[cao-evolution:compiler-security] gh-aw compiler security scan found 3,552 zizmor findings, 34 critical CVEs, and 1,246 license violations

The `gh-aw` compiler exited with code **1** while validating all 65 workflow sources / 65 compiled lock files in `githubnext/gh-aw-cao`. Findings span 6 categories: **95 actionlint issues** (92 shellcheck, 3 expression-type errors), **3,552 zizmor findings** (64 High `github-app` dangerous-token-use, plus Medium/Low/Info), **1 runner-guard** medium taint finding, **34 Critical / 173 High** grype container CVEs across all 9 scanned images, and **1,246 grant license-policy violations** (the failure that set the non-zero exit). Highest severity: **High** — `zizmor`'s `github-app` audit (64 occurrences) plus 34 **Critical** CVEs in container images (curl/libcurl, OpenSSL, glibc). **Action:** assign this issue to Copilot to remediate lockable findings (permission comments, shellcheck quoting, container base-image bumps) via the agent prompt below; license-policy and unfixable base-image CVEs need maintainer review of `.poutine.yml`/image pinning policy.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 2 lock files (`dashboard-authoring-corpus`, `eu-cra-compliance-article-14-reporting-readiness`) | unknown | SC1003: unescaped single quote in heredoc example string (`echo 'This is how it'\''s done'`) | Escape the quote in the source `.md` script block, recompile |
| actionlint (expression) | `optimization-token-optimizer.lock.yml:627` | unknown | property `token_eligible` not defined in referenced needs-outputs object | Fix expression/output name in source workflow |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2353`, `self-care-pages-health.lock.yml:2259` | unknown | property `safe-outputs-app-token` not defined in referenced job-outputs object | Fix expression/output name in source workflow |
| zizmor | 54 lock files | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) — 64 occurrences | Review token scope/handling per zizmor guidance; add ack or narrow usage |
| zizmor | many lock files | Medium | `secrets-outside-env`: secrets referenced outside `env:` — 2,629 occurrences | Move secret references into `env:` blocks in source workflows |
| zizmor | many lock files | Medium | `artipacked`: potential credential persistence in artifacts — 39 occurrences | Review affected steps for credential leakage into artifacts |
| zizmor | many lock files | Low | `undocumented-permissions`: permissions blocks without explanatory comments — 386 occurrences | Add comments explaining each permission scope in source `.md` |
| zizmor | many lock files | Low | `adhoc-packages`: ad hoc package installs — 30 occurrences | Pin/vendor package installs per zizmor guidance |
| zizmor | few lock files | Low/Info | `obfuscation` (9), `template-injection` (11) | Review flagged expressions for injection risk |
| zizmor | all lock files | Informational | `anonymous-definition`: jobs without `name:` — 392 occurrences | Add `name:` to job/workflow definitions (cosmetic) |
| runner-guard | `agentic_commands.yml` | Medium (RGS-005) | Write-level permissions declared alongside untrusted-trigger metadata comment | Confirm this is a false positive on the metadata comment line or restrict permissions |
| grype | `ghcr.io/github/gh-aw-firewall/squid:0.28.16` | Critical | CVE-2026-63073, CVE-2026-75803 (openssl/libssl3/libcrypto3), CVE-2026-18924, CVE-2026-19931 (curl/libcurl) — 10 findings | Bump base image / rebuild with patched OpenSSL & curl |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16`, `cli-proxy:0.28.16` | Critical | CVE-2026-18924, CVE-2026-19931 (curl/libcurl) — 4 findings each | Bump base image / rebuild with patched curl |
| grype | `alpine:latest`, `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3) — 4 findings each | Bump Alpine base image |
| grype | `ghcr.io/github/gh-aw-mcpg:v0.4.21` | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3) — 4 findings | Bump base image |
| grype | `ghcr.io/github/gh-aw-node` | Critical | CVE-2026-18924, CVE-2026-19931 (libcurl) — 2 findings | Bump base image |
| grype | `ghcr.io/github/github-mcp-server:v1.12.1` | Critical | CVE-2026-5450 (glibc), CVE-2026-75803 (libssl3) — 2 findings | Requires upstream image update |
| grype | all 9 images | High | 173 High-severity CVEs (curl, OpenSSL, brace-expansion, bind9-libs, etc.) | Bump/patch affected base images and bundled npm deps |
| grant | all 9 container images | error (strict-mode failure) | 1,246 license-policy violations (GPL-2.0-only, LGPL variants, Artistic-2.0, etc. in base-image packages) | Review `.poutine.yml`/grant policy exceptions vs. actual license obligations for vendored base-image components; this is the finding that set the non-zero compiler exit |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Summary (`summary.txt`)**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 65
Compiled locks: 65
```

**Actionlint summary**
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

**Zizmor findings by severity**
```
High: 64
Medium: 3,068 (secrets-outside-env 2,629; artipacked 39; [remaining medium subtotal not separately itemized])
Low: 427 (undocumented-permissions 386; adhoc-packages 30; obfuscation 9; template-injection 2)
Informational: 401 (anonymous-definition 392; template-injection 9)
```

**runner-guard**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

**grype summary (severity counts across 9 images)**
```
Critical: 34
High: 173
Medium: 322
Low: 54
Negligible: 27
```

**grant (final line)**
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

**Diff observed in target checkout (unrelated to compiler findings, informational only)**
```
M .github/workflows/agentic-auto-upgrade.yml (schedule cron drift)
M 15 *.lock.yml files (line 2 metadata/timestamp diffs)
?? .poutine.yml (untracked local scanner config)
```

Control plane context

- **Correlation ID**: 35074954923-76
- **Central repository**: githubnext/gh-aw-cao
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/35074954923

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35074954923) · copilot · auto · 80.3 AIC · ⌖ 17 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 9:03 AM UTC

Start with the 65 .github/workflows/*.md sources and run the gh aw MCP server's compile and fix tools against githubnext/gh-aw-cao. Review the generated lock-file diffs, .poutine.yml policy, and the listed actionlint, zizmor, runner-guard, grant, grype, and syft findings. Done means the full strict compiler and security scan passes without editing generated .lock.yml files.

Written by the indexing model from the issue text.