[static-analysis] Report - 2026-08-16

[github-actions]

🔍 Static Analysis Report - 2026-08-16

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 1,681 (127 security-relevant across zizmor/poutine/runner-guard, 1,536 container CVEs, 0 lint issues)
• Workflows Scanned: 285 (285 succeeded, 208 compiler warnings)
• Workflows Affected (security tools): 15

Findings by Tool

Tool	Total	Critical	High	Medium	Low/Note
zizmor (security)	9	0	0	1	8
poutine (supply chain)	0	0	0	0	0
actionlint (linting)	0	-	-	-	-
runner-guard (taint analysis)	127	0	116	11	0
syft (SBOM inventory)	10 images / 3,662 packages	-	-	-	-
grype (container CVEs)	1,536	51	188	517	780 (106 low + 637 negligible + 37 unknown)
yamllint (yaml linting)	0	-	-	-	-
shellcheck (shell linting)	0	-	-	-	-

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count	Affected Workflows
github_action_from_unverified_creator_used	note	8	dataflow-pr-discussion-dataset, hippo-embed, super-linter, smoke-codex, copilot-setup-steps, daily-elixir-credo-snippet-audit, link-check (×2)
pr_runs_on_self_hosted	warning	1	smoke-copilot-arm

All 8 unverified-creator findings are already suppressed inline with # zizmor: ignore[...] comments — these are accepted risks (pinned by SHA), not new action items.

Poutine Supply Chain Findings

None reported this run.

Actionlint Linting Issues

None — "Checked 285 workflow(s) / No issues found."

Runner-Guard Taint Analysis Findings

Runner-Guard Score: not reported by the scanner this run (no summary/grade line emitted).

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	High	98	dev-hawk.lock.yml
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	14	daily-byok-ollama-test, daily-model-inventory, docs-noob-tester, visual-regression-checker
RGS-018	Suspicious Payload Execution Pattern	High	4	daily-byok-ollama-test, daily-cli-performance, daily-sentrux-report, smoke-claude
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	9	agentic_commands.yml, ai-moderator.lock.yml, q.lock.yml
RGS-019	Step Output Interpolated in run Block	Medium	2	error-message-lint.yml, windows-cli-integration.yml

Issues created: none (all Critical/High rule+file combinations already have a matching prior issue — see dedup table below).

Deduplication check against prior issues

Rule + File	Prior Issue	Status
RGS-004 dev-hawk.lock.yml	#50189	Closed (superseded chain) → skipped
RGS-012 daily-model-inventory.lock.yml	#51943	Closed → skipped
RGS-012 visual-regression-checker.lock.yml	#51945	Closed → skipped
RGS-012 daily-byok-ollama-test.lock.yml	#51944	Closed → skipped
RGS-012 docs-noob-tester.lock.yml	#50190	Closed → skipped
RGS-018 daily-sentrux-report.lock.yml	#46532	Closed → skipped
RGS-018 smoke-claude.lock.yml	#47477	Closed → skipped
RGS-018 daily-cli-performance.lock.yml	#47478	Closed → skipped

Note: several of these prior issues were closed as "superseded by a newer report issue" rather than fixed — the underlying findings likely remain unresolved but are already tracked under gh-aw's recurring-report cadence, so per the dedup policy no new issue is opened.

Grype Container Vulnerability Findings

Image	Critical	High	Medium	Low+	Notes
ghcr.io/oraios/serena:1.7.0	51	~150	~700	rest	Debian trixie base; nearly all Critical findings live here (curl, perl, openssh, node)
ghcr.io/github/gh-aw-firewall/agent:0.28.1	0	4 (2× brace-expansion, 1× ip-address, Go stdlib)	many	many	Ubuntu 22.04 base
ghcr.io/github/gh-aw-mcpg:v0.4.9	0	several (Go stdlib, grpc, sigstore)	-	-
node:lts-alpine	0	1 (ip-address)	-	-
others (api-proxy, cli-proxy, squid, gh-aw-node, github-mcp-server, mcp-grafana)	0	few each (mostly Go stdlib CVEs)	-	-

Unique vulnerability IDs across all images: 432.

Yamllint YAML Linting Findings

None.

Shellcheck Shell Linting Findings

None.

Top Priority Issues

1. RGS-004: Comment-Triggered Workflow Without Author Authorization Check

• Tool: runner-guard
• Count: 98 (single job in dev-hawk.lock.yml, one finding per privileged step)
• Severity: High
• Affected: dev-hawk.lock.yml
• Description: dev-hawk.md triggers on workflow_run after Dev completes, gated only by event == 'workflow_dispatch', with no check on who dispatched the upstream run before posting comments / using copilot-requests: write.
• Impact: Any principal able to workflow_dispatch the Dev workflow on a copilot/* branch can cause privileged analysis + comment posting without further authorization.
• Reference: https://github.com/Vigilant-LLC/runner-guard

2. Critical container CVEs in ghcr.io/oraios/serena:1.7.0

• Tool: grype
• Count: 51 Critical, ~150 High
• Severity: Critical
• Affected: any workflow using the Serena MCP tool container
• Description: Debian-based image carries outdated curl, perl, openssh, and node packages with known Critical CVEs (e.g. CVE-2026-10536, CVE-2026-8924/8926/8927/9079 in curl; CVE-2026-60002 in openssh; GHSA-23hp-3jrh-7fpw in tar).
• Impact: Largest concentration of unpatched Critical/High vulnerabilities of any image in the fleet; worth an upstream version bump or base-image refresh.
• Reference: https://github.com/oraios/serena

3. RGS-012: Secret Exfiltration via Outbound HTTP Request

• Tool: runner-guard
• Count: 14 across 4 workflows
• Severity: High
• Affected: daily-byok-ollama-test, daily-model-inventory, docs-noob-tester, visual-regression-checker
• Description: run: blocks make outbound HTTP requests to non-GitHub domains in jobs with secrets/publishing access. Several are already annotated with # runner-guard:ignore RGS-012 justifying benign use (localhost probes, public read-only APIs), but not all instances carry that annotation.
• Impact: Potential credential-exfiltration primitive if a step's inputs become attacker-influenced.
• Reference: https://github.com/Vigilant-LLC/runner-guard

Fix Suggestion for RGS-004 (Comment-Triggered Workflow Without Author Authorization Check)

Issue: High-severity, 98 flagged steps concentrated in one workflow, unresolved since at least 2026-08-04.
Severity: High
Affected Workflows: 1 workflow (dev-hawk.lock.yml)

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by runner-guard (rule RGS-004).

**Vulnerability**: Comment-Triggered Workflow Without Author Authorization Check
**Rule**: RGS-004 — https://github.com/Vigilant-LLC/runner-guard

**Current Issue**:
The workflow is triggered by `issue_comment`, `pull_request_review_comment`, or `workflow_run`
(an event indirectly triggerable by non-maintainers), and the compiled job accesses secrets or
has write permissions (e.g. `safe-outputs.add-comment`, `copilot-requests: write`) without first
checking the triggering actor's authorization level.

**Required Fix**:
1. Add an explicit authorization gate before any privileged step — check
   `github.event.comment.author_association` (issue_comment) or the upstream run's actor
   (workflow_run) against an allow-list (OWNER, MEMBER, COLLABORATOR).
2. Prefer the gh-aw frontmatter-level mechanism so the compiler emits the gating job
   consistently: add `roles: [admin, maintainer, write]` to the workflow's `on:` frontmatter,
   matching the pattern already used in `q.md` / `ai-moderator.md`.
3. If triggered via `workflow_run`, confirm which principals can dispatch the upstream workflow
   and restrict `on.workflow_run` to trusted branches/workflows only.

**Example**:

Before:
on:
  workflow_run:
    workflows: ["Dev"]
    types: [completed]
    branches: ["copilot/*"]

After:
on:
  workflow_run:
    workflows: ["Dev"]
    types: [completed]
    branches: ["copilot/*"]
  roles: [admin, maintainer, write]

Please apply this fix to: .github/workflows/dev-hawk.md (source for dev-hawk.lock.yml).

All Findings Details

Detailed Findings by Workflow

dev-hawk.lock.yml

RGS-004 — Comment-Triggered Workflow Without Author Authorization Check

• Severity: High
• Location: 98 steps across one compiled job
• Description: No author-association check before privileged workflow_run-triggered steps.
• Reference: https://github.com/Vigilant-LLC/runner-guard

daily-byok-ollama-test.lock.yml / daily-model-inventory.lock.yml / docs-noob-tester.lock.yml / visual-regression-checker.lock.yml

RGS-012 — Secret Exfiltration via Outbound HTTP Request

• Severity: High
• Description: Outbound HTTP requests to non-GitHub domains in jobs with secret/publish access. Some instances (visual-regression-checker readiness probes, daily-model-inventory's models.dev fetch) carry runner-guard:ignore justifications for benign, unauthenticated, read-only use.
• Reference: https://github.com/Vigilant-LLC/runner-guard

daily-byok-ollama-test.lock.yml / daily-cli-performance.lock.yml / daily-sentrux-report.lock.yml / smoke-claude.lock.yml

RGS-018 — Suspicious Payload Execution Pattern

• Severity: High
• Description: run: blocks match threat-signature heuristics for obfuscated payload execution (e.g. tool installers piping to bash, MCP script config writers). Likely false positives against legitimate installer patterns, but worth a human skim per workflow.
• Reference: https://github.com/Vigilant-LLC/runner-guard

agentic_commands.yml / ai-moderator.lock.yml / q.lock.yml

RGS-005 — Excessive Permissions on Untrusted Trigger

• Severity: Medium
• Description: Write-level permissions: combined with pull_request_target/issue_comment-class triggers.
• Reference: https://github.com/Vigilant-LLC/runner-guard

error-message-lint.yml / windows-cli-integration.yml

RGS-019 — Step Output Interpolated in run Block

• Severity: Medium
• Description: ${{ steps.<id>.outputs.<name> }} interpolated directly into a run: shell block; safe only if the producing step's output can't contain shell metacharacters.
• Reference: https://github.com/Vigilant-LLC/runner-guard

ghcr.io/oraios/serena:1.7.0 (container)

Grype: 51 Critical, ~150 High CVEs

• Description: Outdated curl/perl/openssh/node/tar packages on Debian trixie base.
• Reference: https://github.com/oraios/serena

Historical Trends

• Previous Scan (in cache-memory): none found — this is the first run tracked under /tmp/gh-aw/cache-memory/security-scans/
• Total Findings Now: 1,681
• No trend delta available; today's numbers establish the baseline for future comparisons.

Recommendations

1. Immediate: None new — all Critical/High runner-guard findings already have closed tracking issues; owners should confirm those closures reflect an accepted-risk decision (not an abandoned fix), especially RGS-004 in dev-hawk.lock.yml which has been recurring since at least 2026-08-04.
2. Short-term: Consider pinning/upgrading ghcr.io/oraios/serena to a base image without the 51 Critical CVEs currently carried (curl, perl, openssh chain).
3. Long-term: RGS-005 (excessive permissions on untrusted triggers) and RGS-019 (step-output interpolation) have no prior issues — worth a first pass now while counts are still small (9 and 2 respectively).
4. Prevention: Keep using # runner-guard:ignore RGS-XXX -- reason annotations for confirmed-benign patterns (already used well in visual-regression-checker.lock.yml and daily-model-inventory.lock.yml) to reduce recurring noise on reviewed findings.

Next Steps

• Decide whether the dev-hawk.lock.yml RGS-004 finding is an accepted risk or needs the roles: frontmatter fix
• Triage RGS-005 (excessive permissions) findings in agentic_commands.yml, ai-moderator.lock.yml, q.lock.yml — no issue opened yet
• Triage RGS-019 (step output interpolation) in error-message-lint.yml, windows-cli-integration.yml — no issue opened yet
• Evaluate upgrading/patching the oraios/serena container image
• Continue tracking scan history in cache-memory for trend analysis going forward

References:

• §31927538151

Generated by 📊 Static Analysis Report · agent · 169.8 AIC · ⌖ 7.38 AIC · ⊞ 11.3K · ◷

• expires on Aug 22, 2026, 9:19 PM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #53303

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.