[cao-evolution:compiler-security] gh-aw compiler & security scan findings: githubnext/gh-aw-cao (34 Critical CVEs, 64 High zizmor, exit code 1)

The gh-aw compiler ran a full validation, lint, container, and security scan of `githubnext/gh-aw-cao`'s 65 GitHub Agentic Workflow sources and 65 generated lock files, and exited with **exit code 1**. The scan found actionable findings across six tool categories: **92 shellcheck errors** (actionlint-integrated), **3163 zizmor findings** (64 High, 2668 Medium, 427 Low — mostly `secrets-outside-env` and `undocumented-permissions`), **1 poutine/runner-guard warning** (excessive permissions on an untrusted-trigger workflow), **609 grype container CVEs** (34 Critical, 173 High) across 9 base images, **1247+ grant license-policy violations** across those same images, and 68 shellcheck `SC2034` unused-variable notes plus 184 `SC1003` quoting notes from the standalone shellcheck pass on run-step scripts. The single highest-severity, most concrete class of finding is the **34 Critical CVEs in `libssl3`/`libcrypto3`/`curl`/`libc6` across 6 of the 9 scanned container images** (alpine:latest, gh-aw-firewall/squid, gh-aw-firewall/api-proxy, gh-aw-firewall/cli-proxy, gh-aw-mcpg, node:lts-alpine, github-mcp-server), all with vendor fixes already published.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | `dashboard-authoring-corpus.lock.yml` + 13 similar `.lock.yml` files, step "Execute Pi CLI" | unknown (error) | SC1003: unescaped single quote in generated shell snippet (`echo 'This is how it'\''s done'`), 4 occurrences × 14 files = 92 total | Fix the quoting in the shared shell snippet in the `.md` workflow source that generates the "Execute Pi CLI" step, then recompile |
| zizmor | 65 lock files | Medium | `secrets-outside-env` (2629 occurrences): secrets referenced without a dedicated environment in `safe_outputs`/job-level blocks | Move secret references into a scoped `environment:` block per zizmor's audit guidance |
| zizmor | 65 lock files | Low | `undocumented-permissions` (386) / `anonymous-definition` (392): permission blocks lack explanatory comments; anonymous job/step definitions | Add comments documenting each `permissions:` entry; name anonymous definitions |
| zizmor | e.g. `uk-ai-advisory.lock.yml:1415`, `cao-evolution-catalog-advisor.lock.yml:1922` + others (64 total) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba4...` | Review github-app audit guidance; scope/short-lived token usage per zizmor docs |
| zizmor | multiple lock files | Medium/Low | `artipacked` (39), `adhoc-packages` (30), `template-injection` (11), `obfuscation` (9) | Address per zizmor audit links in raw evidence |
| poutine / runner-guard | `agentic_commands.yml` | Medium (warning) | RGS-005: job specifies write-level `permissions:` while triggered by an event that can be initiated by external users (`pull_request_target`/`issue_comment`-class trigger) | Reduce to read-only default permissions and grant write scopes only in a gated, trusted job |
| grype | alpine:latest, gh-aw-firewall/squid, /api-proxy, /cli-proxy, gh-aw-mcpg, node:lts-alpine | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3/openssl 3.5.7-r0, fix 3.5.8-r0); CVE-2026-18924/19931 (curl/libcurl 8.21.0-r0, fix 8.22.0-r0) | Bump base images / rebuild to pull patched Alpine packages |
| grype | github-mcp-server:v1.12.1 | Critical | CVE-2026-5450 (libc6 2.36-9+deb12u14), CVE-2026-75803 (libssl3 3.0.20-1~deb12u2) | Update the `ghcr.io/github/github-mcp-server` pinned digest to a patched build |
| grype | gh-aw-firewall/agent:0.28.16 | High | GHSA-rgw5-rvv9-x895 / GHSA-mh99-v99m-4gvg (brace-expansion@5.0.7, fix 5.0.8/5.0.9); GHSA-r292-9mhp-454m (tar@7.5.19, fix 7.5.21); GHSA-mwp4-54f8-5fhr (ip-address@10.2.0, fix 10.3.1); plus bind9-libs/perl/curl Ubuntu CVEs (Medium, unfixed upstream) | Update firewall/agent image's npm dependency lockfile and rebuild; track unfixed Ubuntu package CVEs for next base-image refresh |
| grant | alpine:latest | High (error) | License policy violation: `apk-tools`, `busybox`, `scanelf`, `alpine-baselayout*`, `libapk` (GPL-2.0-only); `musl-utils` (GPL-2.0-or-later mix) | Confirm GPL-2.0 packages are policy-acceptable for this base image or update grant's allow-list/policy |
| grant | gh-aw-firewall/agent:0.28.16 | High (error) | License policy violation: `libhogweed6`, `php8.1-common`, `libbsd0`, `libk5crypto3`, `coreutils`, `libattr1`, `libsemanage2` (GPL/LGPL family, 1200+ total across images) | Same as above — review/update grant license policy allow-list |
| shellcheck (standalone) | 3954 run-step resources across all lock files | unknown (note) | SC2034: `WORKFLOW_NAME`/`SOURCE_PATH`/`TITLE_PREFIX` appear unused (68 occurrences); SC1003 quoting note (184 occurrences, overlapping actionlint findings above) | Remove or export the unused shell variables in the relevant `.md` source; fix quoting as above |

Deduplicated finding categories reported by more than one tool: the `libssl3`/`libcrypto3`/`curl` Critical CVEs and the SC1003 quoting issue each appear consistently across multiple images/workflows respectively; counts above already fold those together per tool.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Summary (`summary.txt`):**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

**Severity totals by tool:**
- zizmor: 64 High, 2668 Medium, 427 Low (3159 total across `secrets-outside-env`, `anonymous-definition`, `undocumented-permissions`, `github-app`, `artipacked`, `adhoc-packages`, `template-injection`, `obfuscation`)
- grype: 34 Critical, 173 High, 321 Medium, 54 Low, 27 Negligible across 9 scanned images
- grant: 1247+ license policy violations (error) across 9 scanned images
- actionlint/shellcheck: 92 SC1003 quoting errors
- shellcheck (standalone pass on 3954 run-step resources): 184 SC1003 notes, 68 SC2034 notes
- poutine/runner-guard: 1 Medium finding (RGS-005) on `agentic_commands.yml`

**Sample zizmor High finding:**
```
./.github/workflows/uk-ai-advisory.lock.yml:1415:15: error: [High] github-app: dangerous use of GitHub App tokens ((docs.zizmor.sh/redacted)
1415 | uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
```

**Sample grype Critical finding:**
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
ghcr.io/github/github-mcp-server:v1.12.1:1:1: error: [Critical] CVE-2026-5450: libc6@2.36-9+deb12u14
```

**Sample poutine/runner-guard finding:**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

**Sample grant finding:**
```
alpine:latest:1:1: error: license policy violation: apk-tools@3.0.6-r0 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/agent:0.28.16:1:1: error: license policy violation: coreutils@8.32-4.1ubuntu1.4 (BSD-3-Clause, GFDL-1.2-no-invariants-or-later, GPL-3.0-or-later, ISC)
```

**Sample shellcheck (standalone) finding:**
```
⚠ shellcheck findings in dashboard-authoring-corpus.lock.yml (step: Execute Pi CLI):
script:37:839: note: Want to escape a single quote? echo 'This is how it'\''s done'. [SC1003]
script:3:1: warning: WORKFLOW_NAME appears unused. Verify use (or export if used externally). [SC2034]
```

Full uncompressed tool output (1.6 MB, 27599 lines) is retained in the workflow run artifacts referenced by `control_plane_run_url` below and was not reproduced here in full. No token-like or credential-like values were observed in the reviewed output.

Control plane context

- Correlation ID: `35051808612-120`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35051808612

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35052247683) · copilot · auto · 45.8 AIC · ⌖ 7.98 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 3:53 AM UTC

Start with the gh-aw MCP server's fix and compile tools and the `.github/workflows/*.md` sources; do not edit generated `.lock.yml` files. Inspect `agentic_commands.yml` and the reported workflow and image findings, then rerun the full compiler and security scan. Done means the generated locks reflect safe source changes and strict validation, actionlint, shellcheck, zizmor, poutine, runner-guard, grant, grype, and syft pass, or any unsafe finding is explained.

Written by the indexing model from the issue text.