[static-analysis] Report - 2026-09-04

[github-actions]

Analysis Summary

• Tools configured: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Tools with data this run: zizmor, actionlint only — see Data Gap below
• Workflows Scanned: 299 (all compiled; actionlint 0 findings)
• Zizmor result: build gate failed — 11 high-severity findings (first time in tracked history)
• Previous scan: 2026-09-02 (2026-09-03 run failed, no data — issue [aw] Static Analysis Report failed #58159)

Data Gap

poutine, runner-guard, syft, grype, yamllint, and shellcheck produced zero output lines anywhere in compile-output.txt this run (verified via case-insensitive search for tool names, CVE-, RGS-, and SBOM markers). Every prior scan back to 2026-08-22 had non-trivial data from runner-guard and grype in particular. This looks like a scan-pipeline instrumentation gap rather than those tools finding nothing — do not treat this as "0 findings," and do not close out prior findings from these tools based on this run. Recommend checking the compile step configuration for this workflow run before the next scheduled scan.

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	13,436	0	11	8,795	4,630
poutine (supply chain)	no data this run	—	—	—	—
actionlint (linting)	0	-	-	-	-
runner-guard (taint analysis)	no data this run	—	—	—	—
syft (SBOM inventory)	no data this run	—	—	—	—
grype (container CVEs)	no data this run	—	—	—	—
yamllint (yaml linting)	0	-	-	-	-
shellcheck (shell linting)	no data this run	—	—	—	—

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count	Affected Workflows
github-app	High	8	4: squad-game-planner, squad-implement-worker, squad-plan, squad (all .lock.yml)
unpinned-images	High	1	smoke-service-ports.lock.yml
github-env	High	1	dev-hawk.lock.yml
bot-conditions	High	1	squad.lock.yml
secrets-outside-env	Medium	8,719	296 of 299
artipacked	Medium	75	72
secrets-inherit	Medium	1	1
undocumented-permissions	Low	1,766	299 (all)
adhoc-packages	Low	611	238
obfuscation	Low	28	28
template-injection	Info/Low	34	13
anonymous-definition	Informational	2,190	299 (all)
superfluous-actions	Informational	1	1

Notable change: github_action_from_unverified_creator_used — present every day from 2026-08-22 through 2026-09-02 at ~29 occurrences/28 workflows — has zero occurrences today. This may be a genuine fix, or a zizmor/compiler version change; worth a quick sanity check rather than assuming resolved.

Actionlint Linting Issues

0 findings across 299 files (consistent with recent runs).

Poutine / Runner-Guard / Syft / Grype / Yamllint / Shellcheck

No output present in this run's compile artifact — see Data Gap.

Top Priority Issues

1. github-app: unscoped GitHub App tokens in the squad workflow family

• Tool: zizmor
• Count: 8 occurrences / 4 workflows
• Severity: High
• Affected: squad-game-planner.lock.yml, squad-implement-worker.lock.yml, squad-plan.lock.yml, squad.lock.yml
• Description: Each workflow mints a token via actions/create-github-app-token with no permissions: input.
• Impact: The minted token inherits the full permission set granted to the GitHub App installation, not just what the job needs. If any later step in the job is compromised, the blast radius is the entire app installation's access rather than a minimal scope.
• Reference: (docs.zizmor.sh/redacted)
• All 4 workflows share the identical "Mint Squad GitHub App token" step, suggesting one shared source template to fix rather than 4 separate edits.

2. bot-conditions: spoofable actor check

• Tool: zizmor | Severity: High | Affected: squad.lock.yml (pre_activation job)
• The job's gating if: includes github.actor == 'github-actions[bot]' as a bypass condition — github.actor is attacker-controllable in several trigger contexts and should not be trusted as an identity check.
• Reference: (docs.zizmor.sh/redacted)

3. github-env: environment-file injection risk

• Tool: zizmor | Severity: High | Affected: dev-hawk.lock.yml
• A run: step writes to $GITHUB_ENV seeded from an env:-provided value (GH_AW_RUNNER_TOOL_CACHE), which zizmor flags as a potential env-file injection vector.
• Reference: (docs.zizmor.sh/redacted)

4. unpinned-images: floating container tag

• Tool: zizmor | Severity: High | Affected: smoke-service-ports.lock.yml
• services.redis.image: redis:7 uses a floating tag instead of a digest pin.
• Reference: (docs.zizmor.sh/redacted)

None of these 4 rule+workflow combinations match any existing open or closed gh-aw issue (checked via GitHub search for github-app, zizmor, RGS in titles).

Fix Suggestion for github-app

Issue: GitHub App token minted without a permissions: scope
Severity: High
Affected Workflows: 4 workflows, 8 occurrences

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by zizmor.

Vulnerability: github-app - dangerous use of GitHub App tokens
Rule: github-app - (docs.zizmor.sh/redacted)

Current Issue:
A workflow step uses actions/create-github-app-token to mint an installation
access token but does not pass a `permissions:` input. Without it, the minted
token inherits ALL permissions granted to the GitHub App installation, not
just the subset the job actually needs.

Required Fix:
1. Locate the `uses: actions/create-github-app-token@...` step.
2. Add a `permissions:` map under `with:` listing only the scopes the token
   is actually used for downstream (check every place
   `steps.<id>.outputs.token` is consumed to determine the minimum set).
3. Apply the fix in the shared source/template that generates this step
   (not the compiled .lock.yml), since all 4 affected workflows emit an
   identical step, then recompile.
4. Re-run zizmor to confirm the finding clears.

Example:
Before:
  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
    app-id: ${{ vars.SQUAD_GITHUB_APP_ID }}
    owner: ${{ vars.SQUAD_GITHUB_APP_OWNER }}
    private-key: ${{ secrets.SQUAD_GITHUB_APP_PRIVATE_KEY }}

After:
  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
    app-id: ${{ vars.SQUAD_GITHUB_APP_ID }}
    owner: ${{ vars.SQUAD_GITHUB_APP_OWNER }}
    private-key: ${{ secrets.SQUAD_GITHUB_APP_PRIVATE_KEY }}
    permissions: >-
      {"contents": "write", "issues": "write", "pull-requests": "write"}
  (scope the map to what this token is actually used for in each workflow)

Please apply this fix to: squad-game-planner.lock.yml,
squad-implement-worker.lock.yml, squad-plan.lock.yml, squad.lock.yml
(via their shared source template).

Runner-Guard Analysis

No runner-guard output was present in compile-output.txt for this run (see Data Gap). As of the last successful data point (2026-09-02): RGS-005 (medium, 12 occurrences / 4 workflows) and RGS-012 (high, 8 occurrences / 8 workflows, believed false-positive on loopback curl in shared/playwright-title-test.md, already covered by issue #57854). No new runner-guard issues created this run since no findings data was available to act on.

All Findings Details

squad-game-planner.lock.yml / squad-implement-worker.lock.yml / squad-plan.lock.yml / squad.lock.yml

github-app (High)

• Location: "Mint Squad GitHub App token" step (actions/create-github-app-token)
• Description: Token minted without a permissions: input; inherits full app-installation permission scope.
• Reference: (docs.zizmor.sh/redacted)

squad.lock.yml

bot-conditions (High)

• Location: pre_activation job if: condition, line 2462
• Description: Includes github.actor == 'github-actions[bot]' as a spoofable bypass check.
• Reference: (docs.zizmor.sh/redacted)

dev-hawk.lock.yml

github-env (High)

• Location: line 504, run: step writing to $GITHUB_ENV
• Description: Value seeded from env.GH_AW_RUNNER_TOOL_CACHE is written into the environment file, a pattern zizmor flags as an injection vector.
• Reference: (docs.zizmor.sh/redacted)

smoke-service-ports.lock.yml

unpinned-images (High)

• Location: line 447, services.redis.image
• Description: redis:7 floating tag used instead of a digest-pinned reference.
• Reference: (docs.zizmor.sh/redacted)

Broad-coverage zizmor findings (296-299 of 299 workflows each)

• secrets-outside-env (Medium, 8,719 occurrences) — secrets referenced without a dedicated environment:.
• anonymous-definition (Informational, 2,190) — workflow/action definitions without a name:.
• undocumented-permissions (Low, 1,766) — permissions: blocks without explanatory comments.
• adhoc-packages (Low, 611, 238 workflows) — ad-hoc package installs.

These are near-universal across the workflow set and were not previously tracked at this granularity/volume — recommend confirming whether this reflects a zizmor version or ruleset change before treating it as new backlog.

Historical Trends

• Previous Scan: 2026-09-02 (1,643 total findings, 298 workflows; 2026-09-03 run failed with no data)
• Total Findings Now: 13,436 (zizmor only — not directly comparable due to the data gap and apparent zizmor ruleset change)
• Resolved: github_action_from_unverified_creator_used (info, ~29/day since 2026-08-22) — 0 today
• New: zizmor High findings in 4 previously-unflagged workflows (github-app x2, bot-conditions, github-env, unpinned-images)
• Unknown/gap: runner-guard, grype, poutine, shellcheck, syft — no data this run; last known state was RGS-005/RGS-012 (runner-guard), 14 critical/276 high (grype), SC2086 x6 (shellcheck)

Recommendations

1. Immediate: Fix the 4 new zizmor High findings, starting with github-app (8 occurrences, likely one shared-template fix) — see Fix Suggestion above.
2. Immediate: Investigate why poutine/runner-guard/syft/grype/yamllint/shellcheck produced no output this run — the scan pipeline may be silently dropping these tools' output.
3. Short-term: Confirm whether the disappearance of github_action_from_unverified_creator_used and the appearance of high-volume secrets-outside-env/anonymous-definition/undocumented-permissions reflects a zizmor version bump or ruleset change (check the pinned zizmor version against the last successful run).
4. Long-term: Once the data gap is resolved, re-baseline the historical trend series since today's totals aren't apples-to-apples with prior days.

Next Steps

• Fix github-app unscoped token minting in the 4 squad workflows
• Fix bot-conditions, github-env, unpinned-images findings
• Investigate the compile-output.txt data gap for poutine/runner-guard/syft/grype/yamllint/shellcheck
• Confirm zizmor version/ruleset change explanation for the shifted finding distribution
• Re-run a full 8-tool scan once the pipeline gap is fixed, to restore trend comparability

References:

• Workflow run: §33837880937

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Static Analysis Report · claude · agent · 223.1 AIC · ⌖ 9.57 AIC · ⊞ 11.9K · ◷

• expires on Sep 10, 2026, 8:57 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.88 AIC · ⌖ 19 AIC · ⊞ 20.7K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #58730

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.