[cao-evolution:compiler-security] gh-aw compiler & security scan findings: 64 High zizmor, 220 CVEs, 1246 license violations across 9 images

Compiled all 65 GitHub Agentic Workflow sources in `githubnext/gh-aw-cao` with the gh-aw compiler's full validation, lint, container, and security-scanner suite. Compilation itself succeeded (all 65 lock files regenerated), but the run exited non-zero (1) because downstream tools reported findings: 95 actionlint issues (92 shellcheck, 3 workflow-expression errors), 64 High-severity zizmor `github-app` findings plus thousands of Medium/Low/Informational zizmor findings, 1 medium-severity runner-guard/poutine taint finding, 220 unique CVEs/GHSAs across 9 scanned container images (34 Critical, 173 High, 322 Medium, 54 Low, 27 Negligible, 14 Unknown), and a hard `grant` failure with 1246 license-policy violations in the same container images. Highest-severity supported finding: **Critical** grype CVEs in `alpine:latest` (e.g. CVE-2026-63073, CVE-2026-75803 in libssl3/libcrypto3) and 3 High-severity npm advisories (GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg in brace-expansion; GHSA-r292-9mhp-454m in tar; GHSA-mwp4-54f8-5fhr in ip-address) baked into `ghcr.io/github/gh-aw-firewall/agent:0.28.16`.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `65`
- **Generated lock files checked**: `65`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|------|-------------------|----------|---------|-------------|
| actionlint (expression) | optimization-token-optimizer.lock.yml:627 | error | `token_eligible` property not defined in referenced object | Fix source `.md` template expression; recompile |
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2353, self-care-pages-health.lock.yml:2259 | error | `safe-outputs-app-token` property not defined in referenced step outputs object | Fix source `.md` template expression; recompile |
| actionlint (shellcheck SC1003) | dashboard-authoring-corpus.lock.yml, eu-cra-compliance-article-14-reporting-readiness.lock.yml, uk-ai-advisory*.lock.yml (multiple) | error | Unescaped single quote in `echo 'This is how it's done'` sample string (92 occurrences total across affected workflows) | Escape quote in shared "Execute Pi CLI" script source; recompile |
| zizmor | 20+ workflows incl. cao-evolution*.lock.yml, dependabot*.lock.yml, eslint-rules*.lock.yml, eu-cra-compliance*.lock.yml | High (64 findings) | `github-app`: dangerous use of GitHub App tokens | Review GitHub App token usage per zizmor guidance; scope tokens narrowly |
| zizmor | many workflows | Medium (2668 findings) | `secrets-outside-env`: secrets referenced without a dedicated environment | Move secret references into a dedicated `environment:` block |
| zizmor | many workflows | Low/Informational (828 findings) | `undocumented-permissions`, `anonymous-definition` | Add explanatory comments to `permissions:`; name workflow/job definitions |
| runner-guard / poutine | agentic_commands.yml | Medium | RGS-005: excessive write permissions on untrusted trigger (`pull_request_target`/`issue_comment`-class event) | Narrow `permissions:` to read-only or split job with least privilege |
| grype | alpine:latest | Critical (2 CVEs: CVE-2026-63073, CVE-2026-75803) | libssl3/libcrypto3@3.5.7-r0 vulnerable, fix in 3.5.8-r0 | Bump base image / rebuild with patched Alpine packages |
| grype | ghcr.io/github/gh-aw-firewall/agent:0.28.16 | High (4 GHSAs) | brace-expansion (GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg), tar (GHSA-r292-9mhp-454m), ip-address (GHSA-mwp4-54f8-5fhr) — vulnerable npm deps bundled in image | Rebuild image with patched npm dependencies |
| grype | 9 images total | Critical/High/Medium/Low/Negligible/Unknown (220 unique CVEs) | OS and language-package vulnerabilities across all scanned images | Track upstream image updates for gh-aw-firewall, gh-aw-mcpg, gh-aw-node, github-mcp-server |
| grant | 9 images total | error (1246 findings) | License policy violations (GPL-2.0-only, GPL-2.0-or-later, and complex multi-license packages) across all container images, causing `grant` to fail in strict mode | Review `.poutine.yml`/grant license policy against actual base-image licenses; adjust allowed-license policy or swap base images |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Actionlint summary**
```
✓ Checked 65 workflow(s)
⚠ Found 95 issue(s) (95 error(s))
Issues by type:
• shellcheck: 92
• expression: 3
```

**Zizmor severity totals** (across 65 files): High 64, Medium 2668, Low 427, Informational 401

**Grype severity totals** (across 9 images): Critical 34, High 173, Medium 322, Low 54, Negligible 27, Unknown 14 (220 unique CVE/GHSA identifiers)

**Grant**: `strict mode: grant found 1246 license policy finding(s) in container images` (exit failure)

**Poutine / runner-guard**: 1 finding (RGS-005, medium) in `agentic_commands.yml`

**Non-lock diff (regenerated headers only)**: 16 files changed, 16 insertions(+), 16 deletions(-) — single-line diffs in workflow headers/lock timestamps; no behavioral source changes detected in this run's diff-stat.

No token-like or credential-like values were present in the reviewed evidence.

Control plane context

- Correlation ID: `35121641325-133`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35121641325

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/35122239887) · copilot · auto · 41.1 AIC · ⌖ 9.52 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 30, 2026, 4:50 PM UTC

Start with the named .github/workflows/*.md sources and agentic_commands.yml, then use the gh aw MCP server's fix and compile tools rather than editing generated lock files. Review the listed actionlint, zizmor, runner-guard, grant, grype, and syft findings, and consider the work done only when the full strict compiler and security scan passes.

Written by the indexing model from the issue text.