[cao-evolution:compiler-security] githubnext/gh-aw-cao: compiler validation findings (actionlint, zizmor, grype, grant)

Compiled all 65 gh-aw workflow sources (65 generated lock files) in `githubnext/gh-aw-cao` with the full compiler validation, actionlint, zizmor, poutine, runner-guard, grype, syft, and grant suite. The compiler exited non-zero (`1`). Findings span 3 actionlint expression errors, 92 actionlint/shellcheck issues, 2 zizmor severity bands worth escalating (64 High "dangerous use of GitHub App tokens", 2668 Medium "secrets referenced without a dedicated environment"), 1 runner-guard Medium finding (excessive permissions on an untrusted-trigger workflow), 34 Critical / 173 High grype container CVEs across 9 images, and a hard `grant` license-scanner failure (1246 license policy findings in container images). No poutine findings were reported. Highest-severity supported finding: **Critical** grype CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in `libcrypto3`/`libssl3`) in the `alpine:latest` and gh-aw firewall/proxy images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | `optimization-token-optimizer.lock.yml`, `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Undefined properties referenced in expressions (`token_eligible`, `safe-outputs-app-token`) — 3 occurrences | Regenerate from `.md` sources after fixing the referenced step outputs/context keys, then recompile |
| actionlint + shellcheck | 23 `.lock.yml` files ("Execute Pi CLI" step) | error (SC1003) | Unescaped single quote in an example shell string (`echo 'This is how it'\''s done'`) — 92 occurrences | Fix the quoting in the shared `.md` source that generates the "Execute Pi CLI" step, then recompile all affected workflows |
| shellcheck (graders) | `./graders/*-operational-value.sh` (multiple) | warning (SC2034) | Unused shell variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `DOMAIN`, `FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) | Export or use the variables, or prefix with `_` if intentionally unused |
| zizmor | 15+ `.lock.yml` files | High | `github-app`: dangerous use of GitHub App tokens near `actions/create-github-app-token` — 64 occurrences | Review token scoping/lifetime per zizmor guidance (docs.zizmor.sh/audits/#github-app) |
| zizmor | Most `.lock.yml` files | Medium | `secrets-outside-env`: secrets referenced without a dedicated environment — 2,668 occurrences | Consider moving secret-consuming jobs to a dedicated GitHub Environment |
| zizmor | Multiple `.lock.yml` files | Medium | `artipacked`: credential persistence through GitHub Actions artifacts | Avoid persisting credentials in uploaded artifacts per zizmor guidance |
| zizmor | Informational/Low findings | Informational/Low | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `template-injection`, `obfuscation` — 401/427/386/30/9 occurrences respectively | Lower priority; address opportunistically |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: job has write-level `permissions:` on a workflow triggered by an untrusted event (`issue_comment`/`pull_request_target`-class trigger) | Scope permissions down or move privileged steps to a job gated by approval |
| poutine | — | — | No findings reported | None |
| grype | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/agent:0.28.16`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` (9 images) | Critical (34) / High (173) / Medium (321) / Low (54) / Negligible (27) | CVEs in base OS and npm packages, e.g. CVE-2026-63073/CVE-2026-75803 (`libcrypto3`/`libssl3`, Critical), CVE-2026-18798 (High), GHSA-rgw5-rvv9-x895 / GHSA-mh99-v99m-4gvg (`brace-expansion`, High) | Bump pinned base images and vendored npm packages to patched versions where fixes are listed |
| grant | Same 9 container images | error (strict mode) | 1,246 license-policy findings (mostly GPL-2.0-only/-or-later, MIT, Apache-2.0, and complex multi-license SPDX expressions from OS packages and npm deps) causing `grant failed` | Review `.grant.yaml` license allow-list against the actual third-party licenses shipped in these base images, or accept/waive per policy |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary (`summary.txt`):
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

Actionlint summary:
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

zizmor severity totals (across 65 files): 64 High, 2,668 Medium, 427 Low, 401 Informational (0 Critical).

grype severity totals (across 9 images): 34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible.

grant: `strict mode: grant found 1246 license policy finding(s) in container images` → `✗ grant failed`.

No token-like or credential-like values were present in the sampled tool output; none were redacted.

Control plane context

- Correlation ID: `35042591412-68`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35042591412`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35042591412) · copilot · auto · 56.4 AIC · ⌖ 9.51 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 1:25 AM UTC

Start with .github/workflows/*.md, the shared source for the Execute Pi CLI step, agentic_commands.yml, the grader scripts, and .grant.yaml; do not edit generated .lock.yml files. Run the full compiler and security scan first, then use the gh-aw MCP server's fix and compile tools to address the reported findings. Done means the strict compiler and listed security scans pass, or any unfixable finding is explicitly explained.

Written by the indexing model from the issue text.