[cao-evolution:compiler-security] Compiler + security scan findings: expression errors, zizmor High github-app, grype Critical CVEs, grant license violations

The gh-aw compiler exited non-zero (exit code 1) for `githubnext/gh-aw-cao` (65 workflow sources, 65 compiled locks). Findings span 5 categories: **3 actionlint expression errors** (undefined properties in generated locks), **92 actionlint/shellcheck findings** (mostly SC1003 quoting notes and SC2034 unused-var warnings), **zizmor** (64 High `github-app` token-handling findings plus ~3,467 Medium/Low/Informational findings, dominated by 2,629 "secrets-outside-env"), **grype** container scans with 34 Critical / 173 High CVEs across 8 images (curl/libcurl and libssl3/libcrypto3 CVEs on Alpine-based firewall proxy images), and **grant** license-policy failures (1,246 violations, mostly GPL/LGPL-family licenses in base images treated as violations by the configured policy). Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-18924, CVE-2026-19931 in curl/libcurl; CVE-2026-63073, CVE-2026-75803 in libssl3/libcrypto3) in `ghcr.io/github/gh-aw-firewall/*` and `alpine:latest` images.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `optimization-token-optimizer.lock.yml:627` | error | `[expression]` property `token_eligible` not defined in generated context object | Fix the `.md` source expression/output binding so `token_eligible` is declared before use; recompile |
| actionlint | `self-care-dashboard-performance.lock.yml:2353`, `self-care-pages-health.lock.yml:2259` | error | `[expression]` property `safe-outputs-app-token` not defined on job outputs object | Fix step-output reference in `.md` source (likely stale/renamed output key); recompile |
| actionlint+shellcheck | 16 workflows (e.g. `dashboard-authoring-corpus`, `eu-cra-compliance*`, `repo-assist-issue-fix`) | info (SC1003) | Unescaped single-quote in "Execute Pi CLI" step heredoc example text (`echo 'This is how it'\''s done'`) | Escape the embedded quote correctly in the shared Pi CLI step source |
| shellcheck | multiple `graders/*-operational-value.sh` | warning (SC2034) | Unused shell variables (`WORKFLOW_NAME`, `SOURCE_PATH`, `TITLE_PREFIX`, `FRAMEWORK`, `OPERATIONAL_VALUE`, `OPPORTUNITY`, `ACCEPTED`, `METRIC_ID`) | Export or prefix with `_`/mark intentionally unused in grader script templates |
| zizmor | 52 lock files | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` (64 occurrences) | Review token scoping/lifetime per zizmor guidance; ensure minimal permissions and short-lived tokens |
| zizmor | most lock files | Medium | `secrets-outside-env`: secrets referenced without dedicated `environment:` (2,629 occurrences) | Move secret-referencing jobs into a declared GitHub Environment where feasible |
| zizmor | most lock files | Medium | `artipacked`: artifact/checkout persist-credentials pattern (39 occurrences) | Set `persist-credentials: false` on checkout steps where not needed |
| zizmor | most lock files | Low/Informational | `undocumented-permissions`, `anonymous-definition`, `adhoc-packages`, `obfuscation`, `template-injection` (informational template-injection: 9, low: 2) | Lower priority; document permissions blocks and named job/workflow definitions |
| poutine/runner-guard | `agentic_commands.yml` | medium (RGS-005) | Write-level `permissions:` combined with an externally-triggerable event | Confirm trigger is not externally triggerable, or reduce to read-only + safe-output writes |
| grype | `alpine:latest` | Critical/High | CVE-2026-63073, CVE-2026-75803 (Critical), CVE-2026-18798/63076/14457/14456/63072/54874/63075 (High) in libssl3/libcrypto3 3.5.7-r0 (fix 3.5.8-r0) | Bump base image to pick up patched OpenSSL package |
| grype | `ghcr.io/github/gh-aw-firewall/api-proxy`, `cli-proxy`, `squid` (0.28.16) | Critical | CVE-2026-18924, CVE-2026-19931 in curl/libcurl 8.21.0-r0 (fix 8.22.0-r0); `squid` also carries the alpine libssl3/libcrypto3 CVEs above | Rebuild firewall proxy images on an updated Alpine/curl base |
| grype | `ghcr.io/github/gh-aw-mcpg`, `node`, `github-mcp-server` | Critical (2 each except mcpg 4) | Additional Critical CVEs in these images (see raw evidence) | Rebuild/update base images |
| grype | 8 images total | Medium/Low/Negligible/Unknown | 322 Medium, 54 Low, 27 Negligible, 14 Unknown (e.g. bind9-libs, perl, php8.1-* on the firewall agent image) | Track via routine base-image refresh; not urgent |
| grant | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/agent:0.28.16` (representative) | policy violation | 1,246 license-policy violations, predominantly GPL-2.0/LGPL family packages in base OS layers (e.g. `apk-tools`, `busybox`, `util-linux`, `libgcrypt20`) plus assorted npm deps (MIT/ISC/BlueOak) | Confirm intended license policy for base-image system packages; adjust `grant` allowlist or document accepted exceptions rather than treating standard GPL system libs as violations |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Summary counts:**
- actionlint: 95 issues (92 shellcheck, 3 expression) across 65 files
- zizmor: 64 High, 2,668 Medium, 427 Low, 401 Informational across 65 files
- poutine/runner-guard: 1 medium finding (RGS-005)
- grype: 34 Critical, 173 High, 322 Medium, 54 Low, 27 Negligible, 14 Unknown across 9 container images (alpine:latest, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.16, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server, node)
- grant: 1,246 license policy findings across 9 container images (`grant failed` — strict mode)
- Overall gh-aw workflow inventory: 65 workflows, 395 jobs, 8,413 steps, 3,933 scripts (2.2 MB), total lock size 9.9 MB

Local git diff shows only a compiler-version bump (`2` insertion/deletion pairs × 16 lock files) and an untracked `.poutine.yml`, unrelated to the findings above — these are pre-existing repository state at scan time, not remediation.

Full raw scanner output (compiler stdout/stderr, ~1.6 MB) is available in the deterministic compiler-security evidence artifact for this run; not reproduced here for length. No token-like or credential-like values were observed in the excerpts reviewed.

Control plane context

- Correlation ID: `35084704487-127`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35084704487

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35085300298) · copilot · auto · 51 AIC · ⌖ 9.44 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 10:51 AM UTC

Start with the `.github/workflows/*.md` sources named in the findings and use the gh-aw MCP server's `fix` and `compile` entry points; do not edit generated `.lock.yml` files. Recompile with the listed validation and security scanners, then review the generated lock-file diffs. Done means the compiler and full security scan pass, or any unsafe finding is documented for human action.

Written by the indexing model from the issue text.