[cao-evolution:compiler-security] gh-aw compiler & security scan findings: 65 workflows, exit code 1 (95 actionlint, 3,741 zizmor, 550 CVEs, 1,246 license finding

Compiling all 65 `githubnext/gh-aw-cao` workflows found the compiler run exited **non-zero (1)**. Findings span 5 categories: **95 actionlint issues** (92 shellcheck, 3 expression errors), **zizmor scanner** (34 Critical, 237 High, 2,989 Medium, 481 Low, 401 Informational — dominated by `secrets-outside-env` and `github-app` dangerous-token-use rules), **runner-guard** (1 Medium excessive-permissions on `pull_request_target`/`issue_comment`-triggered workflow), **grype container CVEs** (34 Critical, 131 High across 9 images), and **grant license policy** (1,246 findings, mostly transitive npm packages in the gh-aw Node/firewall images). Highest severity supported by tooling: **Critical** (zizmor secrets-outside-env/CVE-2026-63073 and others in `alpine`/firewall images). No functional workflow-source regressions were found — the only working-tree diff is expected cron-scatter timestamps in lock files.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 15+ `.lock.yml` files (e.g. `dashboard-authoring-corpus.lock.yml`) | error | 92 shellcheck issues (mostly SC1003 unescaped quotes, SC2034 unused vars) in embedded scripts | Regenerate scripts from `.md` sources fixing quoting/unused-var patterns; recompile |
| actionlint (expression) | `optimization-token-optimizer.lock.yml`, `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Undefined properties referenced in `${{ }}` expressions (`token_eligible`, `safe-outputs-app-token`) | Fix expression references in workflow `.md` sources to match actual step outputs; recompile |
| zizmor | 30+ workflows | Medium (2,989 instances) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a scoped `environment:` block |
| zizmor | e.g. `cao-evolution-catalog-advisor.lock.yml`, `cao-evolution-compiler-security.lock.yml`, `cao-evolution-efficiency.lock.yml` (64 instances) | High | `github-app`: dangerous use of `actions/create-github-app-token` (token scope/exposure risk) | Review app-token step permissions/least-privilege scoping per zizmor guidance |
| zizmor | many workflows (392 instances) | Informational | `anonymous-definition`: workflow/action definitions without a `name:` | Add `name:` fields where practical |
| zizmor | many workflows (386 instances) | Medium | `undocumented-permissions`: `permissions:` blocks without explanatory comments | Add inline comments justifying each granted permission |
| zizmor | `dashboard-authoring-corpus.lock.yml`, `design-decision-gate.lock.yml`, `docs-explanatory-diagrams.lock.yml` +36 (39 instances) | Medium | `artipacked`: credential persistence through uploaded artifacts | Ensure `actions/checkout` doesn't persist credentials into artifacts |
| zizmor | 9 workflows | Low | `adhoc-packages`: ad-hoc package installs outside lockfile-pinned steps | Pin package installs via manifest/lockfile where feasible |
| zizmor | `pr-reviewer.lock.yml`, `repo-assist-pr-upkeep.lock.yml`, `self-care-primer-brand-checker.lock.yml`, `self-care.lock.yml` (11 instances) | Informational/Low | `template-injection`: code injection via template expansion | Use intermediate env vars instead of directly interpolating untrusted values into scripts |
| zizmor | `eslint-rules*.lock.yml`, `optimization-ai-credit-*.lock.yml`, `self-care-docs-build-time-investigator.lock.yml` (9 instances) | Low | `obfuscation`: obfuscated usage of GitHub Actions features | Simplify expression/step usage flagged by zizmor |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level `permissions:` on a job triggered by `pull_request_target`/`issue_comment`-style event | Reduce to read-only permissions or move privileged steps to a separate trusted-trigger job |
| grype | `alpine`, `ghcr.io/github/gh-aw-firewall/agent`, `.../api-proxy`, `.../cli-proxy`, `.../squid`, `ghcr.io/github/gh-aw-mcpg`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/github-mcp-server`, `node` | Critical/High | 550 CVE findings (34 Critical, 131 High) across 9 base/tool images — e.g. `CVE-2026-63073`/`CVE-2026-18798`/`CVE-2026-63076` in `libcrypto3`/`libssl3` on `alpine:latest` | Rebuild/pull updated base images (e.g. `alpine` libssl3/libcrypto3 → 3.5.8-r0); bump pinned image digests |
| grant | 9 container images (npm/transitive deps) | error (license policy) | 1,246 license policy findings, largely permissively-licensed (MIT/ISC/Apache-2.0) transitive npm packages inside firewall/Node images flagged under strict mode | Review `.poutine.yml`/grant allowlist for known-safe permissive licenses, or update policy scope |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

Working-tree diff (from `git-status.txt`): only 15 `.lock.yml` cron-scatter timestamp changes plus a new `.poutine.yml`; no functional regressions detected.

Totals from report: 1,612 actionlint/shellcheck-style `error:` lines, 3,074 `warning:` lines, 550 CVE mentions, 1,246 license-policy findings (`grant failed: strict mode: grant found 1246 license policy finding(s) in container images`).

Full raw report (1,636,018 bytes, 27,599 lines) and per-tool digest are retained in the workflow run's `/tmp/gh-aw/agent/cao-evolution-compiler-security/report.txt` evidence artifact for detailed review; not reproduced in full here due to size.

Control plane context

- Correlation ID: `35044423050-118`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35044423050`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35044862900) · copilot · auto · 41.9 AIC · ⌖ 9.39 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 1:59 AM UTC

Start with the 65 .github/workflows/*.md sources and the gh aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Run the compiler and the listed validation and security scans, then review generated lock-file diffs. Done means the full compiler and security scan passes, or any unsafe finding is clearly documented.

Written by the indexing model from the issue text.