[static-analysis] Report - 2026-07-25

[github-actions]

🔍 Static Analysis Report — 2026-07-25

All 261 workflows compiled successfully (0 compile errors). Headline change: actionlint dropped 125 → 55 (‐56%) — the 70 expression secret_verification_result findings that persisted for weeks are now fully resolved. Runner-guard and poutine are unchanged; grype container CVEs edged down 4354 → 4212 after the firewall image bump to 0.27.41. Zizmor emitted no output again (10th consecutive run — tooling anomaly, not a clean result).

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint
• Workflows Scanned: 261 (0 compile errors)
• Container Images Inventoried: 20

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	0 ⚠️ no output	—	—	—	—
poutine (supply chain)	20	0	101	0	0
actionlint (linting)	55	—	—	—	—
runner-guard (taint)	332	0	322	10	0
syft (SBOM inventory)	20 images	—	—	—	—
grype (container CVEs)	4212	236	1315	1719	3362
yamllint (yaml)	0 errors	—	—	—	—

1 poutine's 10 untrusted_checkout_exec are error-level; remaining 10 are note/warning. 2 grype also reports 606 Negligible.

⚠️ Zizmor anomaly: the "Running zizmor" banner (line 1051) is immediately followed by "Running poutine" (line 1052) with no summary block — output has not been captured since 2026-07-16 (10 runs). This is a tooling/reporting gap, not confirmation of zero security issues. Worth investigating the zizmor step in the compile pipeline.

Clustered Findings by Tool and Type

Actionlint (55, all shellcheck)

Rule	Count	Notable Workflows (generated .lock.yml)
SC2016 (expr in single quotes)	35	agent-performance-analyzer, agentic-token-optimizer, audit-workflows, ci-coach, code-simplifier, daily-* (×12 files ×2)
SC2086 (unquoted var)	7	pr-code-quality-reviewer, impeccable/mattpocock-skills-reviewer, daily-geo-optimizer
SC2038 (find|xargs)	6	repository-quality-improver (×3), unbloat-docs (×2), spec-extractor
SC2034	2	—
SC2328/SC2327/SC2188/SC2129/SC2005	1 each	—

All 55 are in generated .lock.yml files → fixes belong in source .md/shared bundled scripts or the compiler, not hand-edits to lock files.

Poutine supply-chain findings (20)

Rule	Sev	Count	Affected
untrusted_checkout_exec	error	10	smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml — all annotated # poutine:ignore (bundled action scripts run from ${RUNNER_TEMP})
github_action_from_unverified_creator_used	note	9	copilot-setup-steps, daily-elixir-credo-snippet-audit, link-check (×2), dataflow-pr-discussion-dataset, super-linter, smoke-codex, mcp-inspector, hippo-embed (astral-sh, erlef, gaurav-nelson, safedep/pmg, super-linter, actions-ecosystem — all pinned by SHA)
pr_runs_on_self_hosted	warning	1	smoke-copilot-arm.lock.yml (ubuntu-24.04-arm)

Identical to 2026-07-21 through 07-24. All are suppressed/accepted patterns.

Runner-Guard Taint Analysis (332 — 322 High / 10 Medium)

Runner-Guard Score: not emitted (no score/grade banner this run).

Rule ID	Name	Sev	Count	Affected
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	High	308	q.lock.yml (124), dev-hawk.lock.yml (94), ai-moderator.lock.yml (90)
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	9	daily-model-inventory (4), visual-regression-checker (2), daily-byok-ollama-test (2), docs-noob-tester (1)
RGS-018	Suspicious Payload Execution Pattern	High	5	daily-byok-ollama-test:461, daily-cli-performance:792, daily-sentrux-report:512, daily-squid-image-scan:1697, smoke-claude:1307
RGS-005	(medium taint)	Med	8	ai-moderator.lock.yml, q.lock.yml
RGS-019	(medium taint)	Med	2	error-message-lint.yml:54, windows-cli-integration.yml:645

Totals identical to 2026-07-24 (322 High / 10 Medium).

Issues this run: commented on open #47726 (RGS-004 q.lock.yml, recurring). 0 new issues — every other High finding already has a closed/reviewed issue (see below). No Critical findings.

Runner-guard dedup decisions

Finding	Existing issue	Action
RGS-004 q.lock.yml	open #47726	commented (recurring)
RGS-004 dev-hawk.lock.yml	closed #30284 (body-covered)	skip
RGS-004 ai-moderator.lock.yml	closed #30284 (body-covered)	skip
RGS-012 daily-model-inventory	closed #30776	skip
RGS-012 visual-regression-checker	closed #30947	skip
RGS-012 daily-byok-ollama-test	closed #35652	skip
RGS-012 docs-noob-tester	closed #28488	skip
RGS-018 smoke-claude	closed #47477	skip
RGS-018 daily-cli-performance	closed #47478	skip
RGS-018 daily-squid-image-scan	closed #47476	skip
RGS-018 daily-sentrux-report	closed #46532	skip
RGS-018 daily-byok-ollama-test	closed #35653	skip

Per policy: closed issue for same rule+file → skip (already reviewed); open → comment; none → create (max 3/run).

Grype container CVEs (4212) — informational inventory

Severity	Count	Δ vs 07-24
Critical	236	‐17
High	1315	‐25
Medium	1719	‐57
Low	336	‐42
Negligible	606	‐1
Total	4212	‐142 (‐3.3%)

Top images by findings: serena-mcp-server:latest (1011), mcp/markitdown (768), mcp/arxiv-mcp-server (386), gh-aw-firewall/agent:0.27.41 (346), mcp/notion (314), semgrep/semgrep:latest (248).

gh-aw-owned images, Crit+High: serena-mcp-server 426, gh-aw-node 44, gh-aw-mcpg 14, github-mcp-server 3, firewall/cli-proxy 2, firewall/agent 2, firewall/api-proxy 0, firewall/squid 0. The bulk (serena, markitdown, arxiv, notion, semgrep) are upstream MCP base images, not gh-aw source code. Firewall bump 0.27.39 → 0.27.41 dropped firewall/agent findings 432 → 346.

Syft SBOM inventory (20 images, firewall v0.27.41)

Largest: serena-mcp-server (2314 pkgs), mcp/notion (604), firewall/agent (532), firewall/cli-proxy (348), markitdown (375). Smallest: python:alpine (38), github-mcp-server (40), gh-aw-mcpg (61), firewall/squid (63). No unexpected ecosystems surfaced.

Yamllint

0 YAML errors. 213 compiler advisory warnings (fixed-time schedules → suggest fuzzy daily/every 6h; 1 slash_command not using centralized routing). Unchanged from 07-24.

Top Priority Issues

1. RGS-004 — Comment-Triggered Workflow Without Author Authorization Check · runner-guard · High · 308 occurrences · q.lock.yml / dev-hawk.lock.yml / ai-moderator.lock.yml. Comment-triggered workflows with write/secret access lacking an author_association gate. Tracked in open [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in q.lock.yml #47726 (+ closed [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows) #30284). Highest-impact real security item.
2. Zizmor output gap — not a finding but a monitoring blind spot; the security scanner has produced no results for 10 runs.
3. SC2016 (×35) — most common lint issue; low severity but pervasive across generated lock files.

Fix Suggestion — SC2016 (shellcheck)

Issue: Expressions don't expand in single quotes (35 occurrences)
Severity: Low (lint)
Affected: 23 generated .lock.yml files

Prompt to Copilot Agent:

You are fixing a shellcheck lint finding (SC2016) surfaced by actionlint across generated GitHub Actions workflow lock files.

Rule: SC2016 — https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-shellcheck-integration
Docs: (www.shellcheck.net/redacted)

Current Issue:
A `run:` block uses single quotes around a string containing what looks like a shell/GitHub expression (e.g. '$VAR' or '${{ ... }}'). In single quotes the shell will NOT expand the variable, so the literal text is used. In ~half of these cases the single quotes are intentional (passing a literal template/jq program), and shellcheck is a false positive that should be suppressed rather than "fixed" by switching to double quotes — switching would break the intended literal.

IMPORTANT: These findings are in *generated* `.lock.yml` files. Do NOT edit lock files directly.
Fix the SOURCE instead:
  1. Locate the origin of each flagged script — the source `.md` workflow, a shared bundled action script under pkg/ , or the compiler template that emits it.
  2. For each occurrence decide:
     - If the variable is MEANT to expand → replace single quotes with double quotes: 'echo $VAR' → "echo $VAR" (quote the whole expansion to also avoid SC2086).
     - If the single quotes are intentional (literal jq filter, awk program, template string) → add a `# shellcheck disable=SC2016` directive on the line above, with a short comment explaining why the literal is required.
  3. Recompile with `make recompile` (or the repo's compile command) and confirm the actionlint count drops.

Example — intended expansion (fix):
Before:  run: echo 'Processing ${GITHUB_SHA}'
After:   run: echo "Processing ${GITHUB_SHA}"

Example — intentional literal (suppress):
Before:  run: jq '.data | .[]' file.json
After:   # shellcheck disable=SC2016  # literal jq filter, no shell expansion intended
         run: jq '.data | .[]' file.json

Apply across the source of these generated files: agent-performance-analyzer, agentic-token-optimizer,
audit-workflows, ci-coach, code-simplifier, copilot-centralization-drilldown, copilot-centralization-optimizer,
daily-cli-tools-tester, daily-compiler-quality, daily-observability-report, daily-regulatory,
daily-safe-output-optimizer, and 11 others. Verify no behavioral change to the emitted scripts.

Historical Trends

Metric	2026-07-24	2026-07-25	Δ
actionlint	125	55	‐70 (‐56%) ✅
poutine	20	20	0
runner-guard	332	332	0
grype	4354	4212	‐142 (‐3.3%)
zizmor	0 (no output)	0 (no output)	0
yamllint errors	0	0	0

Resolved: the 70 actionlint expression secret_verification_result findings — a weeks-long regression — are gone. New: none. Persistent: RGS-004/012/018 runner-guard set (all tracked); grype upstream-image CVE backlog; zizmor output gap.

Recommendations

1. Immediate: Investigate the zizmor step in the compile pipeline — 10 runs with no captured output means the security scanner is effectively dark.
2. Immediate: Progress RGS-004 remediation (open [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in q.lock.yml #47726) — add explicit author_association gate to the comment-triggered source workflows (q, dev-hawk, ai-moderator).
3. Short-term: Apply the SC2016 fix at source (above) to clear the remaining 55 actionlint findings.
4. Long-term: Track gh-aw-owned image CVEs (serena-mcp-server 426 Crit+High) separately from upstream MCP inventory; schedule base-image refreshes.
5. Prevention: Keep firewall images current (0.27.41 already reduced CVEs); adopt fuzzy schedules to clear the 213 yamllint advisories.

Next Steps

• Fix zizmor output capture in the static-analysis compile step
• Apply SC2016 source fix across 23 workflows
• Advance RGS-004 author-authorization remediation ([static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in q.lock.yml #47726)
• Refresh serena-mcp-server base image (426 Crit+High CVEs)
• Convert fixed-time schedules to fuzzy to clear yamllint advisories

References:

• §30145915070

Generated by 📊 Static Analysis Report · age00 · 266.7 AIC · ⌖ 18 AIC · ⊞ 10.6K · ◷

• expires on Jul 31, 2026, 10:10 PM UTC-08:00