[static-analysis] Report - 2026-10-25 #71826

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 21,964
• Workflows Scanned: 348
• Workflows Affected: 348 (every workflow carries at least one low-severity zizmor finding)

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

Poutine Supply Chain Findings

Actionlint Linting Issues

Syft SBOM Inventory

github-mcp-server image bumped v2.0.2 → v2.0.3 since the 2026-10-24 scan (digest changed, package count unchanged at 41). All other 11 image digests are unchanged.

Runner-Guard Taint Analysis Findings

Runner-Guard Score: not reported in this scan's output (no score/grade line present in compile-output.txt).

Issues created this run: 0. Every Critical/High runner-guard finding was directly re-verified via issue_read (GitHub search_issues/list_issues remain blocked by an "integrity policy" filter in this environment, confirmed again today) and dedups to an already-closed issue:

Resolved since last scan: video-analyzer.lock.yml's RGS-018 finding is gone — its companion issue #71352 was closed (not_planned) on 2026-10-24, and the finding no longer appears, dropping RGS-018 from 6 to 5.

Grype Container Vulnerability Findings

All 12 images were planned and completed successfully (0 failed, 0 incomplete).

Yamllint YAML Linting Findings

No findings (0/0) — clean, consistent with recent scans.

Shellcheck Shell Linting Findings

New today: a cluster of SC2034/SC2041/SC2254 findings on a shared "Fetch additional refs" step, newly surfacing in daily-safeoutputs-git-simulator.lock.yml, smoke-claude.lock.yml, and smoke-update-cross-repo-pr.lock.yml. This mirrors the embedded shellcheck findings reported by actionlint above — same codes, same step — suggesting a single shared script/template is the common cause. Not yet root-caused.

Top Priority Issues

1. zizmor dangerous-triggers + bot-conditions (High) on command/bot workflows

• Tool: zizmor
• Count: 4 (3 dangerous-triggers + 1 bot-conditions)
• Severity: High
• Affected: ai-moderator.lock.yml, q.lock.yml, squad.lock.yml
• Description: issue_comment is flagged as a fundamentally insecure trigger; squad.lock.yml additionally has a spoofable bot-actor check.
• Impact: All 3 gate real execution behind an activation job checking actor/author association, so impact is architecturally mitigated — but zizmor flags the trigger/check pattern regardless of downstream gating. Open since 2026-10-22 (dangerous-triggers) with no fix issue filed yet.
• Reference: (docs.zizmor.sh/redacted), (docs.zizmor.sh/redacted)

2. zizmor unpinned-images (High), 26+ days open

• Tool: zizmor
• Count: 1
• Severity: High
• Affected: smoke-service-ports.lock.yml
• Description: Unpinned image reference in a services: block.
• Impact: Longest-standing open High finding in this repo with no tracking issue.
• Reference: (docs.zizmor.sh/redacted)

3. zizmor secrets-outside-env (Medium, highest volume)

• Tool: zizmor
• Count: 12,539
• Severity: Medium
• Affected: 340 of 348 workflows
• Description: ${{ secrets.X }} referenced outside a dedicated GitHub Actions environment: block.
• Impact: Low per-instance risk but dominates the total finding count by volume. See fix suggestion below.
• Reference: (docs.zizmor.sh/redacted)

4. grype Critical CVEs with available fixes

• Tool: grype
• Count: 67 critical findings, ~26 unique CVE/advisory IDs
• Severity: Critical
• Affected: ghcr.io/oraios/serena:1.7.0, ghcr.io/xberg-io/xberg:1.3.6, ghcr.io/github/gh-aw-firewall/agent:0.28.70, grafana/mcp-grafana, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/github-mcp-server
• Description: Known CVEs in base-image packages, most with a fixed version already published upstream (curl, openssl, python, pyjwt, pillow, certifi, Go stdlib/x/net).
• Impact: serena/xberg/grafana are third-party images gh-aw depends on; for images gh-aw controls directly (firewall, mcpg, github-mcp-server) a version bump is the actionable fix.

Fix Suggestion for zizmor secrets-outside-env (highest-volume finding)

Issue: Secrets referenced in run:/with:/env: outside a dedicated GitHub Actions environment: block
Severity: Medium
Affected Workflows: 340 of 348 workflows (12,539 occurrences)

Prompt to Copilot Agent:

You are fixing a security hygiene finding identified by zizmor.

Vulnerability: secrets-outside-env
Rule: secrets-outside-env - (docs.zizmor.sh/redacted)

Current Issue:
A step references `${{ secrets.SOME_TOKEN }}` (directly, or via `env:`/`with:`)
in a job that does not declare a dedicated `environment:` block. Without an
environment, GitHub does not enforce environment-level protection rules
(required reviewers, wait timers, deployment branch restrictions) around
secret access, and the secret is available to every step in the job rather
than being scoped.

Required Fix:
1. For each affected job, add an `environment:` key naming a dedicated
   GitHub Actions environment for that job (create the environment in repo
   settings if it does not exist, with appropriate protection rules).
2. This repository generates workflows from Markdown via `gh aw compile` --
   fix the root cause once in the Go compiler template/generator that emits
   the job, not by hand-editing each `.lock.yml`. Hand-editing a generated
   file will be overwritten the next time `make recompile` runs.
3. Re-run `gh aw compile` (or `make recompile`) and confirm the zizmor
   `secrets-outside-env` count drops across all regenerated workflows.

Example:
Before:
```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: curl -H "Authorization: Bearer ${{ secrets.DEPLOY_TOKEN }}" ...
```

After:
```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: curl -H "Authorization: Bearer ${{ secrets.DEPLOY_TOKEN }}" ...
```

Please apply this fix at the compiler-template level that generates agent/
safe-outputs jobs referencing secrets, since the 12,539 occurrences span 340
auto-generated workflow files rather than being hand-authored per file.

Historical Trends

• Previous Scan: 2026-10-24
• Total Findings Then: 21,949
• Total Findings Now: 21,964
• Change: +15 (+0.07%)

New Issues

• No new issue types. A new (currently unattributed) shellcheck/actionlint-shellcheck cluster surfaced on a shared "Fetch additional refs" step in 3 workflows (daily-safeoutputs-git-simulator.lock.yml, smoke-claude.lock.yml, smoke-update-cross-repo-pr.lock.yml).

Resolved Issues

• runner-guard RGS-018 on video-analyzer.lock.yml — finding is gone (issue [static-analysis] RGS-018: Suspicious Payload Execution Pattern in video-analyzer.lock.yml #71352 closed 2026-10-24).
• zizmor obfuscation rule — 39 findings/31 workflows on 2026-10-24, 0/0 today. Unconfirmed cause (genuine fix vs. ruleset change).

Recommendations

1. Immediate: Investigate the new shellcheck/actionlint cluster on the shared "Fetch additional refs" step (3 workflows) before it spreads further.
2. Short-term: File a tracking issue for zizmor dangerous-triggers/bot-conditions (3 workflows) and the 26+ day-old unpinned-images finding — neither has a dedicated fix issue yet.
3. Short-term: Bump base images/dependencies with already-published fixes for the grype Critical CVEs (curl, openssl, pillow, certifi, pyjwt, Go stdlib/x/net) in the images gh-aw controls directly (firewall, mcpg, github-mcp-server).
4. Long-term: Fix the actionlint expression property-gap at the compiler-template level (needs-context object type for safe-outputs conclusion jobs), and apply the secrets-outside-env → environment: fix broadly since it affects 340 of 348 workflows.
5. Prevention: Investigate why the RGS-012 runner-guard:ignore suppression on github-remote-mcp-auth-test.lock.yml is not honored by the scanner despite being present in the source — this may affect every other suppression comment in the repo.

Next Steps

• Root-cause the new "Fetch additional refs" shellcheck/actionlint cluster (3 workflows)
• File a tracking issue for zizmor dangerous-triggers/bot-conditions and the 26+ day-old unpinned-images finding
• Bump images/dependencies for grype Critical CVEs with available fixes
• Apply the secrets-outside-env → environment: fix at the compiler-template level
• Fix the actionlint needs-context expression property gap (161 occurrences, 39 workflows)
• Investigate why the RGS-012 runner-guard:ignore suppression isn't honored by the scanner
• Confirm whether the zizmor obfuscation rule's disappearance is a genuine fix

References:

• This run: §40163103016

Generated by 📊 Static Analysis Report · claude · agent · ~223 AIC · ⌖ ~1 AIC · ⊞ 4.7K · ◷

• expires on Oct 31, 2026, 9:28 PM UTC-08:00