[static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in dev-hawk.lock.yml

[github-actions]

🚨 Runner-Guard Security Finding

Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
File: .github/workflows/dev-hawk.lock.yml
Line: 123 (and 95 other steps across the same compiled job)

Description

A workflow is triggered by issue_comment, pull_request_review_comment, or workflow_run events and accesses secrets or has write permissions, but does not verify the comment author's authorization level before executing privileged operations. The workflow_run trigger is dangerous when it runs after a workflow that can itself be triggered by forks, because it inherits base-repo context/secrets while depending on an event that may originate from untrusted input.

Impact

dev-hawk.md triggers on workflow_run (workflows: Dev, types: completed, branches: copilot/*) gated further by if: github.event.workflow_run.event == 'workflow_dispatch', and has safe-outputs.add-comment (writes PR comments) plus copilot-requests: write. There is no explicit check on who dispatched the upstream Dev run or on github.actor/author association before the analysis-and-comment steps execute. If the upstream Dev workflow can be workflow_dispatch-triggered by non-maintainers (e.g. any repo collaborator with actions:write, or a workflow_dispatch input abused via a compromised branch), this workflow will run and post a comment without further authorization checks.

Remediation

1. Add an explicit authorization check (e.g. verify github.event.workflow_run.actor.login or the triggering user's association) before the analysis/comment steps run, mirroring the pattern used in other gh-aw workflows (e.g. q.md which restricts via roles: [admin, maintainer, write]).
2. Alternatively, add roles: / skip-author-associations: restrictions to dev-hawk.md's on: frontmatter so the compiler emits the gating job automatically, consistent with ai-moderator.md's pattern.
3. Confirm which principals can dispatch the Dev workflow on copilot/* branches, and restrict if broader than intended.

---

Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30881086944

Generated by 📊 Static Analysis Report · agent · 216.2 AIC · ⌖ 39.2 AIC · ⊞ 5.7K · ◷

• expires on Aug 10, 2026, 10:11 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.11 AIC · ⌖ 7.93 AIC · ⊞ 10.1K · ◷

[github-actions]

🔄 Recurring Finding — 2026-08-05

This finding was detected again in today's static analysis scan.

Workflow run: https://github.com/github/gh-aw/actions/runs/30978455558
File: .github/workflows/dev-hawk.lock.yml
Line: 127 (96 occurrences across the same compiled job)

Context: since the 2026-08-04 scan, ai-moderator.lock.yml and q.lock.yml had this same rule (RGS-004) fixed — they now only trip RGS-005 (excessive permissions), meaning an author-authorization check was added there but this workflow (dev-hawk.lock.yml) still lacks one. Its workflow_run trigger is gated only by if: ${{ github.event.workflow_run.event == 'workflow_dispatch' }}, which restricts by upstream trigger type but not by actor/author.

This issue remains open. Please prioritize remediation to prevent recurring alerts.

Generated by 📊 Static Analysis Report · agent · 137.9 AIC · ⌖ 38.8 AIC · ⊞ 5.7K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #50492

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.