[cao-evolution:compiler-security] Compiler/security scan findings: 95 lint issues, container CVEs, license violations, 64 github-app warnings

Compiling all 65 GitHub Agentic Workflows in `githubnext/gh-aw-cao` with the full gh-aw validation, lint, container, and security-scanner suite exited with code `1` (findings, not clean). Actionlint found 95 issues (92 shellcheck, 3 expression-type errors). Zizmor flagged 34 Critical/237 High findings, dominated by 64 `github-app` (High) dangerous-token-use warnings and 2,629 `secrets-outside-env` (Medium) findings across all 65 workflows, plus 39 `artipacked` (Medium) credential-persistence warnings. Grype found Critical CVEs (curl/libcurl, libssl3/libcrypto3) in 8 of 9 scanned container images, worst in `ghcr.io/github/gh-aw-firewall/squid:0.28.16` and `ghcr.io/github/gh-aw-mcpg:v0.4.21`. Grant (license scanner) failed strict mode with 1,246 license-policy findings (mostly GPL-2.0/LGPL packages in base images). Runner-guard found one medium-severity excessive-permissions finding (RGS-005) on a `pull_request_target`/`issue_comment`-triggered workflow. Poutine reported no findings. Highest-severity actionable item: the `github-app` dangerous-token-use pattern repeated across 54 compiled lock files, tied to `actions/create-github-app-token@bcd2ba4...` usage originating from a shared control-plane include.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint/shellcheck | 65 lock files (`Execute Pi CLI` / `graders.operational-value` steps) | unknown (92 findings) | `SC1003` unescaped single-quote in shared echo example string; `SC2034` unused grader env vars (`WORKFLOW_NAME`, `SOURCE_PATH`, etc.) | Escape the quote in the shared example script; export or remove unused grader variables |
| actionlint (expression) | `optimization-token-optimizer.lock.yml`, `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error (3 findings) | Undefined `needs` output properties (`token_eligible`, `safe-outputs-app-token`) referenced in `${{ }}` expressions | Fix the shared job-output schema/reference in the workflow source so referenced properties exist |
| zizmor | 54 lock files | High (64) | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token@bcd2ba49...` | Scope/guard the app-token step per zizmor's `github-app` guidance in the shared control include |
| zizmor | all 65 lock files | Medium (2,629) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a job `environment:` block |
| zizmor | 20 lock files | Medium (39) | `artipacked`: credential persistence through uploaded artifacts | Ensure checkout/artifact steps don't retain credentials (`persist-credentials: false`, exclude `.git` from artifacts) |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.21` | Critical/High (52) | Outdated `libssl3`/`libcrypto3` (CVE-2026-63073, CVE-2026-75803) and other OpenSSL CVEs | Rebuild image on updated Alpine base (openssl 3.5.8-r0) |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.16` | Critical/High (45) | Same OpenSSL CVEs plus `curl`/`libcurl` CVE-2026-18924/19931 | Rebuild image on updated Alpine base with patched curl/openssl |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16`, `cli-proxy:0.28.16` | Critical (4 each) | `curl`/`libcurl` CVE-2026-18924, CVE-2026-19931 | Rebuild on patched Alpine base |
| grype | `alpine:latest`, `node:lts-alpine`, `ghcr.io/github/gh-aw-node` | Critical/High (18/18/13) | OpenSSL/libtiff CVEs from stale base layers | Pin and rebuild on latest patched base image tags |
| grant | 9 container images | unknown (1,246) | License policy violations, largely GPL-2.0/LGPL-3.0 packages (`busybox`, `alpine-baselayout`, `libidn2`, `libgdbm6`, etc.) in base images | Review license allowlist policy or replace affected base image packages |
| runner-guard | `agentic_commands.yml` (`design-decision-gate`, `mattpocock-skills-reviewer`, `pr-sous-chef`) | medium (RGS-005) | Write-level `permissions:` on a job reachable via untrusted `pull_request_target`/`issue_comment` trigger | Drop to read-only permissions or gate write access behind an authorization check |
| poutine | all 65 workflows | clean | No findings | None |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

Actionlint summary:
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

Zizmor severity distribution (all findings across 65 lock files): Critical 34, High 237, Medium 2989, Low 481, Informational 401, Unknown 16.

Grype Critical/High CVE counts by image:
```
18 alpine:latest
18 ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16
18 ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.16
45 ghcr.io/github/gh-aw-firewall/squid:0.28.16
27 ghcr.io/github/gh-aw-mcpg:v0.4.21
13 ghcr.io/github/gh-aw-node
8 ghcr.io/github/github-mcp-server:v1.12.1
18 node:lts-alpine
```

Grant: `strict mode: grant found 1246 license policy finding(s) in container images` (exit failed).

Runner-guard: 1 finding, `RGS-005` (medium) on `agentic_commands.yml` (commands: `design-gate`, `matt`, `souschef`; workflows: `design-decision-gate`, `mattpocock-skills-reviewer`, `pr-sous-chef`).

Poutine: ran with no reported findings.

No token-like or credential-like values were present in the retained excerpts.

Control plane context

- Correlation ID: `35056007705-72`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35056007705`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35056007705) · copilot · auto · 51.7 AIC · ⌖ 14.6 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 4:55 AM UTC

Start with the .github/workflows/*.md sources, the shared control-plane include, and agentic_commands.yml; do not edit generated .lock.yml files. Run the gh aw MCP server's fix and compile flow, then inspect the generated lock-file diffs and rerun the full validation and security scanner suite. Done means the compiler, actionlint, shellcheck, zizmor, runner-guard, grant, grype, and related checks pass without changing existing behavior.

Written by the indexing model from the issue text.