[cao-evolution:compiler-security] gh-aw compiler & security scan: 34 critical / 237 high CVEs, 1246 license findings, 95 lint errors across githubnext/gh-aw-cao

The compiler scan of all 65 gh-aw workflows in `githubnext/gh-aw-cao` completed with **exit code 1**. actionlint found 95 issues (92 shellcheck, 3 expression-type errors), zizmor found 34 Critical/237 High-severity container CVEs (via grype) plus 64 High "dangerous GitHub App token" workflow findings, poutine/runner-guard flagged 1 excessive-permissions issue, and `grant` failed strict-mode license checks with 1,246 policy findings across 9 container images (mostly ISC/MIT/GPL). Highest severity: **Critical CVE-2026-18924 / CVE-2026-19931** (curl/libcurl RCE-class) present in 3 firewall proxy images, plus **CVE-2026-5450** (glibc) and **CVE-2026-75803** (OpenSSL) in `github-mcp-server`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 8 lock files, "Execute Pi CLI" step | info (SC1003) | Unescaped single-quote in embedded example string ("This is how it's done") | Escape the quote in the source Markdown script block |
| actionlint (expression) | optimization-token-optimizer.lock.yml:627 | error | `token_eligible` property not defined in referenced object type | Fix expression/output name mismatch in workflow source |
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2353, self-care-pages-health.lock.yml:2259 | error | `safe-outputs-app-token` property not defined in referenced object type | Fix expression/output name mismatch in workflow source |
| zizmor | 10+ lock files | High | `github-app`: dangerous use of GitHub App tokens (64 occurrences) | Review token scoping per zizmor guidance |
| zizmor | many lock files | Medium | `secrets-outside-env`: secrets referenced without dedicated environment (2,629 occurrences) | Move secret references into a dedicated `environment:` block |
| zizmor | many lock files | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `obfuscation`, `artipacked`, `template-injection` | See zizmor docs per rule |
| runner-guard (poutine) | agentic_commands.yml | medium (RGS-005) | Write-level permissions on workflow triggerable by untrusted events | Restrict permissions or trigger scope |
| grype | alpine, gh-aw-firewall/{api-proxy,cli-proxy,squid}, gh-aw-mcpg, gh-aw-node | Critical | CVE-2026-18924, CVE-2026-19931 (curl/libcurl), CVE-2026-63073, CVE-2026-75803 (openssl/libssl3/libcrypto3) | Bump base images to patched package versions |
| grype | github-mcp-server:v1.12.1 | Critical | CVE-2026-5450 (libc6), CVE-2026-75803 (libssl3) | Rebuild/upgrade upstream base image |
| grype | 9 images | High (237 findings, 26 unique CVEs) | Various curl/openssl/libexpat/libblkid/libmount/docker-cli/libc6 CVEs | Upgrade affected packages/base images |
| grant | 9 container images | policy (strict) | 1,246 license policy findings (ISC 364, MIT 285, Apache-2.0 66, GPL-2.0-only 62, BlueOak-1.0.0 55, others) | Review license policy allowlist or replace flagged dependencies |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
Actionlint Summary
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3

grant strict mode: grant found 1246 license policy finding(s) in container images
grype: 34 Critical, 237 High findings across 9 scanned container images
poutine/runner-guard: 1 medium finding (RGS-005) in agentic_commands.yml
zizmor: 2629 secrets-outside-env (Medium), 392 anonymous-definition (Informational),
386 undocumented-permissions (Low), 64 github-app (High), 39 artipacked (Medium),
30 adhoc-packages (Low), 11 template-injection (Informational/Low), 9 obfuscation (Low)
```

Full raw output (1.6 MB) is retained in the run's compiler evidence artifact and not reproduced here in full to bound issue size.

Control plane context

- Correlation ID: `35079236366-126`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35079236366

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35079714250) · copilot · auto · 48.8 AIC · ⌖ 8.99 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 9:52 AM UTC

Start with the compiler evidence and the `.github/workflows/*.md` sources named in the findings; do not edit generated `.lock.yml` files. Use the gh-aw MCP server’s `fix` and `compile` tools, then rerun the full compiler and security scan. Done means the generated lock-file review preserves behavior and all listed validation tools pass, or an unfixable finding is documented.

Written by the indexing model from the issue text.