🚨 Runner-Guard Security Finding
Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
Total Findings: 1,460 across 16 workflows
Affected Files: ace-editor, ai-moderator, archie, brave, cloclo, dev-hawk, grumpy-reviewer, mergefest, pdf-summary, plan, pr-nitpick-reviewer, q, scout, security-review, tidy, unbloat-docs
Description
Workflows triggered by issue_comment, pull_request_review_comment, or workflow_run events access secrets or have write permissions, but do not verify the comment author's authorization level before executing privileged operations.
The issue_comment event fires for comments from ANY GitHub user, including those with no affiliation to the repository. Without an explicit check on github.event.comment.author_association (e.g., requiring OWNER, MEMBER, or COLLABORATOR), any external user can trigger the workflow by posting a comment on any open issue or pull request.
Impact
If the workflow accesses secrets, performs deployments, or has write permissions, this effectively grants those privileges to arbitrary external users. This is one of the most common attack vectors in GitHub Actions supply-chain compromises.
Remediation
Add an authorization gate at the beginning of jobs that use comment triggers:
- name: Check author authorization
if: |
github.event.comment.author_association != 'OWNER' &&
github.event.comment.author_association != 'MEMBER' &&
github.event.comment.author_association != 'COLLABORATOR'
run: |
echo "Unauthorized: comment author lacks required permissions"
exit 1Or as a job-level if condition:
jobs:
agent:
if: |
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'COLLABORATOR'
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25271149715
Generated by Static Analysis Report · ● 311.9K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
Total Findings: 1,460 across 16 workflows
Affected Files: ace-editor, ai-moderator, archie, brave, cloclo, dev-hawk, grumpy-reviewer, mergefest, pdf-summary, plan, pr-nitpick-reviewer, q, scout, security-review, tidy, unbloat-docs
Description
Workflows triggered by
issue_comment,pull_request_review_comment, orworkflow_runevents access secrets or have write permissions, but do not verify the comment author's authorization level before executing privileged operations.The
issue_commentevent fires for comments from ANY GitHub user, including those with no affiliation to the repository. Without an explicit check ongithub.event.comment.author_association(e.g., requiring OWNER, MEMBER, or COLLABORATOR), any external user can trigger the workflow by posting a comment on any open issue or pull request.Impact
If the workflow accesses secrets, performs deployments, or has write permissions, this effectively grants those privileges to arbitrary external users. This is one of the most common attack vectors in GitHub Actions supply-chain compromises.
Remediation
Add an authorization gate at the beginning of jobs that use comment triggers:
Or as a job-level
ifcondition:Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25271149715