[cao-evolution:compiler-security] gh-aw compiler & security scan findings: actionlint, zizmor, grype, grant

`githubnext/gh-aw-cao` failed the full gh-aw compiler and security-scanner suite (compiler exit code 1) across 65 workflow sources / 65 generated locks. Findings span actionlint (95 issues: 92 shellcheck, 3 expression-type errors), zizmor (2,629 secrets-outside-env, 392 anonymous-definition, 386 undocumented-permissions, 64 High github-app, 39 artipacked, 30 adhoc-packages, 11 template-injection, 9 obfuscation), runner-guard (1 medium excessive-permissions-on-untrusted-trigger), grype (34 Critical / 173 High / 322 Medium / 54 Low CVEs across 9 container images), and grant (1,246 license-policy violations, causing `grant failed`). Poutine and yamllint reported no findings. Highest-severity supported finding: grype Critical CVEs (e.g. CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931, CVE-2026-5450) in `alpine:latest`, the `gh-aw-firewall` images, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, and `node:lts-alpine`. The `grant` license-policy failure is the compiler's hard failure gate.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 26 `.lock.yml` files (e.g. `dashboard-authoring-corpus`, `eu-cra-compliance-*`, `repo-assist-issue-fix`) | error | SC1003: unescaped single quote in generated `Execute Pi CLI` step script (echo demo string) | Fix quoting in the shared shell-harness template that generates the `Execute Pi CLI` step, then recompile |
| actionlint (expression) | `optimization-token-optimizer.lock.yml:627` | error | property `token_eligible` not defined in referenced object type | Correct the expression/output reference in the workflow source |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml:2353`, `self-care-pages-health.lock.yml:2259` | error | property `safe-outputs-app-token` not defined in referenced job-outputs object | Correct the expression/output reference in the workflow source |
| zizmor | 65 lock files | High (64 occurrences) | `github-app`: dangerous use of GitHub App tokens (e.g. `uses: actions/create-github-app-token@...`) | Review App-token minting steps for scope/exposure per zizmor guidance |
| zizmor | 65 lock files | Medium (2,629) | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block |
| zizmor | 65 lock files | Medium (392) | `anonymous-definition`: unnamed reusable definitions | Name definitions per zizmor guidance |
| zizmor | 65 lock files | Low (386) | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add comments documenting each granted permission |
| zizmor | subset of lock files | Medium (39) | `artipacked`: artifact/credential packing risk | Review artifact upload steps for leaked credentials |
| zizmor | subset of lock files | Low (30) | `adhoc-packages`: ad-hoc package installation (e.g. `npm install -g` steps) | Pin/vendor installs through declared runtimes where feasible |
| zizmor | subset of lock files | Medium (11) | `template-injection`: unsanitized expression interpolation | Sanitize/quote interpolated expressions |
| zizmor | subset of lock files | Low (9) | `obfuscation`: obfuscated script content | Simplify/clarify flagged scripts |
| runner-guard | `agentic_commands.yml:1` | Medium | RGS-005: excessive permissions on untrusted trigger | Restrict write permissions for jobs triggered by `pull_request_target`/`issue_comment`/etc. |
| grype | `alpine:latest`, `gh-aw-firewall/api-proxy`, `gh-aw-firewall/cli-proxy`, `gh-aw-firewall/squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine` | Critical (34) | CVEs incl. CVE-2026-63073, CVE-2026-75803, CVE-2026-18924, CVE-2026-19931, CVE-2026-5450 | Upgrade base images / pull latest patched digests (e.g. `libcrypto3`/`libssl3` → 3.5.8-r0 on Alpine images) |
| grype | same images | High (173) | Additional High-severity CVEs (e.g. CVE-2026-18798, CVE-2026-14457) | Upgrade affected packages to fixed versions listed per finding |
| grype | same images | Medium (322) / Low (54) | Additional CVEs (e.g. CVE-2023-50387 in `bind9-libs`) | Upgrade affected packages where fixes exist |
| grant | `alpine:latest` and other images | error (1,246 total) | License policy violations (e.g. `ssl_client` GPL-2.0-only, `apk-tools` GPL-2.0-only, `alpine-baselayout-data` GPL-2.0-only) — this is the compiler's hard-fail gate | Update `grant` license policy allowlist or replace/rebuild images with compliant licensing |
| poutine | — | — | No findings | — |
| yamllint | — | — | No findings | — |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

- Summary: `Target: githubnext/gh-aw-cao`, `Exit code: 1`, `Workflow sources: 65`, `Compiled locks: 65`.
- Actionlint summary: "Checked 65 workflow(s)", "Found 95 issue(s) (95 error(s))" — 92 shellcheck, 3 expression.
- Grant summary: "grant failed — strict mode: grant found 1246 license policy finding(s) in container images".
- Zizmor scanned 65 files; 64 error-level (`High`) `github-app` findings, 2,668 warning-level, 828 info-level.
- Grype scanned 9 container images (syft SBOMs generated for all 9): `alpine:latest`, `ghcr.io/github/gh-aw-firewall/agent:0.28.16`, `ghcr.io/github/gh-aw-firewall/api-proxy:0.28.16`, `ghcr.io/github/gh-aw-firewall/squid:0.28.16`, `ghcr.io/github/gh-aw-mcpg:v0.4.21`, `ghcr.io/github/gh-aw-node`, `ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.16`, `ghcr.io/github/github-mcp-server:v1.12.1`, `node:lts-alpine`.
- No token-like or credential-like values were present in the reviewed portions of tool output.
- Deterministic evidence artifacts consulted: `summary.txt`, `exit-code.txt`, `git-status.txt`, `diff-stat.txt`, `result.json`, `report.txt` (27,598 lines) under `/tmp/gh-aw/agent/cao-evolution-compiler-security/`.

Control plane context

- Correlation ID: `35108219095-131`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35108219095`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35109070602) · copilot · auto · 53.6 AIC · ⌖ 6.98 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 2:51 PM UTC

Start with the .github/workflows/*.md sources and the gh-aw MCP server's fix and compile tools; do not edit generated .lock.yml files. Run the full strict compiler and security suite, including actionlint, shellcheck, zizmor, runner-guard, grant, grype, syft, yamllint, and poutine. Done means the generated locks reflect the source changes and the compiler and all listed scans pass, or an unsafe finding is clearly explained.

Written by the indexing model from the issue text.