[static-analysis] RGS-008: Secret Directly Interpolated in run Block in ci.yml

[github-actions]

🚨 Runner-Guard Security Finding

Rule: RGS-008 — Secret Directly Interpolated in run Block
Severity: High
File: .github/workflows/ci.yml
Line: 776

Description

A ${{ secrets.* }} expression or ${{ github.token }} appears directly inside a run: block's shell script rather than being passed via the env: mapping.

When secrets are interpolated directly into run: blocks using ${{ }} expressions, they are literally pasted into the shell script as plain text before execution.

Impact

This creates multiple risks:

1. Log exposure: The secret value becomes part of the shell script text, potentially visible in error messages, debug logs, or process listings
2. Shell injection: If the secret value contains shell metacharacters (quotes, backticks, dollar signs, semicolons), it can break the shell script syntax or cause unintended command execution
3. Side-channel exposure: The secret is exposed to shell history and /proc filesystem
4. Expression injection amplification: Any expression injection vulnerability in the same run: block gains direct access to the secret value

GitHub's log masking only redacts known secret values from output, but cannot prevent secrets from being captured via side channels when they are embedded in the script source.

Remediation

Pass secrets via the env: mapping instead of direct interpolation:

Before (vulnerable):

- name: Deploy
  run: |
    curl -H "Authorization: Bearer ${{ secrets.API_TOKEN }}" (api.example.com/redacted)

After (safe):

- name: Deploy
  env:
    API_TOKEN: ${{ secrets.API_TOKEN }}
  run: |
    curl -H "Authorization: Bearer ${API_TOKEN}" (api.example.com/redacted)

This ensures the secret is passed as an environment variable and never directly embedded in the shell script text.

---

Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25244792701

Generated by Static Analysis Report · ● 581K · ◷

• expires on May 9, 2026, 5:41 AM UTC