Skip to content

[static-analysis] Report - 2026-09-05 #58730

Open
Open
[static-analysis] Report - 2026-09-05#58730
Labels
automationcookieIssue Monster Loves Cookies!security

Description

@github-actions
github-actions
bot
opened on Sep 5, 2026

🔍 Static Analysis Report - 2026-09-05

Analysis Summary

  • Tools configured: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
  • Tools with data this run: zizmor, actionlint (only these two produced any output in compile-output.txt)
  • Total zizmor findings: 13,442 (+6 vs 2026-09-04's 13,436)
  • Workflows scanned: 299
  • Workflows affected (zizmor): 299 / 299
  • Build gate: ✗ zizmor failed (11 High severity findings trip the gate)

⚠️ Data-completeness note: poutine, runner-guard, syft, grype, yamllint, and shellcheck produced zero output lines anywhere in compile-output.txt for the second consecutive day (verified via case-insensitive search for tool names, CVE-, RGS-, and SBOM markers — all zero hits except the actionlint header text "Running actionlint (with shellcheck/pyflakes)..."). This is an instrumentation gap, not a clean bill of health — it should not be read as "0 findings" for those 6 tools. This is already tracked in #58562 ("Static-analysis scan pipeline instrumentation gap: 6/8 tools produced zero output") with a fix in progress at #58717 ("[WIP] Fix static-analysis scan pipeline instrumentation gap", fixes #58562). No new issue is being filed for this — see those two instead.

Findings by Tool

Tool Total Critical High Medium Low
zizmor (security) 13,442 0 11 8,801 2,408 (+2,222 informational)
poutine (supply chain) — no data (gap) — — — —
actionlint (linting) 0 - - - -
runner-guard (taint analysis) — no data (gap) — — — —
syft (SBOM inventory) — no data (gap) — — — —
grype (container CVEs) — no data (gap) — — — —
yamllint (yaml linting) — no data (gap) — — — —
shellcheck (shell linting) — no data (gap) — — — —

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type Severity Count Unique Workflows
secrets-outside-env Medium 8,725 296 / 299
anonymous-definition Informational 2,190 299 / 299
undocumented-permissions Low 1,766 299 / 299
adhoc-packages Low 611 238 / 299
artipacked Medium 75 72 / 299
template-injection Info/Low 34 13 / 299
obfuscation Low 28 28 / 299
github-app High 8 4 (squad-*.lock.yml)
secrets-inherit Medium 1 1
superfluous-actions Informational 1 1
unpinned-images High 1 1 (smoke-service-ports.lock.yml)
github-env High 1 1 (dev-hawk.lock.yml)
bot-conditions High 1 1 (squad.lock.yml)

All 4 High-severity rule/workflow pairs are unchanged since 2026-09-04 — none are new today, none have been fixed yet.

Actionlint Linting Issues

None — 0 findings across 299 files, consistent with prior runs.

Poutine / Runner-Guard / Syft / Grype / Yamllint / Shellcheck

No data produced this run (see instrumentation-gap note above). Historical baselines from the last run that had data (2026-09-02) are preserved in cache memory (vulnerabilities/by-tool.json) and should not be overwritten with zeros.

Top Priority Issues

1. zizmor github-app: unscoped GitHub App tokens in 4 squad-* workflows

  • Tool: zizmor
  • Count: 8 occurrences / 4 workflows (squad-game-planner, squad-implement-worker, squad-plan, squad)
  • Severity: High
  • Description: Each workflow mints a token via actions/create-github-app-token with no permissions: input, so the token inherits the full permission set of the GitHub App installation instead of a scoped subset.
  • Impact: If any step in these jobs is compromised (malicious dependency, prompt injection into an agent step, supply-chain issue), the attacker gets a token scoped to everything the app can do, not just what the job needs.
  • Reference: (docs.zizmor.sh/redacted)
  • Status: No GitHub issue exists yet for this finding (checked via search). A fix template already exists in cache memory (fix-templates/zizmor-github-app.md) from 2026-09-04.

2. zizmor github-env: dev-hawk — recurring regression

3. zizmor unpinned-images / bot-conditions

  • unpinned-images (High, 1×, smoke-service-ports.lock.yml): services.redis.image: redis:7 uses a floating tag instead of a digest pin.
  • bot-conditions (High, 1×, squad.lock.yml): pre_activation job's if: condition includes github.actor == 'github-actions[bot]' as a bypass check — actor names are spoofable and shouldn't gate trust decisions.
  • Neither has a dedicated issue yet.

4. zizmor secrets-outside-env (volume driver, Medium)

  • 8,725 occurrences across 296/299 workflows — by far the largest contributor to total finding count, but Medium severity and effectively unchanged day-over-day. Not prioritized for immediate action; noted for completeness since it dominates the raw numbers.

Fix Suggestion for github-app (zizmor)

Issue: GitHub App token minted via actions/create-github-app-token with no permissions: input
Severity: High
Affected Workflows: 4 (squad-game-planner.lock.yml, squad-implement-worker.lock.yml, squad-plan.lock.yml, squad.lock.yml) — 8 occurrences

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by zizmor.

Vulnerability: github-app - dangerous use of GitHub App tokens
Rule: github-app - (docs.zizmor.sh/redacted)

Current Issue:
A workflow step uses actions/create-github-app-token to mint an installation
access token but does not pass a `permissions:` input. Without it, the minted
token inherits ALL permissions granted to the GitHub App installation, not
just the subset the job actually needs. If the job's environment is later
compromised (e.g. via a malicious dependency, prompt injection into an agent
step, or a supply-chain issue in another step), the attacker gets a token
scoped to the app's full installation permissions instead of a minimal set.

Required Fix:
1. Locate the `uses: actions/create-github-app-token@...` step (search for
   "Mint Squad GitHub App token" — all 4 affected workflows share the
   identical step, so there is likely one shared source template/include to
   fix instead of 4 separate files).
2. Add a `permissions:` map under `with:` listing only the scopes the token
   is actually used for downstream (check every place
   `steps.<id>.outputs.token` is consumed to determine the real minimum set,
   e.g. `contents: write`, `issues: write`, `pull-requests: write`).
3. Fix must be applied in the .md source (not the generated .lock.yml), then
   run `make recompile` so it survives the next compile.
4. Re-run zizmor to confirm the finding clears.

Example:
Before:
```yaml
      - name: Mint Squad GitHub App token
        id: squad-app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.SQUAD_GITHUB_APP_ID }}
          owner: ${{ vars.SQUAD_GITHUB_APP_OWNER }}
          private-key: ${{ secrets.SQUAD_GITHUB_APP_PRIVATE_KEY }}

After:

      - name: Mint Squad GitHub App token
        id: squad-app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.SQUAD_GITHUB_APP_ID }}
          owner: ${{ vars.SQUAD_GITHUB_APP_OWNER }}
          private-key: ${{ secrets.SQUAD_GITHUB_APP_PRIVATE_KEY }}
          permissions: >-
            {"contents": "write", "issues": "write", "pull-requests": "write"}

(replace the scope map with whatever this token is actually used for in each
workflow.)

Please apply this fix to all affected workflows via their shared source:
squad-game-planner.lock.yml, squad-implement-worker.lock.yml,
squad-plan.lock.yml, squad.lock.yml


### All Findings Details

<details>
<summary><b>Zizmor severity breakdown (raw counts)</b></summary>

- High: 11
- Medium: 8,801
- Low: 2,408
- Informational: 2,222
- **Total: 13,442**

</details>

<details>
<summary><b>Compiler warnings (gh-aw compiler itself, not one of the 8 tools)</b></summary>

| Warning | Count |
|---|---|
| `sandbox.agent.runtime: cloud-hypervisor` requires human security review | 97 |
| `sandbox.agent.runtime: gvisor` deprecated | 37 |
| `sandbox.agent.runtime: docker-sbx` deprecated | 35 |
| `workflow_dispatch` missing `concurrency.job-discriminator` | 31 |
| Threat detection engine `pi` missing `copilot-requests: write` | 18 |
| Template separator appears mid-line | 15 |
| Prompt references `/tmp/` directly instead of `/tmp/gh-aw/agent/` | 10 |
| Missing required permissions for GitHub toolsets | 8 |

199 / 299 workflows have at least one compiler warning. These are gh-aw's own compile-time diagnostics, distinct from the 8 static-analysis tools, kept here for completeness.

</details>

### Historical Trends

- **Previous Scan**: 2026-09-04 (issue #58390, still open)
- **Total zizmor findings then**: 13,436
- **Total zizmor findings now**: 13,442
- **Change**: +6 (+0.04%) — essentially flat, entirely within `secrets-outside-env`

#### New Issues
None — all 4 High findings are carried over unchanged from 2026-09-04.

#### Resolved Issues
`github_action_from_unverified_creator_used` (info, was ~29/day from 2026-08-22 through 2026-09-02) remains absent for a **2nd consecutive day**, increasingly looking like a genuine fix rather than a fluke.

### Recommendations

1. **Immediate**: Get the instrumentation-gap fix (#58717) merged — six of eight tools have been dark for two days, which hides any real regressions in poutine/runner-guard/syft/grype/yamllint/shellcheck coverage.
2. **Immediate**: File a fix for the 3 net-new zizmor High findings that have no issue yet — `github-app` (4 squad-* workflows), `unpinned-images` (smoke-service-ports), `bot-conditions` (squad.lock.yml).
3. **Short-term**: Investigate why dev-hawk's `github-env` finding keeps regressing after 6 prior fixes — likely a template/source-generation issue, not a one-off code bug.
4. **Long-term**: Once poutine/runner-guard/syft/grype/yamllint/shellcheck data resumes, re-baseline against the last known-good run (2026-09-02) rather than treating the 2-day gap as "0 findings."

### Next Steps

- [ ] Merge #58717 to restore poutine/runner-guard/syft/grype/yamllint/shellcheck output
- [ ] Fix `github-app` unscoped token permissions in the 4 squad-* workflows (fix prompt above)
- [ ] Fix `unpinned-images` in smoke-service-ports.lock.yml (pin redis image to digest)
- [ ] Fix `bot-conditions` spoofable actor check in squad.lock.yml
- [ ] Root-cause dev-hawk's recurring `github-env` regression (6th recurrence)

**References:**
- Prior report: #58390
- Instrumentation gap tracking: #58562
- Instrumentation gap fix (WIP): #58717
- Workflow run: [§33945254017](https://github.com/github/gh-aw/actions/runs/33945254017)

> [!WARNING]
> <details>
> <summary>Firewall blocked 1 domain</summary>
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `api.anthropic.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "api.anthropic.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
> </details>

> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/33945254017) · claude · agent · 253.2 AIC · ⌖ 10.5 AIC · ⊞ 11.9K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-09-12T04:56:21.687Z --> on Sep 11, 2026, 8:56 PM UTC-08:00

<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 33945254017, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/33945254017 -->

<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    automationcookieIssue Monster Loves Cookies!security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions