[cao-evolution:compiler-security] gh-aw compiler/security scan findings: 34 Critical + 173 High CVEs, 64 High github-app zizmor findings, 1246 license violations

Compiling all 65 GitHub Agentic Workflow sources in `githubnext/gh-aw-cao` at `53dca29` succeeded (65/65 lock files regenerated), but the full validation, lint, container, and security-scanner suite reports **1,919+ findings** across actionlint/shellcheck, zizmor, grype, and grant, so the compiler exited non-zero. Highest-severity supported findings: **34 Critical** (grype container CVEs, e.g. CVE-2026-63073, CVE-2026-75803) and **64 High** zizmor `github-app` findings (dangerous use of GitHub App tokens) repeated across nearly every lock file, plus 173 High grype CVEs and 1,246 grant license-policy violations. No credentials were exposed in this evidence.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| zizmor | All 64 affected `.lock.yml` files (e.g. `cao-evolution.lock.yml`, `self-care.lock.yml`, `repo-assist.lock.yml`) | High | `github-app`: dangerous use of GitHub App tokens | Regenerate tokens through the documented least-privilege pattern; review `docs.zizmor.sh/audits/#github-app` guidance and adjust the shared control workflow that mints these tokens |
| zizmor | Same 64 files, ~2,629 occurrences | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret references into a scoped `environment:` block per job |
| zizmor | Same files, ~392 occurrences | Informational | `anonymous-definition`: workflow/job definitions without a `name:` | Add descriptive `name:` fields to jobs (low priority, cosmetic) |
| zizmor | Same files, ~386 occurrences | Low | `undocumented-permissions`: `permissions:` blocks lack explanatory comments | Add short comments explaining each granted permission |
| zizmor | Multiple files, 39 occurrences | Medium | `artipacked`: workflow artifacts may retain credentials | Review artifact upload steps for credential leakage |
| grype | `alpine:latest` | Critical/High | CVE-2026-63073, CVE-2026-75803, CVE-2026-18798, CVE-2026-63076 in `libcrypto3`/`libssl3` 3.5.7-r0 | Bump base image to pick up `libssl3`/`libcrypto3` 3.5.8-r0 |
| grype | `ghcr.io/github/gh-aw-firewall/agent:0.28.16` | High | GHSA-rgw5-rvv9-x895: `brace-expansion@5.0.7` (fix 5.0.9) | Update the pinned firewall/agent image to a version with the patched npm dependency |
| grype | 9 container images total | Critical (34), High (173), Medium (322), Low (54) | CVEs in OS packages (bind9-libs, curl, libexpat1, libpython3.10, php8.1-*, etc.) | Update pinned base/tool images (`gh-aw-firewall/*`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `node:lts-alpine`) to latest patched digests |
| grant | 9 container images | Error (1,246 findings) | License-policy violations (GPL-2.0-only, LGPL variants, custom licenses) across OS packages in every scanned image | Review `grant` license policy configuration; either accept documented exceptions for base-image system packages or replace flagged packages/images |
| actionlint/shellcheck | `dashboard-authoring-corpus.lock.yml`, `eu-cra-compliance*.lock.yml` (16 files), step "Execute Pi CLI" | Error (92 occurrences) | SC1003: unescaped single quote in generated shell snippet (`echo 'This is how it'\''s done'`) | Fix the quoting in the shared "Execute Pi CLI" script source and recompile |
| actionlint | `optimization-token-optimizer.lock.yml:627`, `self-care-dashboard-performance.lock.yml:2353`, `self-care-pages-health.lock.yml:2259` | Error (3 occurrences) | `[expression]` referencing undefined properties (`token_eligible`, `safe-outputs-app-token`) in generated `if:`/output expressions | Fix the shared control template generating these expressions so referenced output/property names match actual step outputs |
| poutine / runner-guard | `agentic_commands.yml` | Medium | RGS-005: excessive permissions (write-level) on an untrusted-trigger workflow | Review permissions granted to jobs triggered by `pull_request_target`/`issue_comment`-style events in this workflow and scope them down |

Uncommitted local repository drift also observed (not part of the scanner findings, informational only): 15 `.lock.yml` files plus `agentic-auto-upgrade.yml` show only a scheduled-cron-time diff (deterministic schedule scattering), and an untracked `.poutine.yml` config file is present in the target checkout.

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Actionlint summary:
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

Zizmor rule totals (across 65 lock files):
```
2629 warning [Medium] secrets-outside-env
392 info [Informational] anonymous-definition
386 info [Low] undocumented-permissions
64 error [High] github-app
39 warning [Medium] artipacked
30 info [Low] adhoc-packages
9 info [Informational] template-injection
9 info [Low] obfuscation
2 info [Low] template-injection
```

Grype severity totals (9 container images):
```
34 Critical
173 High
322 Medium
54 Low
```

Grant (license scanner): `grant failed — strict mode: grant found 1246 license policy finding(s) in container images`

Poutine/runner-guard: 1 finding — `agentic_commands.yml:1:1 RGS-005 (medium)` — excessive permissions on untrusted trigger.

Diff summary (git-status.txt): 16 files modified (cron schedule scatter only), 1 untracked `.poutine.yml`.

No token-like or credential-like values were present in the tool output reviewed.

Control plane context

- **Correlation ID**: 35114758963-132
- **Central repository**: githubnext/gh-aw-cao
- **Control plane run URL**: https://github.com/githubnext/gh-aw-cao/actions/runs/35114758963

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35115587356) · copilot · auto · 57.1 AIC · ⌖ 8.19 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 3:49 PM UTC

Start in the .github/workflows/*.md sources and the shared control workflow behind the generated .lock.yml files; use the gh aw MCP server's fix and compile tools rather than editing generated files. Re-run the strict compiler and listed security scanners, then review the lock-file diffs. Done means the full validation and security scan passes, or an unfixable finding is clearly documented.

Written by the indexing model from the issue text.