You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Total Findings: 2,682 (excluding SBOM package inventory) — down from 2,724 on 2026-08-05
Workflows Scanned: 275
Workflows Affected: ~18 workflows carry at least one finding from a security/lint tool (excludes container CVEs, which affect 16 images used across many workflows)
Note: the # poutine:ignore untrusted_checkout_exec comment is present in these generated .lock.yml files but lands one line above the flagged run: step (an off-by-one in source-map generation), so poutine still reports it. See fix suggestion below.
Actionlint Linting Issues
Issue Type
Count
Affected Workflows
shellcheck: SC2016 (Expressions don't expand in single quotes)
All counts are unchanged from the 2026-08-05 scan.
Issues created: none (all High-severity findings already map to previously-closed issues — see dedup detail below). Medium-severity findings (RGS-005, RGS-019) are not eligible for new-issue creation per policy.
Since all matches were closed issues (not open), per dedup policy these are skipped rather than recreated or commented on — consistent with the concern raised in #31043 about RGS-* issues being recreated daily after closure.
Grype Container Vulnerability Findings
Image
Critical
High
Total
ghcr.io/github/serena-mcp-server:sha-891c160
64
389
1,113
mcp/arxiv-mcp-server
16
115
410
ghcr.io/github/gh-aw-firewall/agent:0.27.44
0
4
370
mcp/context7
10
76
171
grafana/mcp-grafana
7
19
162
mcp/memory
8
58
125
mcp/ast-grep:latest
6
38
95
node:lts-alpine
1
6
22
ghcr.io/github/gh-aw-firewall/squid:0.27.44
0
14
22
ghcr.io/github/gh-aw-mcpg:v0.4.8
0
6
21
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44
0
4
19
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44
0
4
18
ghcr.io/fabio-rovai/open-ontologies:latest
1
2
17
ghcr.io/github/github-mcp-server:v1.8.0
1
3
14
ghcr.io/github/gh-aw-node
0
2
14
python:alpine
0
3
12
serena-mcp-server and mcp/arxiv-mcp-server remain the two heaviest images by far (1,113 and 410 findings respectively, together ~60% of all container CVE findings). Top recurring CVEs by fan-out: CVE-2026-53615/53613/27456/13595 (64 occurrences each, in serena-mcp-server), CVE-2025-60876 (60), CVE-2026-3184 / CVE-2025-14104 / CVE-2022-0563 (50 each).
Yamllint YAML Linting Findings
No issues — 0 findings across 275 files.
Shellcheck Shell Linting Findings
No issues from the standalone shellcheck pass (0 findings). All 6 shellcheck findings this run were surfaced via actionlint's embedded shellcheck integration (see Actionlint table above).
Description: Steps running bash "${RUNNER_TEMP}/gh-aw/actions/*.sh" are flagged as "Arbitrary Code Execution from Untrusted Code Changes" even though a # poutine:ignore untrusted_checkout_exec comment exists in the source.
Impact: The ignore annotation is present but structurally misplaced by the compiler's source-map generation (lands one line above the actual run: step), so poutine can't associate it with the right line and keeps reporting a finding the workflow authors already reviewed and suppressed. This creates permanent unactionable noise in every scan.
2. Runner-Guard RGS-004 — dev-hawk.lock.yml (96 occurrences, single workflow)
Tool: runner-guard
Count: 96
Severity: High
Affected: dev-hawk.lock.yml
Description: dev-hawk.md is triggered by workflow_run and every generated run: step in the ~1000-line lock file trips RGS-004 because runner-guard doesn't recognize the workflow's actor allowlist (contains(fromJSON('[...]'), github.event.workflow_run.actor.login)) as an equivalent authorization gate to author_association.
You are fixing a static-analysis false-positive caused by a source-map bug in the gh-aw workflow compiler.
**Vulnerability class**: poutine `untrusted_checkout_exec` (Arbitrary Code Execution from Untrusted Code Changes)
**Current Issue**:
Generated `.lock.yml` files (e.g. smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml) contain steps like:
- name: Save base github folders
env:
GH_AW_AGENT_FILES: "AGENTS.md"
# poutine:ignore untrusted_checkout_exec
run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
The `# poutine:ignore untrusted_checkout_exec` comment IS present, but poutine's line-attribution logic does not associate it with the `run:` line below it in this generated structure (the comment sits under `env:` rather than immediately above `run:`), so the finding is still reported.
**Required Fix**:
1. Locate the compiler template/generator responsible for emitting these steps (search the compiler source for "poutine:ignore untrusted_checkout_exec" and "save_base_github_folders").
2. Ensure the `# poutine:ignore untrusted_checkout_exec` comment is emitted as the line immediately preceding the `run:` key in the generated YAML (not preceding `env:` or any other key), matching poutine's expected comment-to-statement adjacency.
3. Regenerate all `.lock.yml` files and confirm poutine no longer reports `untrusted_checkout_exec` for these 10 previously-suppressed locations.
4. Add or update a compiler test asserting the ignore comment is the immediate predecessor line of the `run:` key it annotates.
**Example**:
Before (comment attached to the wrong statement):
```yaml
- name: Save base github folders
env:
GH_AW_AGENT_FILES: "AGENTS.md"
# poutine:ignore untrusted_checkout_exec
run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
After (comment directly above run:):
- name: Save base github foldersenv:
GH_AW_AGENT_FILES: "AGENTS.md"run: | # poutine:ignore untrusted_checkout_exec bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
(Exact placement depends on poutine's actual comment-scanning rule — verify against poutine's source/docs for whether it scans the line above the step or the line above run: specifically, then match that.)
Please apply this fix to all affected workflows: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml (and their non-lock source templates, since lock files are regenerated).
### Historical Trends
- **Previous Scan**: 2026-08-05 (issue #50492)
- **Total Findings Then**: 2,724
- **Total Findings Now**: 2,682
- **Change**: -42 (-1.5%)
#### New Issues
- Actionlint `shellcheck: SC2016` now also affects daily-arxiv-researcher.lock.yml and daily-code-metrics.lock.yml (previously only smoke-crush.lock.yml), raising the actionlint total from 2 → 6.
#### Resolved Issues
- Grype total dropped from 2,581 → 2,535 (-46), Critical from 113 → 114 (+1, essentially flat), High from 735 → 743 (+8). The net reduction came from Medium/Low/Negligible buckets shifting slightly as container images were bumped a patch version (agent/cli-proxy/api-proxy/squid 0.27.43→0.27.44, mcpg v0.4.7→v0.4.8).
- No change in zizmor, poutine, or runner-guard counts — all findings are recurring from prior scans with matching closed issues.
### Recommendations
1. **Immediate**: None of today's High/Critical findings are new — all are previously-triaged and either closed (accepted risk / false positive) or tracked. No urgent action required this cycle.
2. **Short-term**: Fix the poutine `untrusted_checkout_exec` comment-placement bug (see Fix Suggestion above) to eliminate 10 recurring false-positive-adjacent findings permanently, and investigate the new SC2016 shellcheck warnings in daily-arxiv-researcher.lock.yml / daily-code-metrics.lock.yml.
3. **Long-term**: Consider teaching runner-guard's RGS-004 rule to recognize actor-allowlist patterns (`contains(fromJSON(...), github.event.*.actor.login)`) as an equivalent gate to `author_association` checks, to stop the 96x noise from dev-hawk.lock.yml on every scan.
4. **Prevention**: `serena-mcp-server` and `mcp/arxiv-mcp-server` account for ~57% of all grype findings (1,523 of 2,535) — consider pinning to slimmer/more current base images or scheduling a dedicated upgrade pass for these two MCP server images.
### Next Steps
- [ ] Fix poutine ignore-comment placement bug in the compiler (smoke-workflow-call*.lock.yml templates)
- [ ] Investigate new SC2016 shellcheck findings in daily-arxiv-researcher.lock.yml and daily-code-metrics.lock.yml
- [ ] Evaluate teaching RGS-004 to recognize actor-allowlist authorization patterns
- [ ] Consider a base-image refresh pass for serena-mcp-server and mcp/arxiv-mcp-server (highest CVE fan-out)
- [ ] No new GitHub issues required this cycle — all High/Critical findings map to already-closed prior issues
**References:**
- [§31074549374](https://github.com/github/gh-aw/actions/runs/31074549374)
> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/31074549374) · agent · 132.7 AIC · ⌖ 43.8 AIC · ⊞ 11.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-08-13T06:05:32.057Z --> on Aug 12, 2026, 10:05 PM UTC-08:00
<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 31074549374, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/31074549374 -->
<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->
Analysis Summary
Findings by Tool
Clustered Findings by Tool and Type
Zizmor Security Findings
github_action_from_unverified_creator_usedAll 9 already carry
# zizmor: ignore[...]annotations — informational only, no action needed.Poutine Supply Chain Findings
untrusted_checkout_execpr_runs_on_self_hostedNote: the
# poutine:ignore untrusted_checkout_execcomment is present in these generated.lock.ymlfiles but lands one line above the flaggedrun:step (an off-by-one in source-map generation), so poutine still reports it. See fix suggestion below.Actionlint Linting Issues
shellcheck: SC2016(Expressions don't expand in single quotes)Up from 2 occurrences on 2026-08-05 (smoke-crush.lock.yml only) — daily-arxiv-researcher.lock.yml and daily-code-metrics.lock.yml are newly affected.
Syft SBOM Inventory
16 images, 5,354 total packages
All firewall/mcpg images bumped a patch version since 2026-08-05 (0.27.43→0.27.44, v0.4.7→v0.4.8).
Runner-Guard Taint Analysis Findings
All counts are unchanged from the 2026-08-05 scan.
Issues created: none (all High-severity findings already map to previously-closed issues — see dedup detail below). Medium-severity findings (RGS-005, RGS-019) are not eligible for new-issue creation per policy.
Runner-Guard issue dedup detail
Since all matches were closed issues (not open), per dedup policy these are skipped rather than recreated or commented on — consistent with the concern raised in #31043 about RGS-* issues being recreated daily after closure.
Grype Container Vulnerability Findings
serena-mcp-serverandmcp/arxiv-mcp-serverremain the two heaviest images by far (1,113 and 410 findings respectively, together ~60% of all container CVE findings). Top recurring CVEs by fan-out: CVE-2026-53615/53613/27456/13595 (64 occurrences each, in serena-mcp-server), CVE-2025-60876 (60), CVE-2026-3184 / CVE-2025-14104 / CVE-2022-0563 (50 each).Yamllint YAML Linting Findings
No issues — 0 findings across 275 files.
Shellcheck Shell Linting Findings
No issues from the standalone shellcheck pass (0 findings). All 6 shellcheck findings this run were surfaced via actionlint's embedded shellcheck integration (see Actionlint table above).
Top Priority Issues
1. Poutine
untrusted_checkout_exec— ignore-comment off-by-onebash "${RUNNER_TEMP}/gh-aw/actions/*.sh"are flagged as "Arbitrary Code Execution from Untrusted Code Changes" even though a# poutine:ignore untrusted_checkout_execcomment exists in the source.run:step), so poutine can't associate it with the right line and keeps reporting a finding the workflow authors already reviewed and suppressed. This creates permanent unactionable noise in every scan.2. Runner-Guard RGS-004 — dev-hawk.lock.yml (96 occurrences, single workflow)
dev-hawk.mdis triggered byworkflow_runand every generatedrun:step in the ~1000-line lock file trips RGS-004 because runner-guard doesn't recognize the workflow's actor allowlist (contains(fromJSON('[...]'), github.event.workflow_run.actor.login)) as an equivalent authorization gate toauthor_association.contents: read/actions: read/pull-requests: read(no write permissions), which materially reduces real risk. However, the 96x repetition (once per generated step) makes this rule's output for this workflow effectively unreadable signal. Previously tracked and closed in [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in dev-hawk.lock.yml #50189 and (for the broader false-positive pattern) Suppress RGS-004 runner-guard false positives for activation-gated jobs #50370.Fix Suggestion for Poutine
untrusted_checkout_execIssue: Ignore-comment misalignment in generated
.lock.ymlfiles causes poutine to keep flagging already-reviewed, already-suppressed findings.Severity: Error (High)
Affected Workflows: 2 workflows (10 findings)
Prompt to Copilot Agent:
After (comment directly above
run:):(Exact placement depends on poutine's actual comment-scanning rule — verify against poutine's source/docs for whether it scans the line above the step or the line above
run:specifically, then match that.)Please apply this fix to all affected workflows: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml (and their non-lock source templates, since lock files are regenerated).