[cao-evolution:compiler-security] Compiler & security scan findings: shellcheck, zizmor, grant, grype (githubnext/gh-aw-cao)

gh-aw compiled all 65 workflow sources for `githubnext/gh-aw-cao` but the full validation/lint/scanner suite exited non-zero. Findings: 95 actionlint issues (92 shellcheck, 3 expression), thousands of zizmor advisories (dominated by 2,629 medium `secrets-outside-env` and 64 high `github-app` token-handling warnings), a `grant` license-policy failure (1,246 findings across 9 container images, mostly GPL/Apache/MIT packages the current allow-list doesn't cover), and `grype` container CVEs including several **Critical**/**High** severity items (e.g. CVE-2026-63073, CVE-2026-75803 in `alpine:latest`; CVE-2026-19931/18924 in the firewall images). `poutine`/`runner-guard` reported one medium finding (RGS-005) already tracked by an existing skip note. Highest-severity supported finding: **Critical** grype CVEs in base container images with available upstream fixes. Recommended next action: rebuild/pin container images to patched versions and tune the `grant` allow-list, then re-run the full compiler+scanner suite.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | multiple `.lock.yml` (e.g. `dashboard-authoring-corpus`, `eu-cra-compliance-article-14-reporting-readiness`) | error | SC1003: unescaped single quote in heredoc example script (92 occurrences) | Escape the quote in the source `.md` script block, recompile |
| actionlint (expression) | `optimization-token-optimizer.lock.yml`, `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Undefined properties (`token_eligible`, `safe-outputs-app-token`) referenced in `${{ }}` expressions | Fix expression references in workflow source, recompile |
| zizmor | 65 lock files | Medium (2,629×) | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a job/step `environment:` block per zizmor guidance |
| zizmor | 65 lock files | High (64×) | `github-app`: dangerous use of `actions/create-github-app-token` | Review app-token step scoping/least privilege per zizmor doc |
| zizmor | multiple | Medium (39×) | `artipacked`: credential persistence via uploaded artifacts | Avoid persisting credentials in artifact-bound paths |
| zizmor | multiple | Low/Info | `undocumented-permissions` (386), `anonymous-definition` (392), `adhoc-packages` (30), `obfuscation` (9), `template-injection` (11) | Add permission comments, job/workflow names, pin package installs |
| grype | `alpine:latest` | Critical | CVE-2026-63073, CVE-2026-75803 in `libcrypto3`/`libssl3` ``@3``.5.7-r0 (fix 3.5.8-r0) | Bump base image / apk packages to fixed version |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16`, `squid:0.28.16` | Critical/High | CVE-2026-19931, CVE-2026-18924 in `curl`/`libcurl` (fix 8.22.0-r0) | Rebuild firewall images on patched Alpine base |
| grype | 9 images total | Critical (34), High (131), Medium (289), Low (54), Negligible (27), Unknown (15) | Aggregate CVE counts across all scanned container images | Triage by image; prioritize Critical/High |
| grant | 9 container images | error | 1,246 license-policy violations (GPL-2.0-only, MPL-2.0, Apache-2.0, MIT, etc. not declared in `.grant.yaml`) | Extend `.grant.yaml` allowed-licenses policy or replace flagged packages |
| runner-guard / poutine | `agentic_commands.yml` | Medium | RGS-005: write permissions on trigger reachable by external users | Already has an existing skip/acknowledgment path in `.poutine.yml`; confirm coverage extends here |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

Actionlint summary:
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

grant summary:
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

Sample grype critical findings (alpine:latest):
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
```

runner-guard finding:
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

zizmor severity totals (info/low/medium/high, deduplicated by rule): secrets-outside-env (2629 medium), anonymous-definition (392 info), undocumented-permissions (386 low), github-app (64 high), artipacked (39 medium), adhoc-packages (30 low), obfuscation (9 low), template-injection (11 info/low).

Control plane context

- Correlation ID: `35048753482-70`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35048753482

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35048753482) · copilot · auto · 52.4 AIC · ⌖ 7.68 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 2:57 AM UTC

Start with the `.github/workflows/*.md` sources and run the gh-aw MCP `compile` workflow; do not edit generated `.lock.yml` files. Review `.grant.yaml`, `.poutine.yml`, and `.github/workflows/agentic_commands.yml` alongside the reported scanner output. Done means the full compiler, validation, and security scan suite passes, or unresolved findings are documented for human action.

Written by the indexing model from the issue text.