[cao-evolution:compiler-security] Compiler & security scan findings: 65 workflows, actionlint/zizmor/poutine/grype/grant

Compiling all 65 GitHub Agentic Workflow sources in `githubnext/gh-aw-cao` (compiler exit code 1) surfaced findings across every stage of the validation suite: 95 actionlint errors (92 shellcheck, 3 expression-typing), 3,929 zizmor findings (64 High, 2,668 Medium, 427 Low, 401 Informational — dominated by `secrets-outside-env` and `undocumented-permissions`), 1 poutine/runner-guard Medium finding (excessive permissions on an untrusted-trigger workflow), 610 grype container CVEs across 9 images (34 Critical, 173 High, 322 Medium, 54 Low, 27 Negligible), and 1,246 grant license-policy violations across 9 images. Highest-severity supported findings are the 34 Critical grype CVEs (e.g. `CVE-2026-63073`/`CVE-2026-75803` in `libssl3`/`libcrypto3` on `alpine:latest` and `node:lts-alpine`) and 64 High zizmor `github-app` findings (dangerous GitHub App token usage). No prerequisite was missing; the scan completed and evidence is bounded below.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | `dashboard-authoring-corpus.lock.yml` (+91 more) | unknown | SC1003/SC2034: unescaped quote / unused variable in embedded scripts | Fix flagged shell scripts in the `.md` sources; re-run `actionlint` via `gh aw compile` |
| actionlint (expression) | `optimization-token-optimizer.lock.yml`, `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | Undefined property referenced in GitHub Actions expression (`token_eligible`, `safe-outputs-app-token`) | Correct expression references in workflow `.md` sources; recompile |
| zizmor | 64 lock files | High | `github-app`: dangerous use of GitHub App tokens | Review App-token minting steps; scope token permissions and follow zizmor guidance |
| zizmor | 2,629 occurrences | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a job `environment:` block per zizmor audit docs |
| zizmor | 39 occurrences | Medium | `artipacked`: credential-adjacent artifact packing pattern | Review flagged steps for credential/artifact handling |
| zizmor | 386 occurrences | Low | `undocumented-permissions`: `permissions:` blocks without explanatory comments | Add comments documenting why each permission is granted |
| zizmor | 30 occurrences | Low | `adhoc-packages`: ad-hoc package installation (e.g. `npm install -g`) | Pin or vendor tool installation where feasible |
| zizmor | 11 occurrences | Low/Informational | `template-injection` | Review expression interpolation into shell/script contexts |
| zizmor | 392 occurrences | Informational | `anonymous-definition`: job/workflow defined without a `name:` | Add descriptive `name:` fields (cosmetic, optional) |
| poutine / runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Excessive write permissions on workflow triggered by an event with untrusted-actor reach | Reduce permissions or restrict trigger scope per runner-guard finding |
| grype | `alpine:latest`, `node:lts-alpine` | Critical | `CVE-2026-63073`, `CVE-2026-75803` in `libssl3`/`libcrypto3@3.5.7-r0` (fix: `3.5.8-r0`) | Bump base image / rebuild to pick up patched `libssl3`/`libcrypto3` |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.16` | High | `GHSA-rgw5-rvv9-x895`, `GHSA-mh99-v99m-4gvg`: `brace-expansion@5.0.7` (fix: 5.0.8/5.0.9); `GHSA-r292-9mhp-454m`: `tar@7.5.19` (fix: 7.5.21); `GHSA-mwp4-54f8-5fhr`: `ip-address@10.2.0` (fix: 10.3.1) | Update firewall image's npm/OS dependencies to patched versions |
| grype | multiple images | High/Medium (173/322 total) | OS package CVEs (`libcrypto3`, `libssl3`, `bind9-libs`, `curl`/`libcurl4`, `libexpat1`, `libpython3.10*`, `libglib2.0-0`, `perl*`, etc.) | Rebuild images against latest upstream security patches |
| grant | `alpine:latest` | error | 16 license-policy violations (GPL-2.0-only, Apache-2.0, MIT, etc.) not allow-listed by `.grant.yaml` | Update `.grant.yaml` allowed-license policy or replace flagged base image components |
| grant | `ghcr.io/github/gh-aw-firewall/agent:0.28.16` | error | 381 license-policy violations (npm + apt packages: ISC, MIT, GPL variants, BlueOak-1.0.0, etc.) | Same — reconcile license policy vs. actual image contents |
| grant | remaining 7 images | error | 849 additional license-policy violations (see raw evidence) | Same |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Summary line from compiler:**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

**actionlint summary:**
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

**Sample actionlint expression errors:**
```
.github/workflows/optimization-token-optimizer.lock.yml:627:9: error: [expression] property "token_eligible" is not defined in object type {...}
.github/workflows/self-care-dashboard-performance.lock.yml:2353:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
.github/workflows/self-care-pages-health.lock.yml:2259:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {...}
```

**zizmor severity totals (across 65 lock files):** High 64, Medium 2,668, Low 427, Informational 401 (3,560 total; some duplicated across identical job patterns repeated per workflow).

**Sample zizmor High finding:**
```
./.github/workflows/uk-ai-advisory.lock.yml:1415:15: error: [High] github-app: dangerous use of GitHub App tokens ((docs.zizmor.sh/redacted)
1415 | uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
```

**poutine / runner-guard finding:**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

**grype severity totals (9 container images):** Critical 34, High 173, Medium 322, Low 54, Negligible 27 (610 total).

**Sample grype Critical findings:**
```
alpine:latest:1:1: error: [Critical] CVE-2026-63073: libcrypto3@3.5.7-r0 (fix: 3.5.8-r0)
alpine:latest:1:1: error: [Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
node:lts-alpine:1:1: error: [Critical] CVE-2026-75803: libssl3@3.5.7-r0 (fix: 3.5.8-r0)
```

**grant summary:**
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

**grant violation counts per image:** `alpine:latest` 16, `ghcr.io/github/gh-aw-firewall/agent:0.28.16` 381, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16` 181, `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.16` 178, `ghcr.io/github/gh-aw-firewall/squid:0.28.16` 63, `ghcr.io/github/gh-aw-mcpg:v0.4.21` 80, `ghcr.io/github/gh-aw-node` 176, `ghcr.io/github/github-mcp-server:v1.12.1` 7, `node:lts-alpine` 164.

**Working tree side effects noted (uncommitted, not part of this report):** `git-status.txt` showed 16 modified `.lock.yml`/workflow files and an untracked `.poutine.yml`, produced by the compile/scan run itself, not by manual edits.

No credential-like values were present in the captured output; none were redacted.

Control plane context

- Correlation ID: `35068574734-124`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35068574734`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35069220230) · copilot · auto · 68.2 AIC · ⌖ 8.52 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 7:55 AM UTC

Start with the `.github/workflows/*.md` sources rather than generated `.lock.yml` files, and use `gh aw mcp-server` with its `fix` and `compile` tools. Review the reported actionlint, zizmor, poutine, runner-guard, grant, grype, and syft findings across the 65 workflows and 9 images. Done means the full strict compiler and security scan passes, with generated lock-file diffs reviewed.

Written by the indexing model from the issue text.