[cao-evolution:compiler-security] Compiler security scan findings: 1246 license violations, 34 critical CVEs, 95 actionlint issues (githubnext/gh-aw-cao)

gh-aw compiler run against `githubnext/gh-aw-cao` exited with code 1: 65 workflow sources compiled cleanly to 65 lock files, but the security-scanner suite reported findings in 4 categories. The blocking failure is **grant** (strict license-policy mode), which flagged **1246 license policy violations** across all 9 scanned container images (GPL/AGPL/LGPL-family licenses in base-image and tool packages such as `busybox`, `apk-tools`, `gnupg`, `sed`, `php8.1-intl`). **grype** additionally found **34 Critical** and **237 High** container CVEs (notably OpenSSL/libcrypto/libssl `CVE-2026-63073`/`CVE-2026-75803` and curl `CVE-2026-18924`/`CVE-2026-19931` across `alpine`, `gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `node:lts-alpine`, `github-mcp-server`). **actionlint** found 95 issues (92 shellcheck `SC1003` quoting style hints, 3 workflow-expression errors referencing undefined context properties). **zizmor** found 64 High-severity `github-app` findings (use of `actions/create-github-app-token` for dangerous-token patterns) plus 2629 Medium `secrets-outside-env` and lower-severity style findings. **poutine/runner-guard** flagged one Medium `RGS-005` (excessive write permissions on an untrusted-trigger job) in `agentic_commands.yml`. Highest-severity, highest-confidence issue: the container CVEs and license violations are upstream base-image/package issues (mostly fixed by bumping pinned image digests), while the actionlint expression errors and the zizmor `github-app` pattern are workflow-source issues fixable in `.md` sources.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| grant | 9 container images (alpine, gh-aw-firewall/agent, api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server) | error (strict) | 1246 license policy violations (GPL-2.0-only, LGPL, and similar copyleft licenses in base packages) | Update `.poutine.yml`/grant policy skip list if these are acceptable base-image licenses, or pin to alternative base images/packages without copyleft licenses |
| grype | alpine:latest, gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}, gh-aw-mcpg, gh-aw-node, node:lts-alpine, github-mcp-server | Critical (34), High (237) | OpenSSL/libcrypto/libssl (`CVE-2026-63073`, `CVE-2026-75803`), curl/libcurl (`CVE-2026-18924`, `CVE-2026-19931`), glibc (`CVE-2026-5450`) | Bump pinned image digests to versions with `libcrypto3/libssl3@3.5.8-r0+`, `curl/libcurl@8.22.0-r0+`, updated `libc6` |
| actionlint (shellcheck) | dashboard-authoring-corpus, eu-cra-compliance*, repo-assist*, self-care*, software-development-practices*, uk-ai-advisory*, optimization-token-optimizer (25 lock files) | error | 92× `SC1003`: unescaped single quote in embedded shell script string (`echo 'This is how it'\''s done'`) | Escape single quotes correctly in the corresponding `.md` workflow source's embedded script |
| actionlint (expression) | optimization-token-optimizer.lock.yml:627, self-care-dashboard-performance.lock.yml:2353, self-care-pages-health.lock.yml:2259 | error | Reference to undefined context property (`token_eligible`, `safe-outputs-app-token`) | Fix the referencing expression or add the missing output/property in the `.md` source, then recompile |
| zizmor | uk-ai-advisory.lock.yml (and similar CAO-app-token workflows) | High | `github-app`: dangerous use of GitHub App tokens via `actions/create-github-app-token` | Review token scoping/usage per zizmor's `github-app` audit guidance |
| zizmor | widespread across lock files | Medium (2629) | `secrets-outside-env`: secrets referenced without a dedicated environment | Consider scoping secret references to job `environment:` blocks where practical |
| zizmor | widespread | Low (386) | `undocumented-permissions`: permission blocks without explanatory comments | Add comments explaining each permission (cosmetic) |
| poutine/runner-guard | agentic_commands.yml | Medium (RGS-005) | Excessive write permissions on a job reachable from an untrusted trigger (`pull_request_target`/`issue_comment`-class event) | Review and minimize permissions on the flagged job, or confirm existing mitigations and add a `.poutine.yml` skip with justification |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary: `Target: githubnext/gh-aw-cao / Exit code: 1 / Workflow sources: 65 / Compiled locks: 65`.

Severity totals — zizmor: 64 High, 2629 Medium (`secrets-outside-env`), 39 Medium (`artipacked`), 386 Low (`undocumented-permissions`), 30 Low (`adhoc-packages`), 9 Low (`obfuscation`), 2 Low (`template-injection`). grype: 34 Critical, 237 High, 2990 Medium, 481 Low, 27 Negligible, 14 Unknown across 9 images. actionlint: 92 shellcheck (`SC1003`) + 3 expression errors = 95 issues in 25 lock files. grant: 1246 license policy findings (strict mode) causing the overall exit code 1. poutine/runner-guard: 1 Medium `RGS-005` finding in `agentic_commands.yml`.

Note: the working tree also shows drift in 16 cron `schedule:` lines from the deterministic `--schedule-seed` recompile and a new untracked `.poutine.yml`; these are expected artifacts of this scan run, not security findings, and are not included in the table above.

Full report is 27598 lines; only representative excerpts are summarized here. No token-like or credential-like values were present in the excerpted output.

Control plane context

- Correlation ID: `35101519517-130`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35101519517

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35102268098) · copilot · auto · 47 AIC · ⌖ 13.1 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 1:51 PM UTC

Start with the named findings in the .github/workflows/*.md sources, especially the actionlint errors and agentic_commands.yml; do not edit generated .lock.yml files. Use the gh aw MCP server's fix and compile tools, then rerun the full compiler and security scan. Done means the reported findings are resolved or safely justified and the complete scan passes.

Written by the indexing model from the issue text.