (9), `template-injection` (9 info + 2 low) | Review flagged expressions for obfuscated or unsanitized template interpolation |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: write-level `permissions:` combined with an externally-triggerable event | Reduce permissions to read-only or restrict trigger to trusted actors |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2353`, `self-care-pages-health.lock.yml:2259` | error | `safe-outputs-app-token` property not defined in referenced job-outputs object type | Fix upstream `.md` workflow source generating this expression, then recompile |
| actionlint (shellcheck) | `dashboard-authoring-corpus.lock.yml` + 91 similar | error | SC1003: unescaped single quote in embedded shell script (`Execute Pi CLI` step, shared template) | Fix quoting in the shared Pi CLI script template, recompile all affected locks |
| shellcheck (standalone) | 35 files incl. `graders/*-operational-value.sh` | warning | SC1003 (92), SC2034 unused vars (68) | Escape quotes; mark intentionally-unused grader vars with `# shellcheck disable=SC2034` or use them |
| poutine | — | — | No findings | — |
| yamllint | — | — | No findings | — |

Repository working tree also shows 16 `.lock.yml` files with a stale 1-line diff (likely compiler-version drift) and an untracked `.poutine.yml`, suggesting locks need recompilation after source fixes.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 64
Compiled locks: 64
```

Actionlint summary:
```
✓ Checked 64 workflow(s)
⚠ Found 94 issue(s) (94 error(s))
• shellcheck: 92
• expression: 2
```

Grant (license scanner) summary:
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

Zizmor rule counts (by count):
```
2585 Medium secrets-outside-env
386 Info anonymous-definition
380 Low undocumented-permissions
63 High github-app
39 Medium artipacked
30 Low adhoc-packages
9 Low obfuscation
9 Info template-injection
2 Low template-injection
```

Grype severity counts (9 images: alpine, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server, node):
```
Critical: 34, High: 173, Medium: 321, Low: 54, Negligible: 27, Unknown: 16
```

Runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

Poutine: no findings. Yamllint: no findings.

Full report (~27,000 lines) is available in the workflow run artifacts; not reproduced here in full.

Control plane context

- Correlation ID: `35035746768-67`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/35035746768

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35035746768) · copilot · auto · 52.4 AIC · ⌖ 8.13 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 11:47 PM UTC

Start with the .github/workflows/*.md sources, especially agentic_commands.yml and the shared Pi CLI script template, then use the gh aw MCP server's fix and compile tools rather than editing generated .lock.yml files. Re-run the full strict compiler and security scan and review the 64 regenerated locks; done means the reported actionlint, shellcheck, license, CVE, zizmor, runner-guard, grant, grype, and syft findings are resolved or a human blocker is documented.

Written by the indexing model from the issue text.