[static-analysis] RGS-018: Suspicious Payload Execution Pattern in ci-coach.lock.yml

[github-actions]

🚨 Runner-Guard Security Finding

Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File: .github/workflows/ci-coach.lock.yml (and 36 other workflows)
Line: 420
Total Occurrences: 39 across 37 workflows

Description

A workflow run: block contains code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains, known malware marker variables, persistence file paths, and C2 communication patterns.

Affected Code Pattern

The flagged pattern is a jq heredoc utility script that appears in many workflows:

cat > /tmp/gh-aw/jqschema.sh << 'EOF'
#!/usr/bin/env bash
# jqschema.sh
jq -c '
def walk(f):
  . as $in |
  if type == "object" then
    reduce keys[] as $k ({}; . + {($k): ($in[$k] | walk(f))})
  elif type == "array" then
    if length == 0 then [] else [.[0] | walk(f)] end
  else
    type
  end;
walk(.)
'
EOF
chmod +x /tmp/gh-aw/jqschema.sh

Assessment

This finding is likely a false positive — the jq utility script is a standard JSON schema walker and does not contain malicious code. However, runner-guard's threat signature database is matching on patterns within this heredoc (e.g., walk(f), reduce keys[], type patterns) that overlap with known IOC signatures.

The underlying concern runner-guard raises is valid in general: heredoc scripts written to temp files can be a vector for supply chain attacks, and the pattern cat > /path/script.sh << 'EOF' ... chmod +x is frequently used in malware.

Impact

While this specific instance appears benign, the pattern is worth reviewing because:

1. The script is written to /tmp/gh-aw/jqschema.sh which persists across steps
2. If a supply chain attack replaced this content, it would execute with full runner privileges
3. 37 workflows share this exact pattern, creating a wide attack surface

Remediation

Consider one of the following approaches:

Option 1 — Move the jq script to a checked-in file in the repository:

- name: Setup jq utilities directory
  run: |
    mkdir -p /tmp/gh-aw
    cp .github/scripts/jqschema.sh /tmp/gh-aw/jqschema.sh
    chmod +x /tmp/gh-aw/jqschema.sh

Option 2 — Add a poutine/runner-guard suppression comment with justification:

# runner-guard:ignore RGS-018 reason: jqschema.sh is a static jq utility with no external inputs
run: |
  cat > /tmp/gh-aw/jqschema.sh << 'EOF'
  ...

Option 3 — Validate the script hash after creation to detect tampering.

Affected Workflows (Top 10)

api-consumption-report, audit-workflows, changeset, ci-coach, cli-version-checker, cloclo, copilot-agent-analysis, copilot-opt, copilot-pr-merged-report, copilot-pr-nlp-analysis, and 27 more.

---

Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25118934458

Generated by Static Analysis Report · ● 433.2K · ◷

• expires on May 6, 2026, 3:58 PM UTC

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #29177

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.